joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010af0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012b3d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10019024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push dword [ecx]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x10010b97
mov dword [ebp - 0x18], str.cannot_read_from_file
mov dword [ebp - 0x14], 0x15
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
sub esp, 0x10
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
mov eax, esp
push 0x15
push str.cannot_read_from_file
push ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], edx
lea eax, [ebp - 0x30]
push eax
call sym.fmt.dll_class_std::system_error___cdecl_fmt::v8::vsystem_error_int__class_fmt::v8::basic_string_view_char___class_fmt::v8::basic_format_args_class_fmt::v8::basic_format_context_class_fmt::v8::appender__char___
add esp, 0x20
mov byte [ebp - 0x19], 1
cmp byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
jne 0x10010bb5
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.std::exception.0
push eax
call sub.VCRUNTIME140.dll___std_exception_destroy
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10011115
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x44]
call fcn.1000a350
push 0x10015d88
lea eax, [ebp - 0x44]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10010bf0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012d1d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10019024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ecx]
mov dword [ebp - 0x20], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10010cab
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10010cab
mov dword [ebp - 0x18], str.cannot_get_file_size
mov dword [ebp - 0x14], 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x10
lea edx, [ebp - 0x18]
mov ecx, esp
push 0x14
push str.cannot_get_file_size
push eax
lea eax, [ebp - 0x34]
mov dword [ecx], 0
push eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], edx
call sym.fmt.dll_class_std::system_error___cdecl_fmt::v8::vwindows_error_int__class_fmt::v8::basic_string_view_char___class_fmt::v8::basic_format_args_class_fmt::v8::basic_format_context_class_fmt::v8::appender__char___
add esp, 0x20
mov byte [ebp - 0x19], 1
cmp byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
jne 0x10010ccc
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], vtable.std::exception.0
push eax
call sub.VCRUNTIME140.dll___std_exception_destroy
add esp, 4
mov edx, dword [ebp - 0x20]
xor eax, eax
or eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10011115
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x48]
call fcn.1000a350
push 0x10015d88
lea eax, [ebp - 0x48]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x41128a
Capabilities:
Get process image filename

Disassembly:
jmp 0x4148d0
jmp dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x4012af
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403d14], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403d10], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011a6
mov dword [ebp - 0x24], str.cognomen
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403d10]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.invocatory
push str.cognomen
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403d18], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401379
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401360
mov eax, dword [0x403d14]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10

Function at 0x401499
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x10
mov edx, esi
mov eax, 4
mov esi, 0x401116
mov edi, 0x4035f5
dec ecx
call fcn.00401cc6
mov eax, ecx
push edi
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call fcn.004013a1
call fcn.00401c72
mov eax, 0x14
mov ecx, 0x78f
mov esi, 0x401192
mov edi, 0x4014e3
call fcn.00401cc6
xor eax, eax
xor eax, 0x17cf0b66
sub eax, 0x4a88926a
fisttp qword [edi - 0x2d]
sbb al, 0xa9
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034
Function at 0x406650
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4066b6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404d04
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403630
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4066a0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066bd
lea eax, [ebp - 0x10]
call fcn.00404a94
ret

Function at 0x4082d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404f30
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4082f1
test al, 0x10
jne 0x4082f5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40843c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404f30
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40845e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40b938
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cdq
push eax
xor byte [esi - 0x75], ah
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0040976b
fild word [0x8b4933f0]
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
push eax
cmp dword [esi], eax
jne 0x40b958
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40b958
call fcn.0040976b
ror dword [ecx], cl
pop edi
cli
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0040976b
pop ss
jmp 0x40b962

Function at 0x40c454
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c4b8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404d04
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407fd0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4bf
lea eax, [ebp - 0xc]
call fcn.00404a94
ret
Function at 0x408180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b31bb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x805c
call fcn.00475050
mov eax, dword [0x4ed0f0]
xor eax, esp
mov dword [esp + 0x8058], eax
push ebx
push esi
push edi
mov eax, dword [0x4ed0f0]
xor eax, esp
push eax
lea eax, [esp + 0x8070]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
or esi, 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x8078], 0
test eax, eax
jne 0x4081fc
lea edi, [eax + 0x57]
jmp 0x40836f
mov edx, dword [ecx]
sub esp, 0x18
lea ecx, [esp + 0x44]
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
call fcn.0040a7d0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x40836f
mov eax, dword [esp + 0x14]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x40823e
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x408367
mov esi, eax
mov dword [esp + 0x24], esi
mov dword [ebx], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea ecx, [esp + 0x34]
push ecx
push 0x4000
lea ecx, [esp + 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408338
call ebx
cmp eax, 0x26
jne 0x40834d
call ebx
cmp eax, 0x103
je 0x40834d
xor ebx, ebx
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
jmp 0x4082c0
lea eax, [esp + 0x4064]
mov edx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0x4000
mov dword [esp + 0x38], eax
call fcn.0040ad50
cmp eax, 0xfffffffe
je 0x4083a8
mov eax, dword [esp + 0x20]
mov edi, 0x4000
push dword [eax + 4]
sub edi, dword [esp + 0x40]
lea eax, [esp + 0x18]
push eax
push edi
lea eax, [esp + 0x4070]
push eax
mov dword [esp + 0x24], 0
call dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add dword [edx], ecx
test eax, eax
je 0x40835e
cmp ecx, edi
jne 0x40835e
cmp dword [esp + 0x3c], 0
je 0x4082c0
cmp ebx, 4
je 0x408351
mov eax, dword [esp + 0x1c]
jmp 0x408270
cmp dword [esp + 0x30], 0
jne 0x4082ae
mov ebx, 4
jmp 0x4082b0
call ebx
jmp 0x40836d
lea ecx, [esp + 0x2c]
call fcn.0040b560
xor edi, edi
jmp 0x40836f
lea ecx, [esp + 0x2c]
call fcn.0040b560
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x408380
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x408380
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x8070]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8058]
xor ecx, esp
call fcn.00473c52
mov esp, ebp
pop ebp
ret 0xc
mov edi, 0xfffffffe
jmp 0x40836f
Function at 0x45b4ba
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ed0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
mov dword [eax], ecx
lea eax, [ebp - 0x118]
push eax
mov dword [esi], ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x108], ebx
jne 0x45b549
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x45b53c
cmp eax, 0xa
je 0x45b51b
cmp eax, 0x5a
je 0x45b513
xor ebx, ebx
mov dword [esi], 0x80
jmp 0x45b542
call fcn.0045c048
test al, al
mov al, bl
je 0x45b531
mov dword [esi], 0x80
jmp 0x45b5cf
mov dword [esi], 0x40
jmp 0x45b5cf
mov dword [esi], 0x10
mov al, bl
jmp 0x45b5cf
cmp dword [ebp - 0x108], 2
jne 0x45b5cd
mov ecx, dword [ebp - 0x114]
sub ecx, 4
je 0x45b5c2
mov eax, dword [ebp - 0x110]
dec ecx
je 0x45b575
dec ecx
jne 0x45b5b8
test eax, eax
jne 0x45b59a
mov dword [esi], 0x1000000
jmp 0x45b542
test eax, eax
jne 0x45b581
mov dword [esi], 0x100000
jmp 0x45b542
cmp eax, ebx
jne 0x45b58d
mov dword [esi], 0x400000
jmp 0x45b542
cmp eax, 2
jne 0x45b569
mov dword [esi], 0x800000
jmp 0x45b542
cmp eax, ebx
jne 0x45b5a6
mov dword [esi], 0x2000000
jmp 0x45b542
cmp eax, 2
jne 0x45b5b3
mov dword [esi], 0x4000000
jmp 0x45b542
cmp eax, 3
je 0x45b5ba
xor ebx, ebx
mov dword [esi], 0x8000000
jmp 0x45b542
mov dword [esi], 0x10000
jmp 0x45b542
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00473c52
leave
ret

Function at 0x45c8c2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x38
mov eax, 0x4afa19
call fcn.00473d21
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push dword [eax]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push ecx
and esi, 0xf
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x45c8ee
mov al, 1
jmp 0x45c90a
xor ecx, ecx
movzx edx, word [eax]
add eax, 2
test dx, dx
je 0x45c902
cmp ecx, esi
je 0x45c910
lea eax, [eax + edx*2]
inc ecx
cmp ecx, 0x10
jl 0x45c8f0
xor al, al
call fcn.00473cd0
ret
push 1
lea ecx, [ebp - 0x41]
push ecx
push edx
push eax
lea ecx, [ebp - 0x40]
call fcn.004114e0
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00411b2a
lea ecx, [ebp - 0x40]
call fcn.00401b80
jmp 0x45c8ea

Function at 0x45d2ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
invalid
test dword [edx - 4], eax
invalid
Function at 0x45d92e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
invalid
Function at 0x46c3c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
push edi
mov edi, ecx
test ebx, ebx
je 0x46c3e8
push 1
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebx], eax
xor eax, eax
lea esi, [edi + 0x70]
push esi
push eax
push eax
push eax
push 2
push dword [edi + 0x10]
call fcn.00469ec8
add esp, 0x18
test eax, eax
jne 0x46c410
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x78], eax
xor al, al
jmp 0x46c4b2
push dword [esi]
call fcn.00474bb7
mov esi, eax
pop ecx
cmp esi, dword [edi + 0x6c]
je 0x46c428
push dword [edi + 0x6c]
call fcn.00472d16
pop ecx
push 0
mov dword [edi + 0x6c], esi
call fcn.00472d16
lea esi, [edi + 0x70]
push esi
push dword [edi + 0x6c]
push 0
push 0
push 2
push dword [edi + 0x10]
call fcn.00469ec8
add esp, 0x1c
test eax, eax
je 0x46c400
push 0
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
push 0
lea eax, [edi + 0x70]
push eax
push dword [eax]
push dword [edi + 0x6c]
push dword [ebp + 8]
call esi
test byte [ebp + 0x10], 1
jne 0x46c499
push 0
push dword [ebp + 8]
push 1
push 1
push 0x10001
push dword [edi + 0xc]
call fcn.00469c33
add esp, 0x18
test eax, eax
je 0x46c400
test ebx, ebx
je 0x46c4b0
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [ebx]
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x46e279
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x46ec1f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov ebx, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
jne 0x46ec42
xor al, al
jmp 0x46ecdc
push eax
call fcn.004521fb
pop ecx
push eax
push dword [ebp - 4]
mov dword [ebx + 0x40], eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46ec3b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b6f58
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46ec3b
push esi
mov esi, dword [ebp - 0xc]
push edi
push 0xd
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea edi, [ebx + 4]
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueW
pop edi
pop esi
test eax, eax
je 0x46ecda
mov eax, dword [ebp - 4]
shr eax, 2
xor ecx, ecx
push 4
pop edx
mov dword [ebx + 0x3c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004521fb
xor edx, edx
pop ecx
mov dword [ebx + 0x38], eax
cmp dword [ebx + 0x3c], edx
jbe 0x46ecda
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov eax, dword [eax + edx*4]
mov dword [ecx + edx*4], eax
inc edx
cmp edx, dword [ebx + 0x3c]
jb 0x46ecc8
mov al, 1
pop ebx
leave
ret 4
Function at 0x414b00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section....1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b18
mov eax, 1
add ebx, ebx
jne 0x414b3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b30
jne 0x414b4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b30
xor ecx, ecx
sub eax, 3
jb 0x414b60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414bd2
mov ebp, eax
add ebx, ebx
jne 0x414b6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414b78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414b9c
inc ecx
add ebx, ebx
jne 0x414b88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414b7d
jne 0x414b99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bad
jmp 0x414b1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bbc
add edi, ecx
jmp 0x414b1e
pop esi
mov edi, esi
mov ecx, 0x13c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414bda
cmp byte [edi], 3
jne 0x414bda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x414bdf
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414c57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14718]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x147b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c0c
mov ecx, edi
jns 0x414c3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x147bc]
or eax, eax
je 0x414c51
mov dword [ebx], eax
add ebx, 4
jmp 0x414c29
call dword [esi + 0x147c0]
popal
jmp 0x406998

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x405334
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x405343
pop dword [ebp - 0x30]
mov eax, 0x405343
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xc598f295
add dword [ebp - 0x40], 0x88b952b6
mov dword [ebp - 0x3c], 0xf69d04df
add dword [ebp - 0x3c], 0x3b964766
mov dword [ebp - 0x38], 0x3d116428
add dword [ebp - 0x38], 0xf3ae006
mov dword [ebp - 0x34], 0xff9b451b
add dword [ebp - 0x34], 0x64bae5
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x3b8d0d9
add dword [ebp - 0x40], 0x70b9987d
mov dword [ebp - 0x3c], 0x454924f
add dword [ebp - 0x3c], 0x3d17cf26
mov dword [ebp - 0x38], 0xd57da7a9
sub dword [ebp - 0x38], 0x720e3b3d
mov dword [ebp - 0x34], 0xc126b0c8
sub dword [ebp - 0x34], 0xc126b0c8
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x77be47f2
add eax, 0x88825822
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39170
push 0
call eax
mov ecx, 0x4962b5be
add ecx, 0xb69d9350
xor ebx, ebx
add ebx, eax
mov esi, 0xeb78b275
add esi, 0x14cb0b8b
add esi, dword [ebp - 0x30]
mov edi, 0xb32e1207
sub edi, 0x30be968f
sub dword [ebp - 0x2c], 0xd8b1d080
mov edx, dword [esi]
mov dword [ebp - 0x28], 0x258df0d1
sub edx, edi
add dword [ebp - 0x14], edx
mov dword [ebx], edx
xor dword [ebp - 0x18], ebx
add ebx, 4
add esi, 0xbec5266d
add esi, 0x413ad997
loop 0x40545d
add eax, 0x1405550e
sub eax, 0x14043e03
xor ebx, ebx
add ebx, eax
add eax, 0xa4549977
sub eax, 0xa4549972
mov ecx, 0xacd0d042
add ecx, 0x536f2fbe
add ecx, dword [ebp - 0x30]
call ebx
leave
ret