joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417590
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp], eax
push esi
movsx edx, byte [ecx]
mov dword [esp + 8], eax
push edx
mov word [esp + 0x10], ax
lea eax, [esp + 8]
push str._C:_
push eax
call fcn.004195cf
add esp, 0xc
lea ecx, [esp + 4]
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
mov eax, 1
je 0x4175d6
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x42582f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42584f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041bf09
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x425872
test byte [esp + 8], 2
je 0x425872
call fcn.0041bf7c
mov dword [eax], 0xd
call fcn.0041bf85
mov dword [eax], 5
jmp 0x42584b
xor eax, eax
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x414498
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41456e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405c38
lea eax, [ebp - 4]
call fcn.0040663c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405c70
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x414558
mov eax, ebx
call fcn.00402fe8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x414551
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405c70
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x41453b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x414580
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x41453b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414558
mov eax, dword [ebp - 0x10]
call fcn.00403004
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414575
lea eax, [ebp - 4]
call fcn.00405bd4
ret

Function at 0x415afb
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + eax + 0x2e], ch
add byte [eax + eax + 0x6c], ah
add byte [eax + eax], ch
add bl, al
call fcn.00405364
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x415b1e
mov eax, edi
add eax, eax
call fcn.00402fe8
mov esi, eax
jmp 0x415b20
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415b59
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415b43
mov eax, esp
cmp esi, eax
je 0x415b66
mov eax, esi
call fcn.00403004
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x415ba0
cmp bl, 0
je 0x415b9c
cmp bl, 0x41
jl 0x415b97
cmp bl, 0x5a
jg 0x415b97
or bl, 0x20
xor al, bl
inc esi
jmp 0x415b7b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x415ae0

Function at 0x42a1c0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00429ec4
dec esi
jne 0x42a1e2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x444760
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4449c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c38
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.004035d8
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.004035d8
push 0x4449d0
push 0x4449f8
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00408f00
test eax, eax
je 0x4447ea
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x4447f6
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x4449a3
test bl, bl
je 0x444826
call fcn.00444b70
mov edx, dword [eax]
mov dword [ebp - 0x11c], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x118], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x444841
lea eax, [ebp - 4]
mov edx, 0x444a20
call fcn.00405c38
cmp dword [ebp - 0x11c], 5
jne 0x444865
cmp dword [ebp - 0x118], 0
jne 0x444865
lea eax, [ebp - 4]
mov edx, 0x444a44
call fcn.00405c38
jmp 0x4449a3
cmp dword [ebp - 0x11c], 5
jne 0x444889
cmp dword [ebp - 0x118], 1
jne 0x444889
lea eax, [ebp - 4]
mov edx, 0x444a6c
call fcn.00405c38
jmp 0x4449a3
cmp dword [ebp - 0x11c], 5
jne 0x4448cf
cmp dword [ebp - 0x118], 2
jne 0x4448cf
cmp byte [ebp - 6], 1
jne 0x4448bd
cmp word [ebp - 0x144], 9
jne 0x4448bd
lea eax, [ebp - 4]
mov edx, 0x444a6c
call fcn.00405c38
jmp 0x4449a3
lea eax, [ebp - 4]
mov edx, 0x444a90
call fcn.00405c38
jmp 0x4449a3
cmp dword [ebp - 0x11c], 6
jne 0x4448f3
cmp dword [ebp - 0x118], 0
jne 0x4448f3
lea eax, [ebp - 4]
mov edx, 0x444ac4
call fcn.00405c38
jmp 0x4449a3
cmp dword [ebp - 0x11c], 6
jne 0x444917
cmp dword [ebp - 0x118], 1
jne 0x444917
lea eax, [ebp - 4]
mov edx, 0x444aec
call fcn.00405c38
jmp 0x4449a3
cmp dword [ebp - 0x11c], 6
jne 0x44493d
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x44493d
lea eax, [ebp - 4]
mov edx, 0x444b0c
call fcn.00405c38
jmp 0x4449a3
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x444962
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x444962
lea eax, [ebp - 4]
mov edx, 0x444b2c
call fcn.00405c38
jmp 0x4449a3
cmp eax, 0xa
jne 0x444991
cmp dword [ebp - 0x114], 0x55f0
jae 0x444982
lea eax, [ebp - 4]
mov edx, 0x444b2c
call fcn.00405c38
jmp 0x4449a3
lea eax, [ebp - 4]
mov edx, 0x444b50
sub cl, bh
mov dword [edi - 1], edx
jmp 0x4449a3
cmp eax, 0xb
jb 0x4449a3
lea eax, [ebp - 4]
mov edx, 0x444b50
call fcn.00405c38
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4449ca
lea eax, [ebp - 4]
call fcn.00405bd4
ret
Function at 0x4829b9
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
xor eax, eax
mov dword [esp + 0xc], eax
push edi
push 4
mov eax, dword [esi + 0x30]
add eax, 0x24
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00482389
mov eax, dword [esi + 0x30]
add eax, 0x2c
push 4
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00482389
mov ecx, dword [esp + 0x44]
xor ebp, ebp
add esp, 0x18
mov dword [esp + 0x14], ebp
xor eax, eax
mov dword [esp + 0x18], ebp
mov ebx, ecx
mov dword [esp + 0x1c], eax
lea edi, [ebx + 1]
mov eax, ecx
sub eax, ebx
xor esi, esi
mov ebx, dword [esp + 0x30]
add ebx, 0xfffffff0
add ebx, eax
je 0x482b1a
nop dword [eax + eax]
xor eax, eax
mov dl, byte [esp + eax + 0x20]
lea ecx, [eax + esi]
cmp byte [ecx + edi], dl
je 0x482a40
cmp dl, 0x3f
jne 0x482ac1
inc eax
cmp eax, 8
jb 0x482a2b
lea ebx, [esi + edi]
test ebx, ebx
je 0x482b1a
mov ecx, dword [ebx]
lea edi, [ebx + 8]
mov eax, ecx
shr eax, 8
movzx esi, al
movzx eax, cl
shl eax, 8
add esi, eax
mov eax, ecx
shr eax, 0x10
shl esi, 8
movzx eax, al
add esi, eax
shr ecx, 0x18
shl esi, 8
add esi, ecx
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x58]
cmp dword [edi], eax
jne 0x482acc
test ebp, ebp
jne 0x482ad8
mov eax, dword [edi + 8]
add eax, 0x10
mov dword [esp + 0x1c], edi
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 0x64]
push 0x40
call eax
push esi
mov ebp, eax
push edi
push ebp
mov dword [esp + 0x20], ebp
call fcn.00482389
mov ecx, dword [esp + 0x38]
add esp, 0xc
add dword [esp + 0x10], esi
jmp 0x482a09
inc esi
cmp esi, ebx
jb 0x482a29
jmp 0x482b1a
mov ecx, dword [esp + 0x2c]
test ebp, ebp
je 0x482a09
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, edx
lea ebp, [esi + edx]
cmp ebp, ecx
ja 0x482b09
push esi
push edi
push eax
call fcn.00482389
mov ecx, dword [esp + 0x38]
add esp, 0xc
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x14]
jmp 0x482a09
sub ecx, edx
push ecx
push edi
push eax
call fcn.00482389
mov ebp, dword [esp + 0x20]
add esp, 0xc
test ebp, ebp
jne 0x482b28
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
test al, 3
je 0x482b3e
nop dword [eax]
dec eax
test al, 3
jne 0x482b39
xor ecx, ecx
test eax, eax
je 0x482b54
nop dword [eax + eax]
xor dword [ecx + ebp + 0x10], edx
add ecx, 4
cmp ecx, eax
jb 0x482b49
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x10], 0
pop edi
pop esi
mov dword [eax], ebp
setne al
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x492d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x492d31
inc edi
mov eax, esi
call fcn.00405358
cmp edi, eax
jg 0x492d43
cmp byte [esi + edi - 1], 0x20
je 0x492d30
mov eax, esi
test eax, eax
je 0x492d4e
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x492e10
cmp byte [esi + edi - 1], 0x2e
je 0x492e34
jmp 0x492e10
cmp byte [esi + edi - 1], 0x2e
jne 0x492db8
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x492e34
cmp dword [esp + 8], 0xff
jg 0x492e34
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x492d9c
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x492da4
mov bl, 1
jmp 0x492db2
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x492e34
jmp 0x492e0f
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x492ddd
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x492e0f
inc edi
mov eax, esi
call fcn.00405358
cmp edi, eax
jg 0x492def
cmp byte [esi + edi - 1], 0x20
je 0x492ddc
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x492e07
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x492e34
jmp 0x492e1f
inc edi
mov eax, esi
call fcn.00405358
cmp edi, eax
jle 0x492d66
cmp dword [esp + 4], 3
jne 0x492e34
cmp dword [esp + 8], 0xff
jg 0x492e34
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x2a60117e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
mov ecx, 0x3e4150d9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x4011d9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
sub ebx, ebx
push ebx
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x403004], eax
push ebx
push str.Class1
push ebx
push 6
push 0x7f00
push ebx
call sub.user32.dll_LoadCursorA
push eax
push 0x7f00
push ebx
call sub.user32.dll_LoadIconA
push eax
push dword [0x403004]
push ebx
push ebx
push section..text
push 3
push 0x30
push esp
call sub.user32.dll_RegisterClassExA
add esp, 0x30
test eax, eax
je 0x401274
push ebx
push dword [0x403004]
push ebx
push ebx
push 0x64
push pe_nt_image_headers32
push ebx
push ebx
push 0x12ca0000
push str.Form1
push str.Class1
push ebx
call sub.user32.dll_CreateWindowExA
test eax, eax
je 0x401274
lea esi, [ebp - 0x1c]
push ebx
push ebx
push ebx
push esi
call sub.user32.dll_GetMessageA
test eax, eax
je 0x401274
push esi
call sub.user32.dll_TranslateMessage
push esi
call sub.user32.dll_DispatchMessageA
jmp 0x401259
push eax
jmp 0x4012d4
jmp dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x68e501d8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x71a00cbf
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
imul ebp, dword [ebp + 0x1e], 0xffffff95
imul ebp, dword [esi + 0x6d6b951e], 0x1e
insd dword es:[edi], dx
push ds
xchg ebp, eax
imul ebp, dword [ebp + 0x1e], 0xffffff95
imul ebp, dword [ebp + 0x1e], 0xffffff95
imul ecx, ebp, 0x6e
lds ebp, [edx]
insd dword es:[edi], dx
mov esp, 0x1e2c0bb5
push esi
imul ebp, dword [ebp + 0x1e], 0xffffff95
imul edi, dword [eax], 0xffffff97
jo 0x414a44
sub byte [esi], dl
push ds
popal
xchg ebp, eax
sar byte [ebx - 0x13], 0x23
push ebp
cmp ch, byte [esi + ebx]
push ds
xchg ebp, eax
push ds
sub bl, byte [ebp + 0x5c1f6a6d]
push ss
sub dword [edx + ebp*2 - 0x67], 0xffffffe8
test dword [edi], ebx
loope 0x414afc
out dx, al
not byte [edi + ebx - 0x7c5b0a8e]
int 0x43
push 0xffffffffffffff94
test ebp, edx
xchg esp, eax
xchg edx, eax
cmc
mov al, 0x83
imul edi, dword [edx + ebp*2 - 0x6c], 0x6b951ed5
insb byte es:[edi], dx
idiv byte [edi + 0x7ee19234]
aad 0x1e
xchg ebp, eax
imul ebp, dword [esi + esi*8 - 0x41], 0x34
xchg edx, eax
loope 0x414b25
jg 0x414a3b
sub eax, ebp
xor ch, byte [esi + ebx]
jge 0x414b06
stosb byte es:[edi], al
loopne 0x414b1d
out dx, al
lodsd eax, dword [esi]
push 0xffffffffffffff90
nop
sbb dword [ecx - 0x5b6b95bf], 0xffffffdc
cdq
imul edi, dword [eax], 0xffffff97
invalid
xchg edi, eax
jo 0x414a71
cmp byte [edi - 0x31975290], dl
les ebp, [edx]
insd dword es:[edi], dx
push 0x6d2ac4ce
pop ds
std
mov ebx, 0x1955caf
wait
imul bh
scasb al, byte es:[edi]
xchg ebx, eax
loope 0x414a9c
or ecx, 0xffffffd8
imul edx, dword [esp + edx*8 + 0x6d29751e], 0xffffffa4
sub dword [ebp - 0x5c], ebp
xchg ecx, eax
mov ebp, dword [edi]
push ds
sub eax, 0x955f0d5b
cmp dword [0x85946ae1], 0x45
push 0xffffffffffffff94
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
test dword [ebx], ecx
sub al, 0x1e
jge 0x414ab6
jmp 0x414adf
xchg ebp, eax
imul ebp, dword [ebp + 0x1e], 0xffffff95
imul ebp, dword [ebp + 0x1e], 0xffffff95
imul edx, dword [edx + 0x6d946ae1], 0x1e
xchg ebp, eax
imul edx, dword [edx + 0x6d946ae1], 0x1e
push ds
xchg ebp, eax
imul ebp, dword [ebp + 0x1e], 0xffffff95
imul ebp, dword [ebp + 0x1e], 0xffffff95
push ds
xchg ebp, eax
imul ebp, dword [ebp + 0x1e], 0x16
xchg dword [ecx - 0x27], ebp
xchg ecx, eax
dec edi
xor dword [esi - 0x1a9b9429], 0x6e6d03da
aam 0x6b
and ebx, dword [ecx + 0x2d]
mov bl, 0xef
and al, 0x13
shl byte [edx + 0x442ef54f], 1
loope 0x414b1e
shr byte [ebp + 0xe], cl
aad 0x6b
in al, dx
fst dword [ebx + ebp*2 - 0x7aebe193]
test byte [eax - 0x63], ch
mov esp, ebp
invalid
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x58127326
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x271b1725
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x9d2370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x9d238e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x9fb074
push ecx
mov edi, eax
call fcn.009e6198
mov esi, eax
add esp, 8
test esi, esi
jne 0x9d23cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.009e602e
push esi
call fcn.009e5fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret