joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4946e7
Capabilities:
Encode data using xor

Disassembly:
or edx, ecx
adc byte [ecx - 0xbc3e2b9], 0xa6
test byte [eax + 0x53ab09d5], dl
xchg edi, eax
mov edi, 0x258009b3
inc eax
scasd eax, dword es:[edi]
invalid
and dword [ebp - 0x4ea93503], ebx
jno 0x4946ff
lodsd eax, dword [esi]
loope 0x49467c
pop es
lodsd eax, dword [esi]
sal ch, 1
mov cl, 0x3f
cmpsb byte [esi], byte es:[edi]
popal
inc ecx
div ah
insd dword es:[edi], dx
mov dl, 0xfb
sti
popal
jne 0x49474a
popfd
ljmp 0x658a
xchg ecx, eax
in al, 0xf1
aaa
dec ecx
jne 0x49477f
mov ch, byte [edi + eax*4 + 0x34794924]
nop
les ebx, [esp + esi*8 + 0x71]
and al, byte [ecx]
mov esi, 0x7e5a6420
in eax, 0xd
shr al, 1
cmpsd dword [esi], dword es:[edi]
imul eax, dword [eax - 8], 0xf5017430
pop edx
jle 0x494732
or eax, 0x69a7e8d0
inc eax
clc
xor byte [ecx + eax - 0xb], dh
call 0x5a2a6bda
test ecx, edi
xchg edx, eax
sbb dword [edx + 0x64], edi
xor al, 0x30
adc al, 0x56
pop edx
sal dword [ebx - 0x42], 1
enter 0xffffffffffffb4dd, 0x56
mov ah, byte [ecx + 0xb]
sbb byte [ecx + ebp*8 - 0x1e2c5761], 0xdf
sar byte [ecx + 0x4b30beaf], 1
dec ebx
jbe 0x4947bd
push ds
pop es
insb byte es:[edi], dx
aas
xchg ecx, eax
sub dl, byte [eax + 0x3c]
invalid
stosb byte es:[edi], al
lock or byte [esi], cl
in al, dx
sar dword [edi + 0x1a39ea7c], 0xfb
xor byte [eax], al
cmc
loope 0x4947c1
add dword [edi - 0x4f], ecx
inc ebp
add dword [ebx - 0xac8605], edi
int1
mov ah, 0xb9
fist dword [ebp - 0x19bceff2]
adc byte [ebx - 0x1a], al
shr byte [edi + 0x46], cl
rcl dword [eax + 0x35], cl
sbb eax, 0xbe73d1c3
mov bh, 0xca
dec edx
loopne 0x494815
rol byte [edx + 0x547085b7], 0xe3
fisubr word [esi - 0x75]
loope 0x4947d9
outsd dx, dword [esi]
push ecx
fldenv [ecx + 0x34b4f50f]
mov ebx, 0xdca9aff4
mov dword [ebx - 0x39], esp
pop ebx
pop ds
imul edi, dword [ecx], 0xb
xor eax, 0xde3081a6
arpl word [ebx + edi*8 - 0x74fb652b], dx
cmpsb byte [esi], byte es:[edi]
xor dword [eax], 0xfb9463de
aad 0x9a
add al, 0x8b
mov byte [edi - 0x6f], ch
wait
js 0x4947de
inc ebp
aad 0xf5
stosb byte es:[edi], al
retf

Function at 0x4aad9a
Capabilities:
Encode data using xor

Disassembly:
loope 0x4aae0b
xor al, 0xbe
lodsd eax, dword [esi]
das
sbb ebx, dword [ebx - 0x40]
push ds
cmp byte [ebx + 0x64], 0x61
stosd dword es:[edi], eax
scasb al, byte es:[edi]
or al, 0xf5
cmp byte [esp + esi - 0x31c0a62a], bl
je 0x4aae74
xor cl, ah
pop edi
loope 0x4aae78
xchg esi, eax
mov al, 0x28
cmp dl, dh
mov esp, 0xdea1b757
or al, 0x50
jbe 0x4aae17
xchg esi, eax
fisub dword [esi]
cmp al, 0xcf
and byte [ecx], dh
pop esp
aas
push ebp
lahf
wait
jae 0x4aae8d
scasb al, byte es:[edi]
pushal
sbb ebp, dword [ebp + 0x784359cf]
into
aas
call 0xd80f9f22
aad 0xc3
mov eax, 0x3f7a01b
mov word [eax + 0x50e42b14], fs
leave
inc ecx
mov byte [0xee292d8d], al
add al, 0x9f
xchg edx, eax
jnp 0x4aae5d
into
shr dword [ecx + eax*8], 1
mov bh, 0x9e
pop ebx
xchg edi, eax
loope 0x4aae85
invalid
xor byte [edi + 0x10567707], ah
ja 0x4aaed0
adc byte [edx + 0x43], cl
dec edx
inc ebx
and dword cs:[0xbead898], esp
js 0x4aae7b
cmc
and cl, dl
mov dl, 0xc4
invalid
xor dword [eax], esp
ljmp 0xb842
push eax
or al, 0xb9
and byte [edx - 0x2312849d], dl
pushfd
add byte [esi + 0x2720af32], al
invalid
Function at 0x6295d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303b8
cmp edx, dword [eax]
je 0x6295f7
add eax, 8
inc ecx
cmp eax, 0x630448
jl 0x6295e8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303b8]
jne 0x629725
mov eax, dword [0x635d50]
cmp eax, 1
je 0x6296ff
test eax, eax
jne 0x629628
cmp dword [0x6302e0], 1
je 0x6296ff
cmp edx, 0xfc
je 0x629725
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62965f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629fc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a450
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6296a2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a450
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62e634
push edi
call fcn.0062c320
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629fc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629fd0
lea eax, [ebp - 0xa0]
push 0x62e614
push eax
call fcn.00629fd0
push dword [esi + 0x6303bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629fd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c294
add esp, 0x2c
pop edi
jmp 0x629725
lea eax, [ebp + 8]
lea esi, [esi + 0x6303bc]
push 0
push eax
push dword [esi]
call fcn.0062a450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.kernel32
call esi
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431005
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
mov ecx, 0x238545d0
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
mov eax, section..7LWLf
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x16f4f34
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
mov ecx, 0x1ae55cee
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x3fc663eb
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4e5bf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa3000]
push edi
jmp 0x4e5c0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e5c11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5c00
mov eax, 1
add ebx, ebx
jne 0x4e5c23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e5c34
jne 0x4e5c53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5c53
dec eax
add ebx, ebx
jne 0x4e5c40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e5c18
add ebx, ebx
jne 0x4e5c4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e5ca5
xor ecx, ecx
sub eax, 3
jb 0x4e5c6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e5cda
sar eax, 1
mov ebp, eax
jmp 0x4e5c76
add ebx, ebx
jne 0x4e5c76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5c44
inc ecx
add ebx, ebx
jne 0x4e5c84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5c44
add ebx, ebx
jne 0x4e5c91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e5c86
jne 0x4e5ca2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e5c86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e5cc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e5cb6
jmp 0x4e5c06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e5cc4
add edi, ecx
jmp 0x4e5c06
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e5ce2
cmp byte [edi], 0x11
jne 0x4e5ce2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e5ce7
lea edi, [esi + 0xe1000]
mov eax, dword [edi]
or eax, eax
je 0x4e5d5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x119c50]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x119da4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e5d14
mov ecx, edi
jns 0x4e5d43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x119da8]
or eax, eax
je 0x4e5d59
mov dword [ebx], eax
add ebx, 4
jmp 0x4e5d31
call dword [esi + 0x119db8]
mov ebp, dword [esi + 0x119dac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e5d93
sub esp, 0xffffff80
jmp 0x416310
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, reloc.kernel32.dll_GetLongPathNameW
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x415b90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x415baa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415ba0
mov eax, 1
add ebx, ebx
jne 0x415bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415bb8
jne 0x415bd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415bb8
xor ecx, ecx
sub eax, 3
jb 0x415be8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415c5a
mov ebp, eax
add ebx, ebx
jne 0x415bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x415c24
inc ecx
add ebx, ebx
jne 0x415c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415c05
jne 0x415c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415c05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x415c44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x415c35
jmp 0x415ba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x415c44
add edi, ecx
jmp 0x415ba6
pop esi
mov edi, esi
mov ecx, 0x128
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x415c62
cmp byte [edi], 2
jne 0x415c62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x415c67
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x415cd6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x155f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15670]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415c94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15678]
or eax, eax
je 0x415cd0
mov dword [ebx], eax
add ebx, 4
jmp 0x415cb1
call dword [esi + 0x15674]
mov ebp, dword [esi + 0x1567c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415d0a
sub esp, 0xffffff80
jmp 0x4059d0
Function at 0xb14a50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6bd000]
push edi
jmp 0xb14a6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xb14a71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb14a60
mov eax, 1
add ebx, ebx
jne 0xb14a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xb14a94
jne 0xb14ab3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb14ab3
dec eax
add ebx, ebx
jne 0xb14aa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xb14a78
add ebx, ebx
jne 0xb14aaf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xb14b05
xor ecx, ecx
sub eax, 3
jb 0xb14acb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xb14b3a
sar eax, 1
mov ebp, eax
jmp 0xb14ad6
add ebx, ebx
jne 0xb14ad6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb14aa4
inc ecx
add ebx, ebx
jne 0xb14ae4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb14aa4
add ebx, ebx
jne 0xb14af1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xb14ae6
jne 0xb14b02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xb14ae6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xb14b24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xb14b16
jmp 0xb14a66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xb14b24
add edi, ecx
jmp 0xb14a66
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xb14b42
cmp byte [edi], 0x11
jne 0xb14b42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xb14b47
lea edi, [esi + 0x70d000]
mov eax, dword [edi]
or eax, eax
je 0xb14bbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd4ee88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd4f004]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xb14b74
mov ecx, edi
jns 0xb14ba3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd4f008]
or eax, eax
je 0xb14bb9
mov dword [ebx], eax
add ebx, 4
jmp 0xb14b91
call dword [esi + 0xd4f018]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xb14bf0
cmp al, 0xef
ja 0xb14be3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xb14bc5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xb14bd2
mov ebp, dword [esi + 0xd4f00c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xb14c24
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1f79463b
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x677a7252
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5488098b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1fdb1f61
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x55cf3a8e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x17c43b32
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401e36
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x401e5a
xor eax, eax
jmp 0x401ea2
cmp dword [ebp - 4], 2
jne 0x401e56
push esi
mov esi, dword [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jb 0x401e9f
cmp word [esi], 0x43
jne 0x401e9f
cmp word [esi + 2], 0x4e
jne 0x401e9f
cmp word [esi + 4], 0x3d
jne 0x401e9f
push dword [ebp + 0xc]
lea eax, [esi + 6]
push dword [ebp + 8]
push eax
call fcn.00402521
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
jmp 0x401ea1
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x402001
Capabilities:
Get graphical window text
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x81
push dword [0x455d30]
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 1
push 0x80
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp + 0xc]
push esi
push 0x428368
push 0x15
push 0
push 0x428378
call fcn.0040d08b
test eax, eax
js 0x4020c2
cmp dword [esi], 0
je 0x4020c2
push 0x3ea
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi]
mov ebx, eax
push 3
pop eax
sub esp, 0x10
mov word [ebp - 0x10], ax
mov edi, esp
mov dword [ebp - 8], 0x1e
lea esi, [ebp - 0x10]
mov edx, dword [ecx]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
mov esi, 0x428398
push 0
push 0xfffffffffffffffc
push ebx
movsd dword es:[edi], dword [esi]
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [edx + 0x18]
push 0x824
mov esi, 0x455d38
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0xc]
push esi
sub esp, 0x10
mov esi, 0x428388
mov edi, esp
mov eax, dword [ecx]
push 0
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push 0xfffffffffffffffc
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x1c]
call fcn.0040c2ec
push eax
push str.o15.officeredir.microsoft.com
push str.http:___s_r_rlidVBASelfCert_clid_d
push 0xffffffffffffffff
push 0x455d38
call fcn.00401206
add esp, 0x14
push 0
push 0x103
push 0xc5
push 0x3e8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8