joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x3a]
test dword [esp + edi*8 - 0x39bb0001], edi
test dword [ebp + 0x55fffffc], edi
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00401403
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004013b8
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
invalid

Function at 0x40236f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor dh, al
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
and esi, eax
test dword [edi + 0x3afffffc], esp
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
sub al, 0xc6
test dword [edx + 0x14fffffc], ebp
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00401403
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004013b8
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004013f3
pop ss
cwde
sub eax, 0x1046864
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.004013f3
fcomi st(3)
insb byte es:[edi], dx
les eax, [eax - 0x7fff1f9b]
loope 0x402415
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0

Function at 0x402823
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x402849
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x4027f3
call fcn.004013f3
sub esi, dword [esi]
jl 0x402838
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
invalid
test edx, esp
clc
invalid
Function at 0x404545
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.00401458
push 2
mov ecx, esi
call fcn.004027aa
mov edi, dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push eax
push 1
call edi
mov ecx, dword [esi]
and word [ecx], 0
and dword [esi + 4], 0
test eax, eax
jbe 0x404598
lea ebx, [eax + 1]
push ebx
mov ecx, esi
call fcn.004027aa
push eax
push ebx
call edi
mov edi, dword [esi]
push edi
call fcn.0040115e
and word [edi + eax*2], 0
pop ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
and dword [ebp + 8], 0
lea ecx, [eax + 0xf]
mov dword [ebp - 4], ecx
lea ebx, [eax + eax]
push dword [ebp - 4]
mov ecx, esi
call fcn.004027aa
push dword [ebp + 8]
add eax, ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [esi]
push edi
call fcn.0040115e
and word [edi + eax*2], 0
add esp, 0x10
push dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4045ed
inc dword [ebp + 8]
cmp dword [ebp + 8], 0xfff
jl 0x4045a8
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x404f67
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.00401458
lea ecx, [ebp - 0x18]
call fcn.00401458
push 0x3c
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x54]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0x10]
xor ebx, ebx
inc ebx
add esp, 0xc
test byte [ebp + 0xc], bl
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x50], 0x740
mov dword [ebp - 0x38], ebx
je 0x404fb8
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x50], 0x8740
test byte [ebp + 0xc], 2
je 0x404fc5
mov dword [ebp - 0x48], str.runas
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.00404a97
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401370
cmp dword [ebp - 8], edi
jne 0x404ffa
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40503a
test dword [ebp + 0xc], 0x10000
jne 0x405028
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push esi
jmp 0x404fec
xor ebx, ebx
jmp 0x405031
Function at 0x13d2c7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf dx, ax
jmp 0x13d2c58
mov edx, dword [esp]
rol bx, cl
jns 0x13d2ba5
bsf dx, ax
jmp 0x13d2c58
lea edx, [edx*4]
setnp dh
mov cl, 0xf8
lea esi, [esp]
mov dh, byte [esp]
jmp 0x13d2bbb
jnp 0x13d2c18
inc ecx
jmp 0x13d2c19
mov dx, 0xfbb0
call fcn.013d2c38
inc eax
fimul word [ebx + ebp - 0x1a]
and eax, 0xc6a333b2
xor eax, 0xaa34a8f7
int 0x3c
mov ah, byte [ecx - 0x74bedc20]
fisttp qword [ebx + 0x24148acc]
inc ecx
mov ebx, ebp
mov ecx, esp
mov dl, byte [esp]
jmp 0x13d2bfa
mov dl, 0x18
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x13d2c68
sub esp, 0xc0
mov edi, esp
mov eax, edx
bsf bx, bx
jmp 0x13d2bf5
lea esp, [esp + 4]
neg ebp
xchg ecx, eax
sub esp, 0x10
jg 0x13d2c84
jle 0x13d2cbf
arpl ax, sp
jbe 0x13d2c8b
loopne 0x13d2ccf
popfd
in al, dx
mov ecx, dword [esp + 4]
jmp 0x13d2c42
jmp 0x13d2cff
cmp eax, 0xbdda44c5
dec esp
mov dh, byte [ebp - 0xf]
popal
add bl, dh
inc esi
jo 0x13d2d0d
push 0xffffffffffffff8b
or al, 0x24
mov dh, al
mov ebp, dword [esp + 0x2c]
jmp 0x13d2be1
lea esp, [esp + 0x10]
add ebp, 0x616e3731
cmp cx, bx
jmp 0x13d2cca
mov cx, word [esp + 0xb]
neg al
xchg cl, ah
jmp 0x13d2d08
ja 0x13d2ce0
mov dx, word [esp]
stc
and al, 0xf9
jmp 0x13d2d20
mov dx, word [esp]
stc
btr dx, bp
mov ecx, dword [esp]
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x13d2d0a
mov cx, word [esp + 0xb]
neg al
xchg cl, ah
jmp 0x13d2ca9
not ebp
bsr edx, ebp
jo 0x13d2d45
mov ebp, 0xf3470d5
retf 0x6651
bswap edx
push ecx
pop cx
jmp 0x13d2d49
btr dx, bp
mov ecx, dword [esp]
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x13d2d0a
push ecx
pop cx
lea ecx, [ecx*4]
lea esp, [esp]
jmp 0x13d2d69
bswap edx
jmp 0x13d2d2f
lea ecx, [ecx*4]
lea esp, [esp]
jmp 0x13d2d69
lea esp, [esp + 2]
ror ebp, 0
mov ah, ch
mov dl, byte [esp]
bswap edx
jmp 0x13d2d98
lea edx, [edi*4]
sub esp, 0x16
jmp 0x13d2e54
btr ecx, ebx
jge 0x13d2d79
lea edx, [edi*4]
sub esp, 0x16
add esp, 3
lea esp, [esp + 3]
jmp 0x13d2e5b
bsf cx, bp
btc ax, sp
mov cx, word [esp]
jmp 0x13d2dfe
not ebp
bsf edx, esi
jo 0x13d2ddb
bsf cx, bp
jmp 0x13d2e1b
add ebp, dword [esi]
xchg ecx, eax
sub esp, 0x14
jno 0x13d2e3b
jo 0x13d2e3b
inc esp
salc
inc esp
and ebx, esi
pushal
salc
dec ebx
fstp xword [esi - 0x138376b3]
bound eax, qword [0x667932f4]
btc eax, esp
btc ax, sp
mov cx, word [esp]
jmp 0x13d2dfe
ficomp dword [eax]
scasd eax, dword es:[edi]
aas
scasd eax, dword es:[edi]
retf 0xf339
call fcn.013d2e25
sbb byte [ebp + 0x5397641d], cl
mov bl, byte [esi]
mov ebx, gs
xchg esp, eax
clc
jae 0x13d2e32
xchg byte [ebp - 0x3a], dh
mul cl
add esp, 3
lea esp, [esp + 3]
lea esp, [esp + 0x10]
jmp 0x13d2df1

Function at 0x13d2e25
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esi*4]
jmp 0x13d2e77
mov eax, ebp
movzx ecx, byte [eax]
btc dx, si
je 0x13d2ec4
xchg edx, eax
jmp 0x13d2e79
jmp 0x13d2e61
lea edx, [ebx*4]
inc dx
mov ax, 0x95e9
jmp 0x13d2ea6
xchg edx, eax
lea edx, [ebx*4]
inc dx
mov ax, 0x95e9
bswap eax
jmp 0x13d2eee
bswap eax
call fcn.013d2ec6
sub cl, bl
lea edx, reloc.kernel32.dll_GetProcAddress
cmc
jnp 0x13d2f39
jp 0x13d2f23
call 0x2e1ad0cf
jmp 0x13d2e8f
rdtsc
mov edx, dword [esp]
jmp 0x13d2ead
or al, dh
rdtsc
Function at 0x13d7c1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0xf41e
mov ax, 0x864b
jmp 0x13d7c48

Function at 0x13dab4f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13dab7a
call 0x13dab4f
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
in eax, 0x7c
adc al, 0xbb
jmp 0x13da7c8
pop eax
sub eax, 0xbb1685bb
jmp 0x13dab3f

Function at 0x1473916
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
add esp, 0xf
sub esp, 9
pop word [esp + 0x1c]
lea eax, [edx - 7]
jmp 0x14738fa
mov edi, edx
xchg bp, bx
mov word [esp + 0xe], bp
mov cl, byte [esp + 4]
bt cx, cx
lea eax, [eax + ecx]
jmp 0x14738cd
mov edx, 0xe8837fcd
mov di, bx
mov ebx, 0x763c6ce6
push word [esp + 0x18]
pop dword [esp + 0xa]
jmp 0x147393b
push dword [esp]
xchg cl, dh
jmp 0x14738e3
xchg cl, dl
xor bl, 0xf3
lea edi, [eax + ebx]
pop si
push word [esp + 0x38]
rdtsc
jmp 0x1473949
mov al, 0x28
pop di
cmc
xchg cx, bp
add esp, 3
pushal
jmp 0x147391d
lea esp, [esp + 0x23]
rdtsc
mov ax, word [esp + 8]
mov ch, 0xfb
push dword [esp + 0xf]
mov si, dx
jmp 0x1473a0b
pushal
pop si
xchg dword [esp + 0x14], ecx
xchg dword [esp + 7], ecx
lea ebx, reloc.kernel32.dll_GetProcAddress
xchg byte [esp + 0x19], bl
jmp 0x147397d
xchg word [esp + 0x11], bx
mov cx, si
bts edi, esi
push word [esp + 0x18]
mov di, word [esp + 1]
lea ecx, [edx + edi]
jmp 0x1473993
pop cx
xchg ecx, eax
neg ax
mov word [esp + 0x18], sp
xchg dword [esp + 0x13], ebp
rol eax, cl
jmp 0x14739c6

Function at 0x14742d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], cl
mov dword [esp], edi
jmp 0x14742de
bswap ebx
cmc
pushal
not ch
pop dx
mov ecx, 0xb8ed8268
jmp 0x1474302
Function at 0x103f3058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x103f31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x103f307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103f306a
add dl, dl
jne 0x103f3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103f30dc
xor eax, eax
add dl, dl
jne 0x103f3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103f317d
add dl, dl
jne 0x103f30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103f30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103f30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103f30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x103f30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x103f3075
mov eax, 1
add dl, dl
jne 0x103f30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103f30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103f30e1
sub eax, ebx
mov ebx, 1
jne 0x103f3128
mov ecx, 1
add dl, dl
jne 0x103f310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103f3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103f3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103f3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x103f313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103f314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103f3136
cmp eax, 0x7d00
jae 0x103f316d
cmp eax, 0x500
jb 0x103f3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103f3075
cmp eax, 0x7f
ja 0x103f3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103f3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x103f319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x103f3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401c66
pop dword [ebp - 0x2c]
mov eax, 0x401c66
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x89be3e12
sub dword [ebp - 0x3c], 0x3b6bf8c7
mov dword [ebp - 0x38], 0xf86452e
sub dword [ebp - 0x38], 0xdd52f8e9
mov dword [ebp - 0x34], 0x56e275e4
sub dword [ebp - 0x34], 0xa9631b6
mov dword [ebp - 0x30], 0x981a6f3e
add dword [ebp - 0x30], 0x67e590c2
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xab43165
add dword [ebp - 0x3c], 0x69be37f1
mov dword [ebp - 0x38], 0x824e834f
add dword [ebp - 0x38], 0xbf1dde26
mov dword [ebp - 0x34], 0xbc58f4e1
sub dword [ebp - 0x34], 0x58e98875
mov dword [ebp - 0x30], 0x5780b1b4
sub dword [ebp - 0x30], 0x5780b1b4
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xcfd82f10
sub eax, 0xcf97fee4
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3682a
push 0
call eax
mov ecx, 0x6193b4d5
add ecx, 0x9e6c9349
xor ebx, ebx
add ebx, eax
mov esi, 0x349d063c
add esi, 0xcba369c4
add esi, dword [ebp - 0x2c]
mov edx, 0xbc32a8c8
add edx, 0xfaa081e6
sub dword [ebp - 0x1c], edx
mov edi, dword [esi]
sub dword [ebp - 0x14], edi
add edi, edx
mov dword [ebx], edi
xor dword [ebp - 0x28], eax
add ebx, 0x83313e44
add ebx, 0x7ccec1c0
add esi, 0x87bc4292
add esi, 0x7843bd72
loop 0x401d80
add eax, 0xc6b77dc
sub eax, 0xc6a6491
xor ebx, ebx
add ebx, eax
add eax, 0x7e671a19
sub eax, 0x7e671a14
mov ecx, 0x6d527d3a
add ecx, 0x92ed82c6
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret

Function at 0x10006710
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x10006723
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000671f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x10006740
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1000677f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10006775
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10006781
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10006765
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4013c0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x41fea0
call fcn.00412d4c
sub esp, 0x520
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, edi
and eax, 0x7f000000
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0xff
mov dword [esi + 4], eax
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], bl
call fcn.00412430
push 0x484
push ebx
push esi
call fcn.00412430
add esp, 0x18
call fcn.00404672
cmp eax, 3
jae 0x40142c
lea eax, [ebp - 0x52c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
and edi, 0xffffff
push edi
mov ecx, esi
call fcn.00401d71
cmp edi, eax
je 0x40149e
test dword [esi], 0x2000000
jne 0x40149e
mov ecx, esi
call fcn.00401bfe
mov eax, dword [esi]
xor eax, edi
and eax, edi
push eax
push str.load__08x
lea eax, [ebp - 0x118]
push 0x100
push eax
call fcn.00412cd2
lea eax, [ebp - 0x118]
add esp, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00412b94
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], vtable.dloader_exception.0
or dword [ebp - 4], 0xffffffff
push 0x42a5a4
lea eax, [ebp - 0x18]
push eax
call fcn.00412cee
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x405418
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
push ebx
push ebp
push esi
mov esi, ecx
push edi
test byte [esi], 2
je 0x405432
or edi, 0xffffffff
mov dword [esp + 0x14], edi
jmp 0x40543f
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, dword [esp + 0x10]
xor ebx, ebx
xor eax, eax
mov ecx, ebx
mov ebp, ebx
mov dword [esp + 0x18], ecx
cmp ax, word [esi + 0x6e]
jae 0x4054b3
mov edx, ebx
mov dword [esp + 0x10], ebx
mov ebx, dword [esi + 0x160]
add ebx, edx
call fcn.0040639e
cmp eax, 3
jae 0x405481
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 8]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40549d
mov eax, dword [ebx + 0xc]
cmp eax, edi
cmovb edi, eax
add eax, dword [esp + 0x10]
cmp eax, ebp
cmova ebp, eax
movzx eax, word [esi + 0x6e]
inc ecx
add edx, 0x28
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edx
cmp ecx, eax
jb 0x405457
xor ebx, ebx
push 0x42fcc8
push 1
mov ecx, 0x42fb70
call fcn.0040d9d1
mov ecx, dword [esi + 0x9c]
push 0x40
push 0x3000
sub ebp, edi
push ebp
add ecx, edi
push ecx
call dword [eax]
mov ecx, dword [esi + 0x9c]
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
test eax, eax
jne 0x405560
call fcn.0040639e
cmp eax, 3
jae 0x40550f
push str.Global585
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40550f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0040639e
cmp eax, 3
jae 0x40552f
push str.327327
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40552f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test byte [esi + 0x7e], 1
je 0x40553c
mov eax, 0x2bc
jmp 0x405583
push 0x42fcc8
push 1
mov ecx, 0x42fb70
call fcn.0040d9d1
push 0x40
push 0x3000
push ebp
push ebx
call dword [eax]
mov dword [esi + 0x14], eax
sub eax, edi
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], ebx
jne 0x40556a
push 8
pop eax
jmp 0x405583
call fcn.0040639e
cmp eax, 3
jae 0x405581
push str.Global747
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret
Function at 0x405640
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
push ebx
mov ebx, ecx
push ebp
mov eax, dword [ebx + 0xe8]
push esi
push edi
test eax, eax
je 0x405734
cmp dword [ebx + 0xec], 0
je 0x405734
mov edi, dword [ebx + 0xc]
add edi, eax
jmp 0x405729
mov eax, dword [ebx + 0xc]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], eax
test eax, eax
je 0x405756
lea eax, [esp + 0x14]
push eax
lea ecx, [ebx + 0x18]
call fcn.00406327
mov esi, dword [edi + 0x10]
add esi, dword [ebx + 0xc]
mov ebp, esi
call fcn.0040639e
cmp eax, 3
jae 0x4056b8
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp dword [edi + 4], 0
je 0x4056c8
cmp dword [edi], 0
je 0x405741
mov esi, dword [ebx + 0xc]
add esi, dword [edi]
cmp dword [esi], 0
je 0x405726
mov edx, dword [esp + 0x14]
sub ebp, esi
mov dword [esp + 0x10], edx
call fcn.0040639e
cmp eax, 3
jae 0x4056f8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [esp + 0x10]
mov ecx, dword [esi]
test ecx, ecx
jns 0x405703
movzx eax, cx
jmp 0x40570b
mov eax, dword [ebx + 0xc]
add eax, 2
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + ebp], eax
test eax, eax
je 0x405746
mov edx, dword [esp + 0x10]
add esi, 4
cmp dword [esi], 0
jne 0x4056d7
add edi, 0x14
mov ecx, dword [edi + 0xc]
test ecx, ecx
jne 0x405671
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret
push 0xb
pop eax
jmp 0x405736
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
jmp dword [sym.imp.KERNEL32.dll_GetLastError]