joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Delete file
Get common file path
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
mov eax, dword [ebp + 0x18]
mov cl, byte [eax]
mov byte [ebp - 4], cl
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x401042
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp + 0x1c]
lea ecx, [edx + eax + 0x39]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov edx, dword [ebp + 0x14]
mov byte [eax + edx], cl
jmp loc.005837b0

Function at 0x401091
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0xf86
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jae 0x4010d9
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x4010c6
jmp 0x580520
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2f5368c5
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x556a1d26
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4dff10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8b000]
push edi
jmp 0x4dff2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4dff31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dff20
mov eax, 1
add ebx, ebx
jne 0x4dff43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4dff54
jne 0x4dff73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dff73
dec eax
add ebx, ebx
jne 0x4dff60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4dff38
add ebx, ebx
jne 0x4dff6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4dffc5
xor ecx, ecx
sub eax, 3
jb 0x4dff8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4dfffa
sar eax, 1
mov ebp, eax
jmp 0x4dff96
add ebx, ebx
jne 0x4dff96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dff64
inc ecx
add ebx, ebx
jne 0x4dffa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dff64
add ebx, ebx
jne 0x4dffb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4dffa6
jne 0x4dffc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4dffa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4dffe4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4dffd6
jmp 0x4dff26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4dffe4
add edi, ecx
jmp 0x4dff26
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e0002
cmp byte [edi], 0x11
jne 0x4e0002
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e0007
lea edi, [esi + 0xd8000]
mov eax, dword [edi]
or eax, eax
je 0x4e007f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe6f38]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe70b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e0034
mov ecx, edi
jns 0x4e0063
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe70b8]
or eax, eax
je 0x4e0079
mov dword [ebx], eax
add ebx, 4
jmp 0x4e0051
call dword [esi + 0xe70c8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e00b0
cmp al, 0xef
ja 0x4e00a3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e0085
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e0092
mov ebp, dword [esi + 0xe70bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e00e4
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x404527
Capabilities:
Encode data using xor

Disassembly:
loop 0x404554
xchg esp, eax
mov esp, 0x64a8cb7a
push dword [eax]
aas
xchg edx, eax
mov eax, 0xbf745146
sub byte [ebx], bl
bound edx, qword [ecx]
sub edi, edi
shr ecx, cl
adc edi, edi
invalid
call 0x4043ea
xor ecx, ecx
sub cx, 0xff80
call 0x404527
rcr byte [esi - 0x7f], 0x76
push cs
add byte [ebx - 5], cl
jle 0x4044b5
pop esi
xor dword [esi + 0xe], 0x7efb4b00
sub esi, 0xfffffffc
out dx, al
cld
loop 0x40452a
fimul dword [ebx - 0x6a89f0bd]
and ah, byte [edi + 0x230f6f74]
sub eax, dword [edx + 0xe31074a]
loope 0x4045c7
inc ebp
push ecx
js 0x4044e1
cld
test eax, 0x2c19d17f
daa
jns 0x40457a
lock add ah, byte [edx + 0x4b5a030f]
cdq
dec edx
invalid
mov cl, 1
jge 0x404504
fsubr qword [ebp + eax*4 + 0xf2d71d4]
iretd
cmovno eax, edx
mov edx, 0x2aa73418
scasb al, byte es:[edi]
popal
jg 0x404529
mov bl, 0xf2
pop eax
dec esi
test dword [edx - 0x78], 0x616b1abd
dec eax
jge 0x40457a
clc
cmp al, 0xfb
adc bl, byte [eax - 0x50]
pop edi
mov ecx, 0xeed9255e
or al, byte [edx]
cmpsd dword [esi], dword es:[edi]
add ch, ch
sbb eax, 0x5e18a02e
jecxz 0x4045e9
cmp esi, edx
push ecx
in al, 0x1c
or byte [esi], dh
loop 0x404590
jl 0x404644
push ebp
ficomp dword [ebp + 0x52a9a4db]
mov edx, 0xe4ccb211
scasb al, byte es:[edi]
sub byte [ecx + 0x49], 0x12
adc ch, dh
dec ecx
adc dl, byte [edx]
out dx, al
loope 0x404600
push edi
mov edi, 0x1069c622
sub al, 0xa6
cmpsb byte [esi], byte es:[edi]
mov dh, 0x30
pop ss
bound ebp, qword [ecx]
bound ecx, qword [edx - 0x70]
invalid
mov ebx, 0x77fc3a96
push esp
xchg esp, eax
imul ecx, dword [0x7a080b5e], 0x10
or ecx, dword [eax]
jp 0x404614
push es
sub esi, dword [edi + eax*4]
xchg esp, eax
lds ecx, [ecx]
mov dh, byte [ecx - 0x1681a2c8]
popal
cmp bh, bh
jno 0x40462f
sbb eax, 0xb6135674
wait
push cs
mov byte [0xf31512d1], al
and ch, byte [ebx]
and ch, byte [ebx]
jno 0x4045dc
push esp
cmp al, 0xfa
nop
jle 0x40466f
jle 0x4045f6
invalid
sahf
mov eax, dword [0xd9e25331]
push ds
jecxz 0x404623
sub byte [edi + ecx*8 - 0x45], bl
push esp
push edi
loop 0x40467a
imul esi, dword [ebp - 0x417fec85], 0x42aaa772
adc eax, dword [eax - 0x55588d42]
inc edx
jne 0x404692
fist word [ebx - 4]
outsd dx, dword [esi]
sbb byte [esi + 0x326d962d], cl
add byte [edx - 0x6544ea6d], bl
lcall 0xecc3, 0x47cdd688
mov eax, 0xaadf9cf5
mov cs, word [ecx + 0x15185771]
push esi
pushal
inc edi
dec edi
sub al, cl
sub edx, esi
cmc
push cs
mov cl, 0xc6
dec edi
mov ss, word [ebx]
inc edx
mov dword [0x8e5dbfd], eax
add edx, esi
int1
pop ss
invalid
invalid
bound edi, qword [ebx - 0x220f01ef]
movsb byte es:[edi], byte [esi]
rol ch, cl
int 0x4d
mov dword [esi], edi
inc edx
salc
hlt
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x400703ff
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..tls
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x1e091f83
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1013c94
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x101647c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20a
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1013d7c
push ebx
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll__mbsrchr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x1013ce8
cmp byte [eax + 1], bl
jne 0x1013ce8
mov byte [eax], bl
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.01013a71
test eax, eax
jne 0x1013d07
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.01013b49
cmp dword [ebp + 0xc], 0x104
jb 0x1013d28
push edi
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d78
xor eax, eax
jmp 0x1013d7b
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1013d24
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1013d53
sub eax, edx
lea ecx, [eax + 1]
cmp ecx, dword [ebp + 0xc]
ja 0x1013d24
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x41c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01011c2a
leave
ret 0xc

Function at 0x40893b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x4085d8
sub edx, 0x7f46dba6
inc ebx
call fcn.00408964
mov ebx, 0xde904f0c
and edx, edx
xor dword [edi], esi
and ebx, ebx
add edx, edx
inc edi
cmp edi, eax
jne fcn.0040893b
ret
Function at 0x414a75
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004148eb

Function at 0x419011
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418b64

Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x407c7f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push ebx
xor eax, eax
push 0x206
mov word [ebp - 0x280], ax
xor ebx, ebx
lea eax, [ebp - 0x27e]
push ebx
push eax
call fcn.004244d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x280]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x407cc7
xor al, al
jmp 0x407d9b
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407d98
push 0x39
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.004244d0
add esp, 0xc
push 2
push ebx
push 0xffffffffffffffc8
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push 0x38
lea eax, [ebp - 0x78]
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x78], 0x44414544
jne 0x407d98
cmp dword [ebp - 0x74], 0x46454542
jne 0x407d98
push edi
xor eax, eax
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x18]
push 0x11
push eax
call fcn.004240b0
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
call fcn.0040666e
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x3c], bl
lea edi, [ebp - 0x3b]
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x3c]
push 0x11
push eax
call fcn.004240b0
mov ecx, dword [ebp + 0xc]
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
call fcn.0040666e
mov al, 1
pop edi
jmp 0x407d9a
xor al, al
pop esi
jmp 0x496390
Function at 0x40a80d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [edi + 9], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi + 0xd], eax
call esi
push 1
mov dword [ebp - 8], eax
call esi
mov esi, dword [edi + 0xd]
mov ebx, dword [edi + 9]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
push 0
push esi
push ebx
fmul qword [0x4430e8]
call fcn.0043be80
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
neg esi
sub esi, ecx
add esi, eax
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 8]
cdq
sub eax, edx
push esi
sar ecx, 1
sar eax, 1
sub eax, ecx
push eax
push 0
push dword [edi + 5]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea esi, [edi + 0x11]
mov eax, esi
call fcn.00408bdf
push dword [ebp + 0xc]
mov ebx, dword [esi]
push dword [ebp + 8]
call fcn.00408b73
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push dword [edi + 5]
call esi
push 9
push dword [edi + 5]
call esi
push 0
push 0
push dword [edi + 5]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebx
leave
ret 8

Function at 0x40c2f1
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 4]
xor ecx, ecx
cmp dword [eax + 0xa3], ecx
je 0x40c31c
add eax, 0x93
cmp dword [eax + 0x14], 8
jb 0x40c30b
mov eax, dword [eax]
push 1
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x40d890
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 4
push 0
mov ecx, dword [ebp + 8]
call fcn.004016a6
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop ebp
ret 4

Function at 0x40d8b0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 4
push 0
mov ecx, dword [ebp + 8]
call fcn.004067a0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop ebp
ret 4

Function at 0x42539e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44aca0]
jne 0x4253a8
repz ret
jmp fcn.00430d55

Function at 0x430e5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
movzx ebx, word [eax + 0x42]
jmp loc.004946a8

Function at 0x434d1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44aca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042b2d6
and dword [ebp - 0x14], 0
cmp dword [0x44dc54], 0
mov dword [ebp - 0x18], eax
jne 0x434dcf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x434e77
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x434e77
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44dc54], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44dc58], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44dc5c], eax
call edi
push eax
call esi
mov dword [0x44dc64], eax
test eax, eax
je 0x434dcf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44dc60], eax
mov eax, dword [0x44dc60]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x434e28
cmp dword [0x44dc64], ecx
je 0x434e28
push eax
call esi
push dword [0x44dc64]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x434e28
test ebx, ebx
je 0x434e28
call edi
test eax, eax
je 0x434e1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x434e1f
test byte [ebp - 8], 1
jne 0x434e28
or dword [ebp + 0x10], 0x200000
jmp 0x434e5b
mov eax, dword [0x44dc58]
cmp eax, dword [ebp - 0x18]
je 0x434e5b
push eax
call esi
test eax, eax
je 0x434e5b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x434e5b
mov eax, dword [0x44dc5c]
cmp eax, dword [ebp - 0x18]
je 0x434e5b
push eax
call esi
test eax, eax
je 0x434e5b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44dc54]
call esi
test eax, eax
je 0x434e77
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x434e79
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042539e
leave
ret
Function at 0x405e27
Capabilities:
Accept command line arguments

Disassembly:
cmp eax, 0x4108dc
adc al, 0x7f
mov esi, gs
add byte [eax], al
add byte [ecx + 0x4103a1], ah
test eax, eax
stc
test ecx, esp
add byte [eax], al
add byte [ebx - 0x1efc7bfb], dh
add ah, bl
rol dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test dword [ecx + 0x74], ebx
push eax
pop eax
add eax, dword [ecx]
test eax, eax
int 0x1d
dec esp
push 0x9040f410
push 4
call fcn.0040a940
or ah, al
or al, 0xa3
call 0x84409e85
sar byte [edi + 0xaf84], 0
lea ebp, [edi - 4]
push ecx
push esi
call dword [ebp - 5]
jae 0x405d34
mov esp, 0xea351d19
cld
mov eax, dword [ebp + 0x73]
push edx
dec ebp
enter 0x2ce8, 0xffffffffffffffb2
add dl, dh
das
dec ebp
or byte [ebx - 0x76a9f33c], al
add edi, edi
adc eax, sym.imp.KERNEL32.dll_GlobalFree
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
iretd
xor cl, al
inc esp
add byte [esp + eax*8 + 0x5fc033c8], dl
or byte [ebx + 0x72c25de5], cl
xlatb
push 0xffffffffffffffa4
call dword [0x2540c04c]
jmp 0x405d7d
Function at 0x415ff3
Capabilities:
Encode data using xor

Disassembly:
pop edx
push es
mov byte [0x1963ad62], al
scasd eax, dword es:[edi]
cmc
pop edx
mov edi, 0x64e8ee20
push edi
mov ch, 0xff
jg 0x416056
push cs
ret 0x132e
insd dword es:[edi], dx
dec esi
mov al, 0xce
inc esi
fcomp dword [esi]
mov dh, 0x58
jg 0x415ff4
pop edx
xlatb
mov gs, word es:[ebx + 0x2f]
jecxz 0x416085
jne 0x4160af
push 0xffffffffffffff8b
push esp
mov edi, esp
pop dword [ebx]
movsd dword es:[edi], dword [esi]
loop 0x4160a7
sub dh, byte [edx - 0x26]
in al, dx
out dx, al
mov bl, 0x3b
out 0x71, al
sub dword [edx - 0x56bb62a1], 0x588aa8ed
in eax, dx
test al, 0x8a
pop eax
mov bl, byte [eax + 0x65]
push ecx
push ecx
inc edi
jg 0x4160c4
jbe 0x4160fc
xchg ebx, eax
out dx, al
xor eax, 0x6feadde
adc eax, 0x8dc9e7f3
clc
xor esp, dword [ecx]
aas
sbb dl, ch
jp 0x416087
invalid
add eax, 0xd38d8722
out dx, al
invalid
dec edi
fidiv word [eax + 0x60]
int 0x7e
sub edx, dword [esi*8 + 0x7dfe8d8e]
sbb byte [ecx - 5], cl
jle 0x4160dc
adc al, 0xf5
mov cs, word [ebp + 0x49187dfe]
sti
push esi
cmpsb byte [esi], byte es:[edi]
jle 0x4160cb
push edi
pushfd
aas
retf
add dh, byte [edx - 0x51]
or esp, dword [esi + 0x47717fb3]
jno 0x416114
cdq
movsb byte es:[edi], byte [esi]
rol byte [esi + 0x279ebf19], 1
pop eax
mov eax, dword [0x2bead880]
wait
cmp dword [ecx + 0xd900b78], 0x939f9d61
lahf
xchg ebx, eax
imul edx, dword [ebx], 0xffffffa7
sbb dh, byte [edi]
movlps qword [edi], xmm5
cmpsd dword [esi], dword es:[edi]
les ebx, [eax]
add dl, bl
jle 0x416166
push ds
xor eax, 0x4ce94920
dec esp
jg 0x41612a
xlatb
rol dword [edi - 0x14], 1
arpl word [0xb949b166], bx
sub cl, byte [edi - 0x70]
int1
adc al, 0x68
mov dword [edx + 0x7afa916b], esp
add al, 0x61
fisub word [eax]
leave
push ds
and edi, dword [ecx + 6]
cdq
push ss
jbe 0x416130
and eax, 0x59edaaa6
add al, 0x6e
sti
int1
cdq
pop edi
imul ebp, dword [edi - 0x29], 0x4f1d0cfc
or al, 0x1d
dec edi
wait
not dword [edi - 0x60]
lds esp, [edx - 0x2e]
pop es
rol byte [edi + 0xf], cl
jae 0x4160e4
jne 0x4161a4
and al, 0xa5
push ebp
adc al, 0xaa
cmp esi, dword [edi]
ror esp, 1
pop esi
sub byte [edi + esi*8], dh
jb 0x41619b
and byte [eax + 0xe9d5999], bh
invalid
idiv byte [ebp - 0x1f]
inc eax
push esp
mov eax, 0x5fdb018f
pop ecx
hlt
call 0xfff7062a
invalid
scasb al, byte es:[edi]
xchg esp, eax
invalid