joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
cmp dword [ebp - 0x6fc], 3
jne 0x100044b3
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
cmp dword [ebp - 0x6fc], 4
jne 0x1000455d
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
mov byte [ebp - 0x7ae], 0xfd
call fcn.10002729
pop ecx
adc dword [esi - 0x72f495f8], edx
test dword [eax + edi*8 - 1], eax
call dword [eax - 0x18]
stc
loope 0x1000453e
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.1000269a
add esp, 0xc
jmp 0x100046a1
cmp dword [ebp - 0x6fc], 5
jne 0x100045fe
and byte [ebp - 0x7cc], 0
and byte [ebp - 0x7cb], 0
mov byte [ebp - 0x7ca], 0x3f
and byte [ebp - 0x7c9], 0
mov byte [ebp - 0x7c8], 0x9c
mov byte [ebp - 0x7c7], 0x90
mov byte [ebp - 0x7c6], 0x93
mov byte [ebp - 0x7c5], 0x81
mov byte [ebp - 0x7c4], 0x90
mov byte [ebp - 0x7c3], 0xac
mov byte [ebp - 0x7c2], 0xee
mov byte [ebp - 0x7c1], 0xa4
mov byte [ebp - 0x7c0], 0xac
mov byte [ebp - 0x7bf], 0xac
mov byte [ebp - 0x7be], 0xc0
push 0xb
lea eax, [ebp - 0x7cc]
push eax
call fcn.10002739
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.1000269a
add esp, 0xc
jmp 0x100046a1
cmp dword [ebp - 0x6fc], 6
jne 0x1000469c
and byte [ebp - 0x7dc], 0
and byte [ebp - 0x7db], 0
mov byte [ebp - 0x7da], 0x11
and byte [ebp - 0x7d9], 0
mov byte [ebp - 0x7d8], 0xb2
mov byte [ebp - 0x7d7], 0x8b
mov byte [ebp - 0x7d6], 0x9c
mov byte [ebp - 0x7d5], 0x9c
mov byte [ebp - 0x7d4], 0x81
mov byte [ebp - 0x7d3], 0x9c
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.10002739
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.1000269a
add esp, 0xc
jmp 0x100046a1
jmp 0x100047cf
cmp dword [ebp - 0x37c], 0
jne 0x10004879
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0

Function at 0x10006710
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x10006723
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000671f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x4012e4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
call fcn.0040128c
test eax, eax
jne 0x4012f8
xor eax, eax
pop esi
pop ebx
ret
mov edx, dword [esi]
mov dword [eax + 8], edx
jmp loc.004170f8

Function at 0x4013a0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov edi, ebx
mov esi, dword [edx]
mov eax, dword [ebx + 8]
cmp esi, eax
jb 0x401420
mov ecx, esi
add ecx, dword [edx + 4]
mov ebp, eax
add ebp, dword [ebx + 0xc]
cmp ecx, ebp
ja 0x401420
cmp esi, eax
jne 0x4013e1
mov eax, dword [edx + 4]
add dword [ebx + 8], eax
jmp loc.00416ee9
mov ecx, dword [edx]
mov esi, dword [edx + 4]
add ecx, esi
mov edi, eax
add edi, dword [ebx + 0xc]
cmp ecx, edi
jne 0x4013f6
sub dword [ebx + 0xc], esi
jmp 0x40141c
mov ecx, dword [edx]
add ecx, dword [edx + 4]
mov dword [esp], ecx
sub edi, ecx
mov dword [esp + 4], edi
mov edx, dword [edx]
sub edx, eax
mov dword [ebx + 0xc], edx
mov edx, esp
mov eax, ebx
call fcn.004012e4
test al, al
jne 0x40141c
xor eax, eax
jmp 0x401428
mov al, 1
jmp 0x401428
mov ebx, dword [ebx]
cmp edi, ebx
jne 0x4013ab
xor eax, eax
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401430
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x401446
mov esi, 0x100000
jmp fcn.00401452
add esi, 0xffff
jmp loc.00416cb8

Function at 0x401494
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4014de
add esi, 0xffff
jmp loc.00417ad2
cmp dword [ebx], 0
je 0x401506
mov edx, ebx
mov eax, 0x40d43c
call fcn.004012e4
test al, al
jne 0x401506
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualFree
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4016d8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
mov ebp, 0x40d44c
add edi, 0x3fff
jmp loc.00417778
Function at 0x4019dc
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x40d415], 0
je 0x401abb
xor edx, edx
push ebp
push 0x401ab4
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x40d032], 0
je 0x401a0e
push 0x40d41c
call sub.kernel32.dll_EnterCriticalSection
mov byte [0x40d415], 0
mov eax, dword [0x40d474]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x40d474], eax
mov ebx, dword [0x40d43c]
jmp 0x401a41
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebx]
cmp ebx, 0x40d43c
jne 0x401a2f
mov eax, 0x40d43c
call fcn.004012dc
mov eax, 0x40d44c
call fcn.004012dc
mov eax, 0x40d478
call fcn.004012dc
mov eax, dword [0x40d434]
test eax, eax
je 0x401a87
mov edx, dword [eax]
mov dword [0x40d434], edx
push eax
call sub.kernel32.dll_LocalFree
mov eax, dword [0x40d434]
test eax, eax
jne 0x401a70
pop dword fs:[0]
add esp, 8
push 0x401abb
jmp 0x4175a7
pop ebx
pop ebp
ret

Function at 0x401ac0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
cmp eax, dword [0x40d468]
jne 0x401ad2
mov edx, dword [eax + 4]
mov dword [0x40d468], edx
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
cmp ecx, 0x1000
jg 0x401b0a
cmp eax, edx
jne 0x401af4
shr ecx, 2
mov eax, dword [0x40d474]
xor edx, edx
mov dword [eax + ecx*4 - 0xc], edx
jmp 0x401b11
shr ecx, 2
mov ebx, dword [0x40d474]
mov dword [ebx + ecx*4 - 0xc], edx
mov eax, dword [eax]
mov dword [edx], eax
mov dword [eax + 4], edx
pop ebx
ret
mov eax, dword [eax]
jmp 0x417d9b
pop ebx
ret

Function at 0x401b44
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ecx, edx
sub ecx, 4
lea ebx, [ecx + eax]
cmp edx, 0x10
jl 0x401b61
jmp loc.004176da
cmp edx, 4
jl 0x401b72
mov ecx, edx
or ecx, 0x80000002
mov dword [eax], ecx
mov dword [ebx], ecx
pop ebx
ret

Function at 0x401b98
Capabilities:
Packed with generic packer

Disassembly:
cmp edx, 0xc
jl 0x401bab
or edx, 2
mov dword [eax], edx
add eax, 4
call fcn.00401b74
ret
cmp edx, 4
jl 0x401bba
mov ecx, edx
jmp loc.00418950
add eax, edx
and dword [eax], 0xfffffffe
ret

Function at 0x401c30
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
xor edi, edi
mov eax, dword [ebx]
test eax, 0x80000000
je 0x401c4b
and eax, 0x7ffffffc
add edi, eax
add ebx, eax
mov eax, dword [ebx]
test al, 2
jne 0x401c62
mov esi, ebx
mov eax, esi
call fcn.00401ac0
mov eax, dword [esi + 8]
add edi, eax
jmp 0x415b81
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x401d80
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x40d46c], 0
jle 0x401dc9
cmp dword [0x40d46c], 0xc
jge 0x401d9e
mov dword [0x40d418], 7
jmp 0x401dc9
mov eax, dword [0x40d46c]
or eax, 2
mov edx, dword [0x40d470]
mov dword [edx], eax
mov eax, dword [0x40d470]
add eax, 4
call fcn.00401b74
xor eax, eax
mov dword [0x40d470], eax
xor eax, eax
jmp 0x4180d3
ret
Function at 0x402684
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov eax, ecx
cmp edi, esi
jg 0x4026a3
je 0x4026c1
sar ecx, 2
js 0x4026c1
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
jmp loc.00415b1b
pop edi
pop esi
ret

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40d02c], 0x8088405
inc edx
mov dword [0x40d02c], edx
mul edx
mov eax, edx
ret

Function at 0x4027b4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push eax
test eax, eax
je 0x40280f
xor eax, eax
xor ebx, ebx
jmp loc.0041812d
mov dword [edx], esi
pop edi
pop esi
pop ebx
ret
inc esi
jmp 0x402816
pop ebx
sub esi, ebx
jmp 0x402809

Function at 0x402924
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.0040292f
mov ecx, dword [eax]
jmp loc.00416179

Function at 0x402b28
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
cmp byte [section.DATA], 0
je 0x402b47
push eax
push eax
push edx
push esp
push 2
push 0
push 0xeedfad4
jmp loc.004190cd
ret

Function at 0x402b5c
Capabilities:
Allocate thread local storage

Disassembly:
cmp byte [section.DATA], 1
jbe 0x402b6e
push eax
push dword [ebx + 4]
jmp 0x402b48
ret

Function at 0x402b70
Capabilities:
Allocate thread local storage

Disassembly:
push esp
push 1
push 0
push 0xeedfad0
call sub.kernel32.dll_TlsAlloc
add esp, 4
pop eax
ret
cmp byte [section.DATA], 1
jbe 0x402b80
push eax
push ebx
jmp 0x402b48
ret

Function at 0x402be8
Capabilities:
Allocate thread local storage

Disassembly:
cmp byte [section.DATA], 1
jbe 0x402c04
push eax
push edx
push esp
push 2
push 0
push 0xeedfad3
call sub.kernel32.dll_TlsAlloc
pop edx
pop eax
ret

Function at 0x402eb4
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
pop edx
push esp
push ebp
push edi
push esi
push ebx
push eax
push edx
push esp
push 7
push 1
push 0xeedface
push edx
jmp loc.004192df

Function at 0x403094
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
lea eax, [ebp - 0xc]
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x403018
mov dword [eax + 8], ebp
jmp loc.00418270

Function at 0x40310c
Capabilities:
Packed with generic packer
Set thread local storage value

Disassembly:
push ebx
cmp dword [0x40d3d0], 0
jge 0x403120
mov eax, 0xe2
call fcn.00403e41
push 8
push 0x40
call sub.kernel32.dll_LocalAlloc
mov ebx, eax
test ebx, ebx
jne 0x40313e
jmp 0x4174ab
push ebx
mov eax, dword [0x40d3d0]
push eax
call sub.kernel32.dll_TlsSetValue
mov dword [0x40d48c], ebx
pop ebx
ret

Function at 0x403278
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
mov eax, edi
jmp loc.004154e0
Function at 0x403454
Capabilities:
Packed with generic packer

Disassembly:
push ebx
test eax, eax
je 0x403486
mov ebx, dword [eax - 4]
test ebx, ebx
je 0x403486
dec edx
jl 0x40347e
cmp edx, ebx
jge 0x403486
sub ebx, edx
test ecx, ecx
jl 0x403486
cmp ecx, ebx
jg 0x403482
add edx, eax
mov eax, dword [esp + 8]
call fcn.00403278
jmp 0x40348f
xor edx, edx
jmp 0x403467
mov ecx, ebx
jmp 0x403471
mov eax, dword [esp + 8]
jmp 0x416b23
pop ebx
ret 4

Function at 0x403554
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [edx + ecx + 0xa]
mov edi, dword [edx + ecx + 6]
jmp loc.004172d4

Function at 0x40374c
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
mov dx, word [eax]
test edx, 0x4000
jne 0x403773
cmp edx, 8
jb 0x403773
cmp edx, 0x100
jne 0x403779
mov word [eax], 0
add eax, 8
jmp loc.00417175
mov word [eax], 0
ret
push eax
call sub.oleaut32.dll_VariantClear
ret

Function at 0x4037f4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
jmp loc.004181b4

Function at 0x403894
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [edx + 8]
call fcn.004036b8
mov esi, eax
mov eax, ebx
call fcn.0040374c
jmp loc.004161d4

Function at 0x403cc8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [eax + 4]
sub edx, 0xd7b1
je 0x403ce4
cmp edx, 2
ja 0x403cf4
call dword [eax + 0x1c]
test eax, eax
jne 0x403ced
mov eax, ebx
call dword [ebx + 0x24]
test eax, eax
jne 0x403ced
pop ebx
ret
jmp 0x417ed7
cmp eax, 0x40d038
je 0x403ceb
mov eax, 0x67
jmp 0x403ced

Function at 0x403e8e
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, eax
jmp loc.004170ba
mov edx, 0xd7b2
jmp 0x403e4c

Function at 0x403f67
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0x40c078
mov ecx, 2
call fcn.00403e9c
jmp loc.004187ed

Function at 0x404014
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
jl 0x404060
je 0x40405f
cmp eax, 0x1400
jmp loc.00419488
ret
neg eax
cmp eax, 0x1400
jge 0x4040ab
mov edx, eax
and edx, 0x1f
lea edx, [edx + edx*4]
fld xword [edx*2 + 0x4040b8]
fdivp st(1)
shr eax, 5
je 0x40405f
mov edx, eax
and edx, 0xf
je 0x404092
lea edx, [edx + edx*4]
fld xword [edx*2 + 0x4041ee]
fdivp st(1)
shr eax, 4
je 0x40405f
lea eax, [eax + eax*4]
fld xword [eax*2 + 0x404284]
fdivp st(1)
ret
fldz
ret

Function at 0x4045a0
Capabilities:
Get common file path
Packed with generic packer

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
jmp loc.00417c3c

Function at 0x405034
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov ecx, ebx
mov dl, 1
mov eax, 0x404e8c
jmp loc.00418bd3
Function at 0x40504c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push esi
push edi
mov ecx, ebx
mov dl, 1
mov eax, 0x404e8c
jmp loc.00419127

Function at 0x405090
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov edi, edx
or eax, eax
je 0x40509e
mov eax, dword [eax - 4]
or edx, edx
je 0x4050a5
mov edx, dword [edx - 4]
mov ecx, eax
cmp ecx, edx
jbe 0x4050ad
mov ecx, edx
cmp ecx, ecx
repe cmpsb byte [esi], byte es:[edi]
je 0x4050dd
mov bl, byte [esi - 1]
cmp bl, 0x61
jb 0x4050c3
cmp bl, 0x7a
ja 0x4050c3
sub bl, 0x20
mov bh, byte [edi - 1]
cmp bh, 0x61
jb 0x4050d3
cmp bh, 0x7a
ja 0x4050d3
sub bh, 0x20
cmp bl, bh
je 0x4050af
jmp 0x418095
sub eax, edx
pop ebx
pop edi
pop esi
ret

Function at 0x405114
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, edx
mov edx, esp
jmp loc.0041560e

Function at 0x40517c
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov esi, edx
mov edi, eax
mov edx, ecx
cmp edi, esi
jg 0x405199
je 0x4051b5
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
lea esi, [esi + ecx - 1]
lea edi, [edi + ecx - 1]
and ecx, 3
std
rep movsb byte es:[edi], byte [esi]
sub esi, 3
sub edi, 3
mov ecx, edx
jmp loc.004178fe
pop edi
pop esi
ret

Function at 0x405230
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
jmp loc.00418c2d

Function at 0x405244
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov ebx, ecx
mov esi, eax
cmp ebx, 0x1f
jle fcn.00405257
jmp loc.00418e61

Function at 0x4055b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esi
jmp loc.004155ef

Function at 0x40565c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405695
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40569e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4056a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4056c9
mov al, byte [esp]
jmp 0x4056cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x405d90
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x405da4
add esp, 0xfffffff0
call fcn.00402ac8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x405de3
jmp loc.004160b4
Function at 0x4060f8
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, 0xff87
mov dl, 1
mov eax, 0x404b3c
call fcn.00405d90
mov dword [0x40d558], eax
mov dword [0x40d004], 0x405f24
mov dword [section.BSS], 0x4060e8
mov eax, 0x404ab0
jmp loc.004164e6

Function at 0x406144
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
jmp loc.004188d1

Function at 0x40618e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov dword [ebp - 4], eax
mov eax, 0x13
cmp cl, 0
jne 0x4061bb
mov eax, dword [ebp + 0xc]
cmp eax, 2
jge 0x4061b1
mov eax, 2
cmp eax, 0x12
jle 0x4061bb
mov eax, 0x12
mov dword [ebp + 0xc], eax
push eax
mov eax, 0x270f
cmp byte [ebp + 0x10], 2
jb 0x4061cd
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
call fcn.0040672a
mov edi, dword [ebp - 4]
movzx eax, word [ebp - 0x1c]
sub eax, 0x7fff
cmp eax, 2
jae 0x4061f7
lea esi, [eax + eax*2 + 0x406188]
mov ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40621a
lea esi, [ebp - 0x19]
movzx ebx, byte [ebp + 0x10]
cmp bl, 1
je 0x406213
cmp bl, 4
ja 0x406211
movsx eax, word [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jle 0x406213
mov bl, 0
jmp 0x4157c9
mov eax, edi
sub eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4066e5
Capabilities:
Packed with generic packer

Disassembly:
mov al, byte [ebx]
inc ebx
or al, al
jne 0x4066f7
dec ebx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jle fcn.00406726
mov al, 0x30
cmp dword [ebp - 0x24], 0
jne 0x406708
mov ah, al
jmp loc.00416262
stosb byte es:[edi], al
cmp byte [ebp - 8], 0
je fcn.00406726
mov eax, dword [ebp - 0x24]
cmp eax, 1
jle fcn.00406726
mov dl, 3
div dl
cmp ah, 1
jne fcn.00406726
mov al, byte [0x40d49e]
stosb byte es:[edi], al

Function at 0x40672a
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a
push edi
push esi
push ebx
mov ebx, eax
mov esi, edx
cmp cl, 0
je 0x406743
call fcn.00406846
jmp fcn.00406748
jmp loc.00416bdd

Function at 0x406a88
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x406ab5
mov eax, ebx
call fcn.00406da0
mov al, byte [eax]
call fcn.00406b00
test al, al
jne 0x406ab5
mov eax, esi
jmp loc.00416291
mov eax, esi
mov edx, ebx
call fcn.0040322c
pop esi
pop ebx
ret

Function at 0x406b10
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
jmp loc.00418795
Function at 0x406c70
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp], dl
mov esi, eax
mov dl, 1
mov eax, esi
call fcn.00406b94
mov edi, eax
mov dword [esp + 4], edi
mov eax, esi
call fcn.004032f4
mov ebp, eax
lea ebx, [edi + 1]
cmp ebp, ebx
jl 0x406ccf
mov al, byte [esi + ebx - 1]
call fcn.00406b00
test al, al
je 0x406cb9
cmp byte [esp], 0
je 0x406cb2
mov edi, ebx
jmp 0x406cb6
mov edi, dword [esp + 4]
inc ebx
jmp 0x406ccb
mov edx, ebx
mov eax, esi
call fcn.00406ad0
add ebx, eax
mov eax, ebx
jmp 0x415d4c
cmp ebp, ebx
jge 0x406c9b
mov eax, edi
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406cd8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
mov edi, edx
mov esi, eax
push esp
lea eax, [esp + 8]
push eax
push 0x1000
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_GetFullPathNameA
mov ebx, eax
test ebx, ebx
jle 0x406d1e
cmp ebx, 0x1000
jge 0x406d1e
jmp loc.00415afa
mov eax, edi
mov edx, esi
call fcn.0040322c
add esp, 0x1004
pop edi
pop esi
pop ebx
ret

Function at 0x406e2c
Capabilities:
Get file attributes
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406e74
push dword fs:[eax]
mov dword fs:[eax], esp
jmp loc.00416087

Function at 0x406ef8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
xor edx, edx
mov dword [esi], edx
xor ecx, ecx
jmp 0x406f28
mov dl, byte [eax]
test dl, dl
je 0x406f38
jmp loc.0041536b
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40707c
Capabilities:
Accept command line arguments
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40710a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4070c7
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp fcn.004070f4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x4070db
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x4070ea
lea edx, [ebp - 4]
call fcn.00406f40
test ebx, ebx
je 0x4070ea
dec ebx
jmp 0x4070cc
mov eax, esi
mov edx, dword [ebp - 4]
jmp loc.00416e33

Function at 0x407118
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405230
add esp, 0x104
pop ebx
ret

Function at 0x407144
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405230
add esp, 0x104
pop ebx
ret