joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41deac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41df05
test eax, edx
je 0x41df08
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41dec3
movzx eax, word [eax]
sub eax, ecx
jmp 0x41deea
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41deeb
add ecx, 4
js 0x41dedb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41dee8
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41deea
xor eax, eax
ret
test eax, eax
je 0x41df14
test edx, edx
jne 0x41deb4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41ee4c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x41ee79
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4228e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x422921
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409d10
jmp 0x42292a
mov eax, ebx
mov edx, esi
call fcn.00409f68
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x422934
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x422956
movzx eax, word [esp]
jmp 0x422958
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x423c54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x423d79
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00423a5c
mov esi, eax
mov eax, dword [0x4e0a4c]
cmp byte [eax], 0
je 0x423d21
mov eax, dword [0x4e08a0]
call fcn.0040768c
call fcn.00406f60
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x423c24]
call fcn.0040bc98
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x423d94
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x423d5d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4e0868]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4e4624]
call fcn.0040c088
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423d80
lea eax, [ebp - 4]
mov edx, dword [0x423c24]
call fcn.0040bdbc
ret
Function at 0x424e38
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x424f38
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409fb0
lea eax, [ebp - 4]
call fcn.0040a118
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a65c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x424f22
mov eax, ebx
call fcn.00406e0c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x424f1b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a65c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x424f05
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x424f4c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x424f05
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424f22
mov eax, dword [ebp - 0x10]
call fcn.00406e28
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424f3f
lea eax, [ebp - 4]
call fcn.00409b88
ret

Function at 0x425ce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a058
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040ec2c
mov edi, eax
cmp edi, 0x104
jbe 0x425c8b
mov eax, edi
add eax, eax
call fcn.00406e0c
mov esi, eax
jmp 0x425c8d
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040ec2c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x425cc6
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x425cb0
mov eax, esp
cmp esi, eax
je 0x425cd3
mov eax, esi
call fcn.00406e28
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x425d0c
cmp bl, 0
je 0x425d08
cmp bl, 0x41
jl 0x425d03
cmp bl, 0x5a
jg 0x425d03
or bl, 0x20
xor al, bl
inc esi
jmp 0x425ce7
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x425c4c

Function at 0x426568
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a700
add esp, 0x800
pop ebx
ret
Function at 0x47d820
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47d828
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b0024
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b00c2
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b0086
cmp byte [ebx + 0x11], 0
jne 0x4b0086
cmp byte [ebx + 0x24], 0
jne 0x4b0086
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b00a7
lea edx, [ebp - 4]
mov eax, dword [0x4e0a08]
call fcn.0040eb98
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48ad14]
call fcn.00423dc4
call fcn.00409204
jmp 0x4b00a7
lea edx, [ebp - 8]
mov eax, dword [0x4e0a08]
call fcn.0040eb98
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48ad14]
call fcn.00423dc4
call fcn.00409204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b00c9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409be8
ret

Function at 0x4b08dc
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b092a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004afea4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0943
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b094c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004afea4
dec esi
jne 0x4b096e
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4cfe5c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4cfef6
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4cfe7b
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4cff0c
dec edx
je 0x4cff41
jmp 0x4cff92
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4cff92
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d00a4
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4d00c3
add edx, 3
sar edx, 2
test edx, edx
jle 0x4d01d1
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4d00f8
je 0x4d013b
sub ecx, 0x2b
je 0x4d0131
sub ecx, 4
je 0x4d0136
dec ecx
sub ecx, 0xa
jb 0x4d0123
jmp 0x4d013e
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4d010a
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4d0115
jmp 0x4d013e
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4d013e
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4d013e
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4d013e
mov byte [eax], 0x3e
jmp 0x4d013e
mov byte [eax], 0x3f
jmp 0x4d013e
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4d00db
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4d018f
cmp byte [esp + 7], 0xff
jne 0x4d018f
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4d01c6
cmp dl, 0xff
je 0x4d01c6
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4d00d2
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4d286c
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov edx, ecx
dec edx
test edx, edx
jb 0x4d2887
inc edx
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x4d287c
pop edi
pop esi
ret
Function at 0x4d3d80
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, edx
lea edi, [esp + 0xc]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call fcn.004d3d28
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
push eax
mov eax, 0x4e6dd0
mov ecx, 1
mov edx, dword [0x4d3c34]
call fcn.0040bc98
add esp, 4
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jl 0x4d3edb
inc edi
xor esi, esi
mov eax, dword [esp + 8]
cmp dword [eax + 0x10], 0
jne 0x4d3e54
mov ebp, dword [esp + 0x44]
test ebp, ebp
jle 0x4d3e45
push 0x40
push 0x1000
push ebp
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.004d3c9c
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov eax, dword [0x4e6dd0]
mov dword [eax + esi*8], ebx
mov eax, dword [0x4e6dd0]
mov dword [eax + esi*8 + 4], ebp
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
mov edx, ebp
mov eax, ebx
xor ecx, ecx
call fcn.004076f0
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.004d3c6c
jmp 0x4d3ed3
push 0x40
push 0x1000
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.004d3c9c
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov eax, dword [0x4e6dd0]
mov dword [eax + esi*8], ebx
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x10]
mov edx, dword [0x4e6dd0]
mov dword [edx + esi*8 + 4], eax
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
call fcn.004d3c9c
mov edx, dword [esp + 8]
mov edx, dword [edx + 0x10]
mov ecx, ebx
xchg edx, ecx
call fcn.00406fb0
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.004d3c6c
inc esi
dec edi
jne 0x4d3de9
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d4364
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x4d4379
or edx, 0x200
test eax, 0x20000000
je 0x4d43ac
test eax, 0x40000000
je 0x4d4398
test eax, 0x80000000
je 0x4d4393
or edx, 0x40
jmp 0x4d43d3
or edx, 0x20
jmp 0x4d43d3
test eax, 0x80000000
je 0x4d43a7
or edx, 0x80
jmp 0x4d43d3
or edx, 0x10
jmp 0x4d43d3
test eax, 0x40000000
je 0x4d43c4
test eax, 0x80000000
je 0x4d43bf
or edx, 4
jmp 0x4d43d3
or edx, 2
jmp 0x4d43d3
test eax, 0x80000000
je 0x4d43d0
or edx, 8
jmp 0x4d43d3
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x40cf8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
clc
nop
nop
cld
jae 0x40f71b
add byte [ebx], dl
push 0xb7a05400
push 0x2e9c14b
mov ecx, dword [ecx + 0x38]
clc
nop
nop
cld
jae 0x40f3dc
insb byte es:[edi], dx
add byte [eax - 0x49], dl
insb byte es:[edi], dx
dec edi
add ecx, dword [ecx + 0x3c]
push ebp
mov ebp, esp
nop
leave
jmp 0x40d190
mov ecx, ebx
clc
nop
nop
cld
jae 0x40dc58
add byte [ebx], dl
mov edi, 0xa880bd2c
sahf
Function at 0x40fa82
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
jmp 0x40fab1
mov ecx, ebx
clc
nop
nop
cld
jae 0x40fee7
mov bh, 0x51
add ah, bh
inc edi
add byte [eax], al
add byte [eax], al
mov ecx, dword [0xd9bf5759]
sti
inc eax
add byte [edi + 0xc3243c], al
add byte [eax], al
call 0xf1549b84
fdiv dword [ecx + edi*8 + 0x5702c683]
mov edi, 0x40ed15
xchg dword [esp], edi
ret
add ecx, dword [ebx + 0x3c]
clc
Function at 0xaf3e3c
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xf3
movsb byte es:[edi], byte [esi]
sub bl, ch
push ebx
cmp ecx, edi
jne 0xaf3e29
neg ecx
add ecx, 0x10
mov dword [ebp - 0x1c], ecx
or eax, eax
cmp dword [edi], eax
out dx, al
in al, 0x1b
mov dword [0x47333d10], eax
jmp dword [edi]
sbb ch, byte [eax + edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ebp, dword [edi - 0x2ae3c7fd]
scasd eax, dword es:[edi]
add edi, dword [eax]
sbb al, 0xd5
aad 0xd8
push cs
fmul dword [esi]
call [ebp - 4]
loop 0xaf3e25
cmc
push ebp
mov cl, 9
cmp al, byte [ebx + 0x56cbec04]
sbb byte [ebx], 0x88
fimul word [ebx + 0x7c]
and al, 0x14
cmp esi, dword [ecx + ecx*8 - 0x70f8005e]
inc ebp
lodsb al, byte [esi]
lea ebx, [edx]
call 0x119c0c25
mov ah, 0x29
and byte [esi + 0x2bbf8b31], 0xea
fbld tbyte [eax]
jne 0xaf3e65
mov byte [ecx], bl
jmp 0xaf3e3e
mov ecx, esp
add al, byte [edx + 0x46]
cmp al, bl
je 0xaf3e1a
xor bh, 0xff
idiv edi
add ecx, dword [edi + 0x75]
cmp edi, ebx
jne 0xaf3e89
mov byte [ecx], bl
call 0xeb7a0d
loope 0xaf3ef2
je 0xaf3e6f
rol dl, 0x91
aam 0xdf
rcr dword [edi - 0x31], 4
test ecx, 0x2474008a
mov al, byte [eax]
je 0xaf3eb7
mov al, byte [ecx]
add ecx, 0x31
sahf
xor eax, 0x104e3f04
jne 0xaf3e8f
mov esp, 0x5526c1e8
mov ebp, 0xba018b06
fist word [esp + esi*4 - 0x57]
ja 0xaf3eb3
shr byte [edx + eax*8 - 0x7d], 1
rol dword [ecx + ebp*4], 0xff
dec dword [edi + 0x45]
add ecx, 4
test eax, 0x454fffff
invalid
invalid
int3
Function at 0xe9ee40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2bd000]
push edi
or ebp, 0xffffffff
jmp 0xe9ee62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xe9ee69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe9ee58
mov eax, 1
add ebx, ebx
jne 0xe9ee7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xe9ee70
jne 0xe9ee8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe9ee70
xor ecx, ecx
sub eax, 3
jb 0xe9eea0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xe9ef12
mov ebp, eax
add ebx, ebx
jne 0xe9eeab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xe9eeb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xe9eedc
inc ecx
add ebx, ebx
jne 0xe9eec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xe9eebd
jne 0xe9eed9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe9eebd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xe9eefc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xe9eeed
jmp 0xe9ee5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xe9eefc
add edi, ecx
jmp 0xe9ee5e
pop esi
mov edi, esi
mov ecx, 0x34cc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xe9ef1a
cmp byte [edi], 0x1e
jne 0xe9ef1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xe9ef1f
lea edi, [esi + 0xa9b000]
mov eax, dword [edi]
or eax, eax
je 0xe9ef97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaa5424]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaa5548]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xe9ef4c
mov ecx, edi
jns 0xe9ef7b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaa5550]
or eax, eax
je 0xe9ef91
mov dword [ebx], eax
add ebx, 4
jmp 0xe9ef69
call dword [esi + 0xaa554c]
mov ebp, dword [esi + 0xaa5554]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xe9efcb
sub esp, 0xffffff80
jmp 0x47b175
Function at 0x10001e84
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, ecx
xor esi, esi
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x10001f8b
push ebx
lea eax, [edi + edi]
push eax
push 1
call fcn.1004c10e
pop ecx
pop ecx
mov ebx, eax
push ebx
push edi
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10001f7f
mov ecx, 0x400
lea eax, [edi + 1]
cmp edi, ecx
push 2
cmovb eax, ecx
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10045a56
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov dword [esp], str.SpecialBuild
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10001f78
cmp dword [ebp - 4], esi
jbe 0x10001f78
push esi
call fcn.10045856
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10045a56
pop ecx
pop ecx
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
call fcn.10045856
pop ecx
push ebx
call fcn.1004e96a
pop ecx
mov eax, esi
pop ebx
jmp 0x10001f90
mov eax, 0x1007a938
pop edi
pop esi
leave
ret