joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63758c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x637594
push ecx
push ebx
xor eax, eax
push ebp
push 0x6376de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005ec920
mov edx, dword [ebp - 0x10]
mov eax, 0x65ce14
call fcn.00408aec
lea eax, [ebp - 0x14]
mov ecx, dword [0x65ce14]
mov edx, 0x6376f8
call fcn.00409a14
mov eax, dword [ebp - 0x14]
call fcn.005f5130
mov eax, dword [0x655878]
cmp byte [eax], 0
je 0x6375ef
mov eax, dword [0x65ce14]
call fcn.005f483c
lea edx, [ebp - 0x18]
mov eax, dword [0x65ce14]
call fcn.005a274c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x637740
call fcn.00409a14
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x637685
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x39
call fcn.005ab224
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.004207c0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.005a4d44
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x6e
call fcn.005ab1f4
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41992c]
call fcn.004265d4
call fcn.00407e08
lea eax, [ebp - 8]
call fcn.0060e1c8
cmp dword [ebp - 8], 0
je 0x6376b6
lea eax, [ebp - 0xc]
mov ecx, 0x63775c
mov edx, dword [ebp - 4]
call fcn.00409a14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00637534
mov eax, dword [ebp - 0xc]
call fcn.0060e220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6376e5
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040876c
ret

Function at 0x63a074
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x65d0fd], 1
call fcn.005ee750
test al, al
jne 0x63a0c6
push 5
mov eax, dword [0x655774]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x655774]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x655788]
mov eax, dword [eax + 0x130]
mov cl, 2
xor edx, edx
call fcn.00639e14
ret

Function at 0x63d924
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x63d949
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63f874
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x63f8a0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x63f8a9
call fcn.0063e578
mov eax, 0xa
call fcn.005a5158
call fcn.0063e578
call fcn.0063f840
test al, al
jne 0x63f87e
pop ebx
ret

Function at 0x63fdcc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x655238]
cmp dword [eax], 0
je 0x63fe77
mov eax, dword [0x655238]
mov eax, dword [eax]
call fcn.004f969c
test al, al
je 0x63fe77
mov eax, dword [0x655238]
mov eax, dword [eax]
cmp byte [eax + 0x215], 0
je 0x63fe21
cmp byte [ebx + 0x3e1], 0
jne 0x63fe21
mov eax, dword [0x655774]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x63fe25
xor eax, eax
jmp 0x63fe27
mov al, 1
mov ebx, eax
mov eax, dword [0x655238]
mov eax, dword [eax]
call fcn.004f92c8
push 0xfffffffffffffff0
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x63fe77
test bl, bl
je 0x63fe63
push 5
mov eax, dword [0x655238]
mov eax, dword [eax]
call fcn.004f92c8
push eax
call sub.user32.dll_ShowWindow
jmp 0x63fe77
push 0
mov eax, dword [0x655238]
mov eax, dword [eax]
call fcn.004f92c8
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x63ff28
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov byte [0x65d0b6], 0
push 0x6400b4
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
push 0x6400d0
push ebx
call fcn.00412174
mov esi, eax
test esi, esi
je 0x63ffd0
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x63ffd0
cmp word [esp], 0
je 0x63ffd0
mov byte [0x65d0b6], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x63ff94
sub ax, 0xb4
je 0x63ffa0
sub ax, 0x8464
je 0x63ffac
sub ax, 0x2400
je 0x63ffb8
jmp 0x63ffc4
mov byte [0x655085], 1
jmp 0x64006c
mov byte [0x655085], 3
jmp 0x64006c
mov byte [0x655085], 2
jmp 0x64006c
mov byte [0x655085], 4
jmp 0x64006c
mov byte [0x655085], 0
jmp 0x64006c
push 0x6400f0
push ebx
call fcn.00412174
test eax, eax
je 0x640018
lea edx, [esp + 8]
push edx
call eax
push 0x640118
push ebx
call fcn.00412174
mov esi, eax
test esi, esi
je 0x640022
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x640022
cmp dword [esp + 4], 0
je 0x640022
mov byte [0x65d0b6], 1
jmp 0x640022
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [esp + 8]
sub ax, 1
jb 0x640041
sub ax, 5
je 0x64004a
sub ax, 3
je 0x640053
sub ax, 3
je 0x64005c
jmp 0x640065
mov byte [0x655085], 1
jmp 0x64006c
mov byte [0x655085], 3
jmp 0x64006c
mov byte [0x655085], 2
jmp 0x64006c
mov byte [0x655085], 4
jmp 0x64006c
mov byte [0x655085], 0
cmp byte [0x65d0b6], 0
je 0x6400ad
call fcn.005eb370
test al, al
je 0x6400a6
push 0x640138
push ebx
call fcn.00412174
test eax, eax
je 0x6400a6
push 0x64016c
push 0x64018c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412174
test eax, eax
jne 0x6400ad
mov byte [0x65d0b6], 0
add esp, 0x2c
pop esi
pop ebx
ret

Function at 0x6401a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x640218
mov edx, 0x80000002
xor eax, eax
call fcn.005a41dc
test eax, eax
jne 0x640211
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x64026c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x640208
cmp dword [ebp - 0xc], 4
jne 0x640208
cmp dword [ebp - 8], 4
jne 0x640208
movzx eax, word [ebp - 0x10]
mov word [0x65d0cc], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x640414
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6404c3
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x65d0c8], eax
cmp byte [0x65d0b5], 0
je 0x6404c3
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x6404b4
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6404c3
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x65d0cc], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x65d0ce], al
movzx eax, word [esp + 0x22c]
mov word [0x65d0d0], ax
jmp 0x6404c3
cmp eax, 4
jne 0x6404c3
call fcn.006401a8
call fcn.00640284
add esp, 0x230
ret

Function at 0x641444
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6414ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x641508
push ebx
push 0x641518
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00409a9c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405ce4
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x6414ca
mov eax, dword [0x655788]
mov eax, dword [eax + 0x1c0]
call fcn.0064139c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6414f3
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x641e60
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64204e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005a3dac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.005ec7a4
test al, al
jne 0x641ecd
xor eax, eax
push ebp
push 0x641ec3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.005ecc9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x641ecd
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
mov eax, dword [0x65d1a8]
call fcn.004097c0
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x641efc
mov eax, dword [0x655788]
mov eax, dword [eax + 0x1bc]
call fcn.0064139c
push 0x80
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x659634]
push eax
push 0
mov ecx, 0x64205c
mov edx, 0x642060
xor eax, eax
call fcn.00412e94
mov dword [ebp - 8], eax
push 0x64155c
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x65d1d4], eax
xor eax, eax
push ebp
push 0x642017
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x655774]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.005a3778
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x64207c
call fcn.00421bb4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.005a3658
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004099bc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00641444
mov dword [ebp - 0xc], eax
call fcn.00641520
test al, al
jne 0x641ff7
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x641fd5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64201e
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x6433c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x643674
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x655774]
mov eax, dword [eax]
mov edx, 0x643690
call fcn.00596034
push 5
mov eax, dword [0x655774]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x64363b
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0063a300
lea eax, [ebp - 0x10]
call fcn.005a3c24
mov eax, dword [ebp - 0x10]
call fcn.004216dc
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005a3778
mov edx, dword [ebp - 0x14]
mov eax, 0x65d1a8
call fcn.00408aec
call fcn.0064172c
lea ecx, [ebp - 0x18]
mov edx, 0x6436b0
mov eax, dword [0x65d1a8]
call fcn.005a2838
mov edx, dword [ebp - 0x18]
mov eax, 0x65d1ac
call fcn.00408aec
lea ecx, [ebp - 0x1c]
mov edx, 0x6436c8
mov eax, dword [0x65d1a8]
call fcn.005a2838
mov edx, dword [ebp - 0x1c]
mov eax, 0x65d1b0
call fcn.00408aec
push 2
push 0
push 1
mov ecx, dword [0x65d1a8]
mov dl, 1
mov eax, dword [0x5a9378]
call fcn.005a9cd4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x643518
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005a9c94
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005a9c6c
cmp dword [ebp - 0xc], 0x67734d49
je 0x6434f3
mov cl, 1
xor edx, edx
mov eax, dword [0x65d1b0]
call fcn.005ab3d0
jmp 0x643502
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x65d1a8]
call fcn.005ab3d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64351f
mov eax, dword [ebp - 4]
call fcn.004069c8
ret
Function at 0x64380c
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x643949
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x643964
mov edx, ebx
call fcn.00409a14
mov eax, dword [ebp - 0x25c]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x643923
xor eax, eax
push ebp
push 0x64391c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x643980
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0042185c
test eax, eax
jne 0x6438ed
test byte [ebp - 0x258], 0x10
jne 0x6438ed
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00409864
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409a14
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x6438e5
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004210dc
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x64387d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x643923
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x643950
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040876c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x64398c
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x643a8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040870c
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005a2cd0
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x643aa4
call fcn.00421bb4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00409a14
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x643a2a
test esi, 0x10
jne 0x643a5a
test esi, 1
je 0x643a2a
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x643a54
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00408aec
jmp 0x643a67
inc edi
cmp edi, 0xa
je 0x643a67
inc ebx
cmp ebx, 0x3e8
jne 0x6439cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x643a91
lea eax, [ebp - 0x14]
call fcn.0040870c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x50d040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x147000
lea edi, [esi - 0xb6000]
push edi
jmp 0x50d05a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50d061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d050
mov eax, 1
add ebx, ebx
jne 0x50d073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50d084
jne 0x50d0a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d0a3
dec eax
add ebx, ebx
jne 0x50d090
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50d068
add ebx, ebx
jne 0x50d09f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50d0f5
xor ecx, ecx
sub eax, 3
jb 0x50d0bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50d12a
sar eax, 1
mov ebp, eax
jmp 0x50d0c6
add ebx, ebx
jne 0x50d0c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d094
inc ecx
add ebx, ebx
jne 0x50d0d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d094
add ebx, ebx
jne 0x50d0e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50d0d6
jne 0x50d0f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50d0d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50d114
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50d106
jmp 0x50d056
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50d114
add edi, ecx
jmp 0x50d056
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50d132
cmp byte [edi], 0x11
jne 0x50d132
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50d137
lea edi, [esi + 0x106000]
mov eax, dword [edi]
or eax, eax
je 0x50d1af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x141a34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x141bb0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50d164
mov ecx, edi
jns 0x50d193
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x141bb4]
or eax, eax
je 0x50d1a9
mov dword [ebx], eax
add ebx, 4
jmp 0x50d181
call dword [esi + 0x141bc4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x50d1e0
cmp al, 0xef
ja 0x50d1d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x50d1b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x50d1c2
mov ebp, dword [esi + 0x141bb8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50d214
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x41c480
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x414015
lea edi, [esi - 0x13015]
mov dword [edi + 0x153f0], 0x7c354039
push edi
or ebp, 0xffffffff
jmp 0x41c4aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c4b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c4a0
mov eax, 1
add ebx, ebx
jne 0x41c4c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c4b8
jne 0x41c4d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c4b8
xor ecx, ecx
sub eax, 3
jb 0x41c4e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c55a
mov ebp, eax
add ebx, ebx
jne 0x41c4f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c500
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c524
inc ecx
add ebx, ebx
jne 0x41c510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c505
jne 0x41c521
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c505
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c544
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c535
jmp 0x41c4a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c544
add edi, ecx
jmp 0x41c4a6
pop esi
mov edi, esi
mov ecx, 0x67c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c562
cmp byte [edi], 7
jne 0x41c562
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41c567
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c5d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c594
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c058]
or eax, eax
je 0x41c5d0
mov dword [ebx], eax
add ebx, 4
jmp 0x41c5b1
call dword [esi + 0x1c054]
mov ebp, dword [esi + 0x1c05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x1c631]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41c622
sub esp, 0xffffff80
jmp 0x4014a0

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x438ca7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x438a14
mov ecx, dword [esp]
add esp, 4
push 0x3930084
mov edx, dword [esp]
add esp, 4
dec esi
call fcn.00438ce7
or esi, edx
xor dword [eax], ecx
and edx, esi
mov edx, edx
add eax, 1
dec esi
add edx, edx
cmp eax, ebx
jne fcn.00438ca7
sub edx, 0x9f4e4df4
mov edx, esi
ret
Function at 0x405001
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x405015
cmp dl, 0xcc
jne 0x40505f
inc eax
cmp eax, 0xffffffff
jle 0x405008
mov al, byte [ecx]
cmp al, 0x8b
je 0x405025
cmp al, 0x89
jne 0x40505f
cmp byte [ecx + 1], 0xff
jne 0x40505f
mov eax, 0x4053b7
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x4418b0], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x424118]
push eax
call dword [0x42410c]
mov al, 1
ret 0xc
xor al, al
jmp 0x40505c

Function at 0x4083e2
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4083f2
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4083ef
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x4083ef
add ecx, 0x2b
cmp word [eax + 0x18], cx
sete al
ret