joyce8/EMBER2024-capa huggingface dataset:
Function at 0x700589
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov byte [ebp - 0x190], 0x7d
jmp 0x430313
mov byte [ebp - 0x198], 0x6d
jmp 0x71f265
push eax
lea eax, [ebp - 0xc]
jmp 0x88bd2d
call fcn.004071f0
mov edx, dword [eax]
movsx ecx, si
movsx cx, cl
mov ecx, eax
not ah
mov eax, dword [edx + 0xc]
jmp 0x71dc4d
mov dword [ebp - 0x2c8], edx
call fcn.00450641
sub ecx, ecx
sub esi, esi
xor cl, dl
shl cl, 0xed
cmp eax, esi
xchg cl, cl
setne cl
cmp ecx, esi
jmp 0x8708f0
mov byte [ebp - 0x19c], 0xc8
mov byte [ebp - 0x19b], 0xc4
jmp 0x6efb04
mov byte [ebp - 0x19a], 0xb9
mov byte [ebp - 0x199], 0xe4
jmp 0x583304
push ebp
btc ax, si
sub ebp, edi
mov ebp, esp
add ah, cl
and eax, 0x92f6259
shld eax, esi, 0xfc
push 0xffffffffffffffff
dec eax
push 0x4e38ab
mov eax, dword fs:[0]
push eax
movzx eax, di
movsx ax, bl
rcr eax, cl
sub esp, 0x2c4
shl ax, 0x19
mov eax, dword [0x51f620]
cmc
test edi, 0x2ee0fbc
xor eax, ebp
jmp 0x87264f
call eax
add eax, 0x10
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 4], esi
mov bl, 0x37
mov al, 0xaf
mov dl, 0xac
not cl
mov cl, 0x53
jmp 0x8c6b11
mov byte [ebp - 0x197], 0x50
jmp 0x867db1
mov byte [ebp - 0x191], 0x12
jmp 0x5686e3
push ebx
jmp 0x84f167
mov byte [ebp - 0x169], bl
setnp bl
mov bl, 0xd1
mov byte [ebp - 0x1a0], 0xb
jmp 0x84460e
mov dword [ebp - 0x2c4], ecx
jmp 0x65fd09
mov byte [ebp - 0x19f], cl
mov byte [ebp - 0x19e], 0x1a
mov byte [ebp - 0x19d], 0xba
jmp 0x6da6de
push esi
jmp 0x886175
mov dword [ebp - 0x2cc], eax
jmp 0x82b2f1
mov byte [ebp - 0x196], 0x62
mov byte [ebp - 0x195], 0x24
mov byte [ebp - 0x194], al
jmp 0x8abda6
jne 0x617c10
push 0x80004005
jmp 0x617c0b
mov dword [ebp - 0x10], eax
jmp 0x7d2bbb
push edi
jmp 0x5e0ba2
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x85d2c8
mov byte [ebp - 0x193], 0x97
mov byte [ebp - 0x192], 0x62
jmp 0x7ae01b
mov byte [ebp - 0x16a], bl
jmp 0x805cb6

Function at 0x701c0c
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.00474480
mov eax, dword [0x51f620]
cmp ebx, ebp
sub dl, 0xd4
sbb cl, 3
xor eax, esp
jmp loc.00417ecd
push ebp
cmovg bp, ax
mov ebp, esp
and esp, 0xfffffff8
movsx eax, si
cmovbe eax, ecx
movzx eax, bx
push 0xffffffffffffffff
mov al, dh
push 0x4e51d8
movsx eax, bp
jmp 0x7d246c
push eax
lahf
cbw
bswap ax
push ecx
lahf
movzx ax, cl
mov eax, ebp
mov eax, 0x1424
jmp 0x5a7eba
mov eax, dword fs:[0]
jmp 0x72ab05

Function at 0x71a618
Capabilities:
Execute anti-debugging instructions
Manually build aes constants
Reference processor manufacturer constants

Disassembly:
mov byte [ebp - 0x3e], 0x61
jmp loc.0040b946
mov byte [ebp - 0x3f], 0x72
jmp 0x5c9094
push ebp
rol eax, 0x6b
cmovs ebp, ebx
mov ebp, esp
lea esp, [esp - 0xa8]
sal al, cl
inc ax
clc
mov eax, dword [0x51f620]
clc
jmp 0x89686b
mov dword [ebp - 4], eax
jmp 0x8429dd
mov byte [ebp - 0x42], 0x6f
jmp 0x7cd47a
mov byte [ebp - 0x43], 0x42
jmp 0x776c82
mov byte [ebp - 0x41], 0x78
mov byte [ebp - 0x40], 0x54
jmp 0x5f9119
mov byte [ebp - 0x44], 0x56
jmp 0x7a63bf
xor eax, ebp
jmp 0x751367
Function at 0x740210
Capabilities:
Write file on windows

Disassembly:
push 4
jmp 0x88041c
push ecx
mov dword [ebp - 0xf9c], ebx
call edi
lea edx, [ebp - 0x258]
jmp 0x6f1be9
push edx
jmp loc.0042c562
push 0xfe9492a3
call fcn.006f60a4
push 8
push eax
jmp 0x75c75f
call fcn.004708fd
mov ecx, dword [ebp - 0xf9c]
shr dx, 0x9a
bts edx, esi
and dx, 0xf36
add esp, 0x1c
not dl
movsx edx, cx
movzx edx, ax
push ecx
movsx edx, cx
push 1
lea edx, [ebp - 0xfc4]
jmp 0x5bfdc2
call fcn.0046ed51
mov eax, dword [ebp - 0xf9c]
push eax
jmp 0x862529
call fcn.0046f030
add esp, 0x14
seta cl
push pe_nt_image_headers32
movsx ecx, sp
mov ch, 0xbc
lea ecx, [ebp - 0x258]
jmp 0x64dae8
push edx
jmp 0x802b2b

Function at 0x780b59
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.004062d0
lea eax, [esp + 0x18c8]
mov cl, 0x60
push eax
bswap cx
movzx ecx, bp
lea ecx, [esp + 0x604]
jmp loc.00412a76
mov dword [esp + 0x20], 0xb34
cmovb cx, sp
lea esp, [esp]
jmp 0x8a8d83
call fcn.00444120
add esp, 8
lea eax, [esp + 0x1bc0]
push eax
xchg cl, cl
lea ecx, [esp + 0x5e8]
jmp loc.00401411
push 0xbfd7ec39
call fcn.00645d4b
mov dword [esp + 0x14], ecx
jl 0x89e452
mov byte [esp + 0x1a3c], 0x3c
add edx, ebp
sal dx, cl
mov byte [esp + 0x1a3d], 0x48
mov byte [esp + 0x1a3e], 0x59
xor ecx, edi
xadd cx, cx
mov byte [esp + 0x1a3f], 0x50
test esp, 0x6ca00d6b
bts dx, sp
mov byte [esp + 0x1a40], 0x45
sbb ch, 0xdd
bsr cx, sp
mov byte [esp + 0x1a41], 0x52
mov byte [esp + 0x1a42], 0x5f
btr ecx, 0xb
mov byte [esp + 0x1a43], 0x4c
inc ch
cwd
sub cl, 0xa3
mov byte [esp + 0x1a44], 0x41
bswap ecx
sal ecx, cl
mov byte [esp + 0x1a45], 0x42
sbb ecx, edi
add dl, cl
mov byte [esp + 0x1a46], 0x45
btr edx, eax
mov byte [esp + 0x1a47], 0x4c
mov byte [esp + 0x1a48], 0x25
movzx cx, ah
test esi, esp
mov byte [esp + 0x1a49], 0x64
sar cl, 0x3c
cmc
mov byte [esp + 0x1a4a], 0x3e
mov byte [esp + 0x1a4b], 0
sar dx, cl
shr dl, cl
sub eax, eax
jmp 0x6276b8
mov dword [esp + 0x2c], eax
jmp 0x87e783
call fcn.00444120
add esp, 8
movsx edx, si
lea edx, [esp + 0x1bc0]
push edx
bswap cx
lea ecx, [esp + 0x620]
jmp 0x5b75f7
inc eax
xchg dx, dx
mov dl, 0x6f
movsx dx, dh
push eax
cmovp edx, edx
setno dl
lea edx, [esp + 0x19e0]
push edx
lea edx, [esp + 0x1bc8]
mov dword [esp + 0x24], eax
jmp 0x69ed01
inc eax
push eax
lea ecx, [esp + 0x1a40]
push ecx
lea edx, [esp + 0x1bc8]
jmp 0x822745

Function at 0x78aa68
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.0046e045
mov edx, dword [esp + 0x14]
mov cx, si
movzx ecx, cx
cmovbe cx, bp
mov ecx, dword [edx + 0x84]
jmp 0x874419
jmp loc.0041418a
push 0xfe9492a3
call fcn.006f60a4
push eax
jmp 0x5a1243
mov dword [ecx + 0x30], eax
jmp 0x6de64c
Function at 0x7f4c09
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ah, 0xf
ror ax, 0x6f
mov ebp, esp
push 0xfffffffffffffffe
test eax, esp
push 0x7e3450
rcl ax, 0xba
push 0x473a90
mov eax, dword fs:[0]
push eax
cmp esp, eax
sub esp, 8
cwde
not ax
mov eax, 0x1e50
jmp 0x7f4c09
push ebx
movsx bx, dh
bswap ebx
push esi
push edi
push eax
not bx
setae bl
mov bx, 0xc3e
lea eax, [ebp - 0x10]
jmp 0x794b05
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
movzx eax, sp
cwde
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov si, 0xc7d
mov dword [ebp - 0x1e40], eax
mov esi, 0x19703124
cwde
mov dword [ebp - 0x1e38], ecx
setae ah
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1e30], esi
lahf
mov ecx, 0x67034382
mov cx, di
mov dword [ebp - 0x1e2c], edx
cbw
xchg ah, dl
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1e28], eax
mov ecx, dword [ebp + 0x18]
mov al, 0x60
jmp loc.0040e34a
call fcn.00474480
mov eax, dword [0x51f620]
xor dword [ebp - 8], eax
xor eax, ebp
jmp 0x8700fb
mov dword [ebp - 0x1c], eax
jmp 0x7819db
Function at 0x80dfed
Capabilities:
Execute anti-debugging instructions
Read file on windows
Write file on windows

Disassembly:
call fcn.004406d0
push str.Packing_resource_files._Please_wait.
movsx edx, bx
cwd
setl dl
mov edx, 0x529928
jmp 0x81cde9
call fcn.00450241
add esp, 4
clc
mov dword [0x529b48], eax
test di, dx
cmp eax, ebx
jne 0x61319d
push str.Cant_Optimize_Resource_File.
movzx dx, cl
bswap dx
push str._s_Error:0x00000006
movsx edx, dx
mov dl, dl
jmp 0x6f30fe
add esp, 8
jmp 0x65f4b4
call fcn.0044a900
push eax
movzx edx, dx
mov edx, 0x52afa8
jmp 0x848483
push 0x4c8
push eax
jmp 0x404d29
lea edx, [ebp - 0x1020]
jmp 0x73213f
mov dword [ebp - 4], 0xffffffff
jmp 0x7f50df
call fcn.0046d9d8
mov esp, ebp
movzx ebp, ax
jmp 0x84ac3f
push ebx
jmp 0x70fa96
mov edx, 0x529928
jmp 0x860ab1
sub ebx, ebx
jmp 0x77a4cf
push ebx
jmp 0x832897
push edx
jmp 0x611080
push ebx
jmp 0x6119f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
adc ecx, esp
add bx, 0x7df5
pop ecx
rcl si, 0x2c
not si
cmovbe cx, di
pop edi
pop esi
test edi, 0x13fa0b09
cmc
sal cx, 0x30
pop ebx
shr ecx, 0x66
mov ecx, dword [ebp - 0x10]
cmc
test esp, ebx
test dl, 0x64
xor ecx, ebp
jmp 0x650785
call 0x83beed
test eax, eax
je 0x75661f
mov ecx, dword [0x529d70]
cmp al, dl
cmp ecx, ebx
jmp 0x7b4f9e
jmp 0x75661f
call 0x76012d
xor eax, dword [esi]
jmp 0x806ac5
call fcn.00438400
add esp, 4
jmp 0x763f50
push ebx
jmp 0x77c7b8
push eax
jmp 0x76201d
je 0x75661f
call fcn.006e6f67
lea esi, [eax + 0x14]
jmp 0x76bc6b
ret
push ebx
jmp 0x738a33
push ecx
call dword [0x4e7668]
call 0x6da4a9
push 6
not si
mov esi, eax
movsx edi, cx
movzx edi, cx
mov edi, 0x512a00
jmp 0x777197
call fcn.0040cc10
push ebx
jmp 0x574547
call fcn.0040bf60
mov ecx, dword [0x529908]
cmc
jmp 0x60a9ad
cmp eax, 0x1b7d6a4
jne 0x75661f
mov byte [0x529b4c], 1
test esp, 0x4b0c56df
clc
cmp dword [0x529b48], ebx
jmp 0x820cee
call fcn.00474480
mov eax, dword [0x51f620]
test ecx, 0x52ac3b37
cmp sp, 0x6f45
clc
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
cmp ecx, esp
push esi
cmc
push edi
cmp di, 0x4ff1
push eax
xchg ah, al
lea eax, [ebp - 0xc]
test di, di
mov dword fs:[0], eax
shld eax, ecx, 0x5a
bts eax, ebp
mov eax, dword [0x52afa0]
jmp 0x700218
mov dword [ebp - 0xfb4], ebx
call fcn.0040bf60
mov eax, dword [0x529908]
add esp, 4
jmp 0x7be15b
jne 0x61319d
push 0xa00000
jmp 0x5eb588
push 0x4c8
jmp 0x7c253e
push ebp
mov ebp, esp
mov ax, 0x4d60
movsx eax, sp
push 0xffffffffffffffff
push 0x4e4f12
movsx eax, sp
cwde
mov eax, dword fs:[0]
jmp 0x86c3ae
mov dword [ebp - 4], ebx
jmp 0x8cab22
pop ebp
jmp 0x7b5870
mov byte [0x529b4c], bl
jmp 0x7f8463
push eax
mov ax, 0x19b6
cbw
mov eax, 0x1054
jmp 0x80dfed
call fcn.00440860
lea esi, [ebp - 0x1020]
jmp 0x615b72
Function at 0x83425c
Capabilities:
Execute anti-debugging instructions
Read file on windows
Write file on windows

Disassembly:
call fcn.004406d0
push str.Packing_resource_files._Please_wait.
movsx edx, bx
cwd
setl dl
mov edx, 0x529928
jmp 0x81cde9
call fcn.00450241
add esp, 4
clc
mov dword [0x529b48], eax
test di, dx
cmp eax, ebx
jne 0x61319d
push str.Cant_Optimize_Resource_File.
movzx dx, cl
bswap dx
push str._s_Error:0x00000006
movsx edx, dx
mov dl, dl
jmp 0x6f30fe
add esp, 8
jmp 0x65f4b4
call fcn.0044a900
push eax
movzx edx, dx
mov edx, 0x52afa8
jmp 0x848483
push 0x4c8
push eax
jmp 0x404d29
lea edx, [ebp - 0x1020]
jmp 0x73213f
mov dword [ebp - 4], 0xffffffff
jmp 0x7f50df
call fcn.0046d9d8
mov esp, ebp
movzx ebp, ax
jmp 0x84ac3f
push ebx
jmp 0x70fa96
mov edx, 0x529928
jmp 0x860ab1
sub ebx, ebx
jmp 0x77a4cf
push ebx
jmp 0x832897
push edx
jmp 0x611080
push ebx
jmp 0x6119f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
adc ecx, esp
add bx, 0x7df5
pop ecx
rcl si, 0x2c
not si
cmovbe cx, di
pop edi
pop esi
test edi, 0x13fa0b09
cmc
sal cx, 0x30
pop ebx
shr ecx, 0x66
mov ecx, dword [ebp - 0x10]
cmc
test esp, ebx
test dl, 0x64
xor ecx, ebp
jmp 0x650785
call 0x83beed
test eax, eax
je 0x75661f
mov ecx, dword [0x529d70]
cmp al, dl
cmp ecx, ebx
jmp 0x7b4f9e
jmp 0x75661f
call 0x76012d
xor eax, dword [esi]
jmp 0x806ac5
call fcn.00438400
add esp, 4
jmp 0x763f50
push ebx
jmp 0x77c7b8
push eax
jmp 0x76201d
je 0x75661f
call fcn.006e6f67
lea esi, [eax + 0x14]
jmp 0x76bc6b
ret
push ebx
jmp 0x738a33
push ecx
call dword [0x4e7668]
call 0x6da4a9
push 6
not si
mov esi, eax
movsx edi, cx
movzx edi, cx
mov edi, 0x512a00
jmp 0x777197
call fcn.0040cc10
push ebx
jmp 0x574547
call fcn.0040bf60
mov ecx, dword [0x529908]
cmc
jmp 0x60a9ad
cmp eax, 0x1b7d6a4
jne 0x75661f
mov byte [0x529b4c], 1
test esp, 0x4b0c56df
clc
cmp dword [0x529b48], ebx
jmp 0x820cee
call fcn.00474480
mov eax, dword [0x51f620]
test ecx, 0x52ac3b37
cmp sp, 0x6f45
clc
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
cmp ecx, esp
push esi
cmc
push edi
cmp di, 0x4ff1
push eax
xchg ah, al
lea eax, [ebp - 0xc]
test di, di
mov dword fs:[0], eax
shld eax, ecx, 0x5a
bts eax, ebp
mov eax, dword [0x52afa0]
jmp 0x700218
mov dword [ebp - 0xfb4], ebx
call fcn.0040bf60
mov eax, dword [0x529908]
add esp, 4
jmp 0x7be15b
jne 0x61319d
push 0xa00000
jmp 0x5eb588
push 0x4c8
jmp 0x7c253e
push ebp
mov ebp, esp
mov ax, 0x4d60
movsx eax, sp
push 0xffffffffffffffff
push 0x4e4f12
movsx eax, sp
cwde
mov eax, dword fs:[0]
jmp 0x86c3ae
mov dword [ebp - 4], ebx
jmp 0x8cab22
pop ebp
jmp 0x7b5870
mov byte [0x529b4c], bl
jmp 0x7f8463
push eax
mov ax, 0x19b6
cbw
mov eax, 0x1054
jmp 0x80dfed
call fcn.00440860
lea esi, [ebp - 0x1020]
jmp 0x615b72
Function at 0x8409c3
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 0x1bf8], 0xa4
call fcn.0042cfd0
push 0xffffffffffffffff
not cl
bswap ecx
push edi
movsx cx, bh
movzx ecx, sp
not cl
push eax
lea ecx, [esp + 0x165c]
jmp 0x89b58c
call fcn.004064a0
push edi
mov cx, 0x1b35
movzx cx, dh
mov cx, dx
push 1
not ecx
lea ecx, [esp + 0x1620]
jmp 0x6b587b
call fcn.00406590
push edi
push 1
lea ecx, [esp + 0x1230]
jmp 0x71dc1d
call fcn.00406590
mov dword [esp + 0x17b8], 0xf
mov dword [esp + 0x17b4], 0
bts ecx, eax
mov byte [esp + 0x17a4], 0
ror ah, 0xc
bt ecx, esp
cmp edx, esp
mov byte [esp + 0x1bf0], 0xa9
mov ecx, dword [esp + 0x504]
sal ah, 0xe8
cwde
sub ecx, dword [esp + 0x500]
rcl edx, cl
bswap ax
jmp 0x7489b5
mov byte [esp + 0x1bf8], 6
call fcn.00406590
cmp dword [esp + 0x1664], edi
jmp 0x88ff82
push 1
xchg cl, ch
lea ecx, [esp + 0x1038]
jmp 0x710ebd
call fcn.00406590
push edi
jmp 0x7113fc
mov eax, 0x92492493
cmc
imul ecx
or bh, ch
add bx, 0x1075
add edx, ecx
clc
shl ebx, 0x7f
sar edx, 4
mov bh, al
test ecx, esi
mov ebx, edx
clc
shr ebx, 0x1f
test edx, ebx
lea ebx, [ebx + edx]
test ecx, 0xf1a4177
clc
test sp, cx
xor eax, eax
jmp 0x7970b1
mov dword [esp + 0x18], eax
test sp, ax
test ebx, ebx
jle 0x88ffa3
call fcn.0044a350
add esp, 8
push 0
movzx ecx, cx
push 1
not ecx
cmovns ecx, edi
setl cl
lea ecx, [esp + 0x1348]
jmp 0x6c839d
call fcn.004062d0
lea ecx, [esp + 0x1340]
sets dl
movzx dx, dl
push ecx
mov cx, dx
lea edx, [esp + 0x4f8]
not cx
push edx
lea ecx, [esp + 0x1658]
mov byte [esp + 0x1bf8], 0xa6
jmp 0x7a9b5f
push 0xbfd7ec39
call fcn.00645d4b
call fcn.004062d0
lea edx, [esp + 0x1030]
cmovae ax, dx
cwde
push edx
lea eax, [esp + 0x161c]
push eax
bswap edx
cdq
movsx edx, ax
lea edx, [esp + 0x1674]
not ch
lea ecx, [esp + 0x1230]
jmp 0x67e931
je 0x5fb2af
push 0x511994
mov cx, 0xb0e
lea ecx, [esp + 0x1344]
jmp 0x7ed37f
mov byte [esp + 0x1bfc], 0xa5
jmp 0x689df0
Function at 0x9a2420
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x37f000]
mov dword [edi + 0x41c5a8], 0xb58c86cb
push edi
jmp 0x9a244a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9a2451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2440
mov eax, 1
add ebx, ebx
jne 0x9a2463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9a2474
jne 0x9a2493
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2493
dec eax
add ebx, ebx
jne 0x9a2480
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9a2458
add ebx, ebx
jne 0x9a248f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9a24e5
xor ecx, ecx
sub eax, 3
jb 0x9a24ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9a251a
sar eax, 1
mov ebp, eax
jmp 0x9a24b6
add ebx, ebx
jne 0x9a24b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2484
inc ecx
add ebx, ebx
jne 0x9a24c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9a2484
add ebx, ebx
jne 0x9a24d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9a24c6
jne 0x9a24e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9a24c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9a2504
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9a24f6
jmp 0x9a2446
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9a2504
add edi, ecx
jmp 0x9a2446
pop esi
mov edi, esi
mov ecx, 0x197b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9a2522
cmp byte [edi], 0x82
jne 0x9a2522
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9a2527
lea edi, [esi + 0x59d000]
mov eax, dword [edi]
or eax, eax
je 0x9a259f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c09c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c0b98]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9a2554
mov ecx, edi
jns 0x9a2583
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c0ba0]
or eax, eax
je 0x9a2599
mov dword [ebx], eax
add ebx, 4
jmp 0x9a2571
call dword [esi + 0x5c0b9c]
mov ebp, dword [esi + 0x5c0ba4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x287]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9a25d3
sub esp, 0xffffff80
jmp 0x68aae5
Function at 0x4f38ed
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f3763
Function at 0x41fc56
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f480]
jne 0x41fc60
repz ret
jmp fcn.004247e8

Function at 0x431e51
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00425d9b
and dword [ebp - 0x14], 0
cmp dword [0x442a44], 0
mov dword [ebp - 0x18], eax
jne 0x431f04
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x431fac
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x431fac
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x442a44], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x442a48], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x442a4c], eax
call edi
push eax
call esi
mov dword [0x442a54], eax
test eax, eax
je 0x431f04
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x442a50], eax
mov eax, dword [0x442a50]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x431f5d
cmp dword [0x442a54], ecx
je 0x431f5d
push eax
call esi
push dword [0x442a54]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x431f5d
test ebx, ebx
je 0x431f5d
call edi
test eax, eax
je 0x431f54
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x431f54
test byte [ebp - 8], 1
jne 0x431f5d
or dword [ebp + 0x10], 0x200000
jmp 0x431f90
mov eax, dword [0x442a48]
cmp eax, dword [ebp - 0x18]
je 0x431f90
push eax
call esi
test eax, eax
je 0x431f90
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x431f90
mov eax, dword [0x442a4c]
cmp eax, dword [ebp - 0x18]
je 0x431f90
push eax
call esi
test eax, eax
je 0x431f90
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x442a44]
call esi
test eax, eax
je 0x431fac
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x431fae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fc56
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x70df1327
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x70df13b0
call fcn.70df12a8
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x70dfc86d
xor edi, edi
cmp eax, edi
je 0x70df64df
cmp eax, 2
jne 0x70df1596
call fcn.70df233f
push 0x214
push 1
call fcn.70df21ae
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x70df699e
push esi
push dword [0x70e7f008]
push dword [0x70e7f010]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
call eax
test eax, eax
je 0x70e04fe9
push edi
push esi
call fcn.70df21e9
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
xor eax, eax
inc eax
call fcn.70df12ed
ret 0xc
cmp eax, 3
jne 0x70df13a1
push edi
call fcn.70df1528
pop ecx
jmp 0x70df13a1
cmp dword [0x70e7f8c8], edi
jle 0x70df699e
dec dword [0x70e7f8c8]
mov dword [ebp - 4], edi
cmp dword [0x70e7f778], edi
jne 0x70df6501
call fcn.70df651b
cmp dword [ebp + 0x10], edi
je 0x70e04fb7
mov dword [ebp - 4], 0xfffffffe
call fcn.70df6994
jmp 0x70df13a1
xor eax, eax
jmp 0x70df13a4
call fcn.70e62097
jmp 0x70e04fb0
call fcn.70df97c4
test eax, eax
je 0x70df699e
call fcn.70dfc276
test eax, eax
je 0x70e04fa6
call fcn.70df983c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x70e820ec], eax
call fcn.70dfd2a5
mov dword [0x70e81d20], eax
call fcn.70dfc8e3
test eax, eax
js 0x70e04fb0
call fcn.70dfc7b0
test eax, eax
js 0x70df69a5
call fcn.70dfabe5
test eax, eax
js 0x70df69a5
push 0
call fcn.70dfae31
pop ecx
test eax, eax
jne 0x70df69a5
inc dword [0x70e7f8c8]
jmp 0x70df13a1
call fcn.70e620ea
jmp 0x70df699e
call fcn.70e61be5
jmp 0x70e04fa6
call fcn.70e62097
call fcn.70e61be5
call fcn.70e620ea
jmp 0x70df650a
push esi
call fcn.70df1301
pop ecx
jmp 0x70df699e

Function at 0x70df13d0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x70df66ad
dec eax
je 0x70dfa75e
mov eax, 1
pop ebp
ret 0xc
mov eax, dword [0x70e7f780]
test eax, eax
jne 0x70e01ed1
mov ecx, dword [0x70e7f790]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x70df13e8
mov eax, dword [ebp + 8]
mov dword [0x70e81fd4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x70e81fd8], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x70e7f790], eax
cmp eax, 0xffffffff
jne 0x70df13e8
jmp 0x70e01ecb
xor eax, eax
pop ebp
ret 0xc
push esi
push eax
mov esi, eax
call fcn.70e3bebb
push esi
call fcn.70df3455
add esp, 4
mov dword [0x70e7f780], 0
pop esi
jmp 0x70df66ba