joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419bb0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4309bc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x419bc3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x419c04
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x430a64]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x419c36
mov bl, byte [esp + ecx + 0x4c]
jmp 0x419c3a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x419c2b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x419c58
mov bl, byte [esp + ecx + 0x4c]
jmp 0x419c5c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x419c4d
xor ecx, ecx
mov eax, 0x4309cc
xor ebx, ebx
mov bl, byte [ecx + 0x430a74]
cmp byte [esp + ebx + 0x14], 0
je 0x419c87
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x430a8c]
cmp byte [esp + ebx + 0x14], 0
je 0x419c9e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x419c6e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x419bf7
lea edx, [esp + 0x84]
push edx
call fcn.00419ce0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov edx, 0xc3e83ec
cmp byte [esp + ecx + 0x53], ah
jb 0x404ac3
lea edx, [eax + 7]
mov dword [esi], edx
clc
cmp edx, eax
mov eax, dword [ebp + 0x31]
mov dword [ebp - 8], edx
jae 0x404a99
mov esi, edi
and byte [ebp + 0x46840fc0], al
push edi
sub al, 0
push 0xffffffffffffff98
call [esi]
add esp, 4
xor eax, eax
mov ecx, 0xe58b5b5e
pop ebp
ret 0x5108
mov esp, 0x4e8b2c70
fimul dword [ebx - 0x6d4ebe9]
cmp edx, edi
ja 0x404ab8
add ebx, dword [edi + 0x1056895f]
pop esi
mov eax, ecx
pop ebx
pop edx
in eax, 0x5d
ret 0xc508
hlt
xlatb
ja 0x404ada
pushfd
inc edi
add al, 0x8b
cmp dword [ebx], ebp
cmp byte [ebx + 0x4798b01], cl
mov dword [eax + 4], edi
jmp 0x404c4a
mov edi, dword [eax + 0x18]
lea ebx, [edx + 0xfd68]
cmp edx, 0xfffff000
ret 0x89da
mov eax, dword [ecx + 0x10]
inc ebx
inc ecx
or al, 0
add byte [edx], al
add edx, eax
mov dword [ecx + 0x10], edx
mov edx, dword [esi + 4]
mov dword [ecx - 0x38], edx
push edi
or cl, byte [ebx + 0x26890855]
mov edx, dword [ebp + 8]
mov dword [esi], esp
mov dword [esi + 4], ecx
mov dword [edx + 0x2c], ecx
mov ecx, dword [esi + 0x14]
mov ecx, dword [esi - 0x7430d4f0]
xor al, byte [ecx + 0x431000c1]
push ebx
mov edx, edi
jae 0x404c61
add al, dh
inc dword [ecx + ecx*2 - 0x3f]
stc
or al, 0x8d
jae 0x404c97
mov ebx, dword [edx - 0x34]
cmp ecx, ebx
retf
mov edx, dword [edx]
cmp ecx, dword [eax - 0x74068df4]
dec esi
add al, 0x89
cmp dword [edx], ebx
push cs
jb 0x404c92
mov ecx, dword [esi + 4]
mov dword [ecx], edi
sbb cl, byte [esi]
mov edi, dword [esi + 4]
mov dword [ecx + 0x5a], edi
mov ecx, dword [edx + 4]
mov dword [esi + 0x3e], ecx
mov dword [ecx], esi
mov dword [esi], edx
xchg esi, eax
jb 0x404cb7
aas
pop esi
pop ebx
mov esp, ebp
pop ebp
in eax, 0x5d
hlt
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x442384
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x442393
pop dword [ebp - 0x3c]
mov eax, 0xdeb7e5d1
sub eax, 0xde73c23e
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x4f6b3
push 0
mov eax, 0xff7c0138
add eax, 0xc8b178
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x4f5cb737
add ecx, 0xb0a38dea
xor ebx, ebx
add ebx, eax
mov edx, 0x1577b748
sub edx, 0x152f2948
add edx, dword [ebp - 0x3c]
mov edi, 0x9851157
sub dword [ebp - 0x24], ebx
mov esi, dword [edx]
xor dword [ebp - 8], eax
xor esi, edi
mov dword [ebx], esi
sub dword [ebp - 0xc], esi
add ebx, 4
add edx, 4
loop 0x4423ee
add eax, 0x7e4bef90
sub eax, 0x7e4ae839
mov ebx, eax
add eax, 0x8727677e
add eax, 0x78d89887
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4087e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408874
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408874
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408827
test edx, 3
jne 0x408816
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408821
jmp 0x408827
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408827
cmp dword [ecx - 8], 1
je 0x408831
mov edx, ebx
or edx, 3
call fcn.00405924
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408843
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405234

Function at 0x408880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408910
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408910
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4088c3
test edx, 3
jne 0x4088b2
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4088bd
jmp 0x4088c3
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4088c3
cmp dword [ecx - 8], 1
je 0x4088cd
mov edx, ebx
or edx, 3
call fcn.00405924
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4088df
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405234

Function at 0x41abb0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41abb6
ret
Function at 0x425414
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x425442
mov eax, ebx
call fcn.00425ec8
cmp dword [ebx + 0x40], 0
je 0x42543b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4254b3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4254a5
cmp dword [ebx + 8], 0
je 0x425464
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x425476
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4254a5
cmp dword [ebx + 8], 0
je 0x425457
cmp eax, 3
je 0x425489
dec eax
jne 0x425457
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x425457
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x425457
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4254d1
cmp dword [ebx + 0x14], 0xcc
je 0x4254d1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004254dc
pop ebx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403203
pop dword [ebp - 0x14]
mov eax, 0x403203
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x8b013eb8
add dword [ebp - 0x24], 0xc3510693
mov dword [ebp - 0x20], 0x81ac4bc7
add dword [ebp - 0x20], 0xb087007e
mov dword [ebp - 0x1c], 0x450dc1
add dword [ebp - 0x1c], 0x4c07366d
mov dword [ebp - 0x18], 0x6277e44d
sub dword [ebp - 0x18], 0x6277e44d
lea eax, [ebp - 0x24]
push eax
mov eax, 0x3da041fe
sub eax, 0x3d5fd19a
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xcd5964cf
add dword [ebp - 0x24], 0xa7190487
mov dword [ebp - 0x20], 0xeac06378
add dword [ebp - 0x20], 0x56abfdfd
mov dword [ebp - 0x1c], 0x2103871d
add dword [ebp - 0x1c], 0x426be54f
mov dword [ebp - 0x18], 0xe776acfb
sub dword [ebp - 0x18], 0xe776acfb
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x5afb4a3
add eax, 0xfa90bc05
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3b8d5
push 0
call eax
mov ecx, 0xcb6ea0e6
sub ecx, 0xcb6e4511
mov ebx, eax
mov edx, 0x410000
add edx, dword [ebp - 0x14]
mov edi, 0xe33ce05a
add edi, 0xa13b20f6
mov dword [ebp - 8], 0xc2252fe
mov esi, dword [edx]
xor dword [ebp - 0xc], edi
xor esi, edi
xor dword [ebp - 8], esi
mov dword [ebx], esi
add dword [ebp - 0xc], 0xea42e085
add ebx, 4
add edx, 0x270e15ed
add edx, 0xd8f1ea17
loop 0x40331a
add eax, 0x16227
xor ebx, ebx
add ebx, eax
add eax, 0x1d659302
sub eax, 0x1d6592fd
mov ecx, 0x6d2b52dd
sub ecx, 0x6ceb52dd
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], 0x40d114
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401a5f
cmp dword [ebp - 0x118], 0
je 0x401a5f
jmp 0x401ac3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401ac3
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x438274], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x438290], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x43828c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.004013b0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401a5f
mov esp, ebp
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414ddc
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], ebx
add eax, 4
mov edi, 0x757be830
push 0x900fe3fe
pop edx
cmp eax, esi
jne fcn.00414ddc
add edi, 0x373e43d9
and edx, ecx
ret
Function at 0x4c8810
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5e000]
push edi
jmp 0x4c882a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c8831
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8820
mov eax, 1
add ebx, ebx
jne 0x4c8843
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c8838
jne 0x4c8854
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c8838
xor ecx, ecx
sub eax, 3
jb 0x4c8868
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c88da
mov ebp, eax
add ebx, ebx
jne 0x4c8873
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4c8880
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4c88a4
inc ecx
add ebx, ebx
jne 0x4c8890
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c8885
jne 0x4c88a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c8885
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c88c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c88b5
jmp 0x4c8826
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c88c4
add edi, ecx
jmp 0x4c8826
pop esi
mov edi, esi
mov ecx, 0xd2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c88e2
cmp byte [edi], 1
jne 0x4c88e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c88e7
lea edi, [esi + 0xc5000]
mov eax, dword [edi]
or eax, eax
je 0x4c8956
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc8594]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc863c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c8914
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc8644]
or eax, eax
je 0x4c8950
mov dword [ebx], eax
add ebx, 4
jmp 0x4c8931
call dword [esi + 0xc8640]
mov ebp, dword [esi + 0xc8648]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c898a
sub esp, 0xffffff80
jmp 0x403da4
Function at 0x437165
Capabilities:
Encode data using xor

Disassembly:
xchg byte [eax + 0xf7530f4], ah
mov byte [0xfd48428c], al
add ebx, dword [edi]
add eax, 0xff8c67d2
dec ecx
dec ecx
adc dh, byte [ecx]
mov byte [0x3ab59d35], al
mov dl, 6
shr edx, cl
xchg esp, eax
jp 0x437183
ljmp 0x97fe:0x22fc7a94
and bh, dh
xchg edi, eax
mov dword [edx], edi
mov edx, ebp
dec edi
inc esp
cmp eax, 0x9047a0f3
xchg ebp, eax
mov dh, 0x9e
push esp
invalid

Function at 0x44aab0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x214
lea eax, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push 0x104
push eax
push ecx
mov word [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44ab72
cmp eax, 0x104
jne 0x44aaf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x44ab72
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x44ab72
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x44ab72
mov ecx, dword [esp + 0x10]
push ebx
push esi
push edi
lea edx, [esp + 0x24]
push ecx
push edx
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44ab5a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44ab5a
mov edx, dword [esp + 0x10]
mov ebx, 1
mov ax, word [edx]
mov word [ebp], ax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x214
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x214
ret 8
Function at 0x60f572
Capabilities:
Encode data using xor

Disassembly:
fnstcw word [esi + 0x1a]
push es
clc
adc bl, byte [edx - 0x446b6547]
imul eax, dword [ecx], 0x84b095e4
cmp byte [ecx + 0x29645e5a], ah
pop esp
adc al, 4
lds ecx, [esp + ecx]
mov ebx, 0x481b55b6
mov dh, 0xc7
adc byte [eax - 0xb], cl
or eax, 0x7d9cd025
xchg esp, eax
sal byte [edi + 0x3e], 0x38
pop ecx
xor al, 0x1c
jnp 0x60f5b3
push ebp
call 0xb1fddee8
lock xor bl, byte [ebx + ebx*2 - 0x33c2e0b]
cmc
rol ebx, 1
cld
push ebx
cmp byte [ecx + 0x41], 0x56
fsubr dword [eax]
jnp 0x60f62b
insb byte es:[edi], dx
in al, 0x7b
inc edi
das
xchg ebp, eax
cmp al, 0xa
mov bh, byte [eax - 0x85fc645]
push esi
sub al, dl
add byte [ebx + edx - 0x3a042f16], dh
cdq
cmpsb byte [esi], byte es:[edi]
adc al, 0xb7
and byte [esi + ebp*4], cl
cdq
cmp esp, dword [edi + 0x41]
mov eax, 0x4cb1fcec
fbld tbyte [ecx + ebp*4 + 0x36]
insd dword es:[edi], dx
sbb dword [eax - 0x141d6233], edi
mov ah, 0xed
invalid
fstp dword [edi + 0x16]
add cl, byte [eax + 0x8881045]
dec edi
adc ch, dl
adc byte [eax - 0x2aefb0f8], cl
mov esp, 0x2ec4f138
shl byte [ebx], 1
fnstsw word [eax + 0x3b]
das
sub al, 0x63
mov ah, 0x95
xchg esi, eax
push edx
push edx
or byte [ecx - 0x19ca6d9c], ch
test al, 0xb
fidivr dword [0xd3f6eb0a]
xor al, byte [ebp - 0x77]
rol ecx, 0x7b
wait
wait
cmpsd dword [esi], dword es:[edi]
test byte [edi + 0x5c73f137], cl
xchg ebx, eax
mov eax, dword [0xe47baf88]
jnp 0x60f625
cmp ch, byte [edi - 0x40c93491]
stosd dword es:[edi], eax
mov dh, 0xfa
mov eax, 0xf97bc5fb
or ebx, dword [edx + edx*4]
stosb byte es:[edi], al
test dword [eax - 0x178c75c3], ebx
xchg esp, eax
and dword [ebx + 0x1f], 3
jle 0x60f6e0
scasd eax, dword es:[edi]
outsd dx, dword [esi]
retf
jns 0x60f6e4
sub dword [ebx], edx
xchg esi, eax
sub dword [edx], ebp
mov eax, 0x98cce328
xchg edi, eax
xchg ebx, eax
fprem
lodsb al, byte [esi]
mov edi, 0x914fa8fd
push ebx
loopne 0x60f669
push edi
invalid
cmpsb byte [esi], byte es:[edi]
ret 0x5e8
cmp byte [ebx - 0x15], ch
sub bl, 0x32
mov ebp, 0xbf8f7a8c
or bl, dl
sti
cmp eax, 0x50
int 0x8e
sbb byte [esp], ah
out dx, eax
push esi
or ebx, dword [eax + 0x1824da30]
mov bl, 0x54
mov ebp, 0x113d7a49
lea edx, [esi + 0x65]
fiadd word [eax - 0x6643af8]
not bl
jnp 0x60f6df
jmp dword [ebp - 0x70]
Function at 0x40319a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.004031be
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0044614f
add esp, 4
push 0xa
call fcn.00444f7b
pop ebp
ret
Function at 0x407d2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], 0xfbea
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x407d86
mov edx, dword [ebp - 2]
and edx, 0xffff
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
xor edx, ecx
and edx, 0xff
xor eax, eax
mov ax, word [edx*2 + 0x46bca8]
mov ecx, dword [ebp - 2]
and ecx, 0xffff
sar ecx, 8
xor eax, ecx
mov word [ebp - 2], ax
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x407d40
mov edx, dword [ebp - 2]
and edx, 0xffff
and edx, 0x7ff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x260]
lea eax, [ecx + edx*4]
mov esp, ebp
pop ebp
ret
Function at 0x41202e
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov dword [ebp - 0x808], 0
cmp dword [0x4854cc], 0
jne 0x412115
lea eax, [ebp - 0x800]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x804], 0
jmp 0x41207b
mov ecx, dword [ebp - 0x804]
add ecx, 1
mov dword [ebp - 0x804], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x804]
cmp eax, dword [edx + 4]
jge 0x412108
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x804]
mov ecx, dword [edx + eax*4]
movsx edx, byte [ecx + 8]
cmp edx, 2
jne 0x412103
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x804]
mov eax, dword [ecx + edx*4]
movsx ecx, byte [eax + 0xa]
test ecx, ecx
jne 0x4120bf
cmp dword [0x46bfd4], 0
jne 0x412103
lea edx, [ebp - 0x400]
push edx
lea eax, [ebp - 0x800]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x804]
mov ecx, dword [edx + eax*4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x804]
mov edx, dword [eax + ecx*4]
mov eax, dword [edx]
push eax
call fcn.004114a0
add esp, 0x10
mov ecx, dword [ebp - 0x808]
add ecx, eax
mov dword [ebp - 0x808], ecx
jmp 0x41206c
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x808]
mov esp, ebp
pop ebp
ret

Function at 0x41211f
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov dword [ebp - 0x808], 0
lea eax, [ebp - 0x800]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x804], 0
jmp 0x41215f
mov ecx, dword [ebp - 0x804]
add ecx, 1
mov dword [ebp - 0x804], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x804]
cmp eax, dword [edx + 4]
jge 0x412202
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x804]
mov ecx, dword [edx + eax*4]
movsx edx, byte [ecx + 8]
cmp edx, 3
jne 0x4121fd
mov eax, dword [0x4854d0]
cmp eax, dword [ebp - 0x804]
jle 0x41219d
movsx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x4121fd
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x804]
mov edx, dword [eax + ecx*4]
movsx eax, byte [edx + 0xa]
test eax, eax
jne 0x4121bc
cmp dword [0x46bfd4], 0
jne 0x4121fd
lea ecx, [ebp - 0x400]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x804]
mov eax, dword [ecx + edx*4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x804]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx]
push edx
call fcn.004114a0
add esp, 0x10
mov ecx, dword [ebp - 0x808]
add ecx, eax
mov dword [ebp - 0x808], ecx
jmp 0x412150
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x808]
mov esp, ebp
pop ebp
ret