joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6392b8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x6392fd
pop edi
pop esi
pop ebx
leave
ret

Function at 0x63a628
Capabilities:
Link many functions at runtime

Disassembly:
lea esi, [0x6e1818]
push esi
mov eax, dword [0x6e1408]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x6e182d], eax
mov dword [0x6e10f5], 1
mov eax, 0x4000
push eax
lea eax, [0x6e1333]
push eax
lea eax, [0x6e10e1]
push eax
lea esi, [0x6e15cf]
call dword [esi]
cmp eax, 0xffffffff
jne 0x63a674
mov dword [0x6e10f5], 0
cmp dword [0x6e10f5], 0
je 0x63a6ea
mov eax, 0x4000
push eax
lea eax, [0x6e1333]
push eax
lea eax, [0x6e10ca]
push eax
lea esi, [0x6e15cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x63a6ea
lea eax, [0x6e10ca]
push eax
call dword [0x6e11f3]
mov dword [0x6e10ed], eax
cmp eax, 0
je 0x63a6ea
lea edx, [0x6e10f9]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a6ea
mov dword [0x6e114b], eax
mov eax, dword [0x6e10ed]
lea edx, [0x6e1130]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a6ea
mov dword [0x6e114f], eax
jmp 0x63a762
mov eax, 0x4000
push eax
lea eax, [0x6e1333]
push eax
lea eax, [0x6e10d7]
push eax
lea esi, [0x6e15cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x63a757
lea eax, [0x6e10d7]
push eax
call dword [0x6e11f3]
mov dword [0x6e10f1], eax
cmp eax, 0
je 0x63a757
lea edx, [0x6e1115]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a757
mov dword [0x6e114b], eax
mov eax, dword [0x6e10f1]
lea edx, [0x6e113e]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a757
mov dword [0x6e114f], eax
jmp 0x63a76d
mov dword [0x6e1153], 0
ret
mov dword [0x6e1153], 1
ret
mov dword [0x6e1153], 2
ret

Function at 0x63aa85
Capabilities:
Packed with generic packer

Disassembly:
pushal
push eax
push ecx
push edx
test ax, 1
je 0x63aaa2
push ecx
push edx
call dword [0x6e1763]
cmp eax, 0
je 0x63aaa2
pop edx
pop ecx
pop eax
stc
jmp 0x63aabd
pop edx
pop ecx
pop eax
test ax, 2
je 0x63aabc
push ecx
push edx
call dword [0x6e1775]
cmp ax, 0
je 0x63aabc
stc
jmp 0x63aabd
clc
popal
ret
Function at 0x63b8f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 8]
mov dword [esp + 0x14], 0xc
mov edx, dword [edi + 4]
add edx, ecx
mov ecx, dword [edi]
mov dword [edi + 4], edx
mov edx, dword [eax + 4]
add ecx, edx
mov dword [edi], ecx
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
mov esi, ebx
mov edx, ebx
shr esi, 4
xor edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
add ebp, 8
shr eax, cl
mov ecx, esi
shl edx, cl
mov ecx, 0x20
or eax, edx
mov edx, dword [ebp - 8]
sub eax, edx
mov edx, eax
mov dword [edi + 4], eax
shr edx, 7
and edx, 0x1f
xor eax, ebx
sub ecx, edx
mov esi, eax
shr esi, cl
mov ecx, edx
mov edx, dword [ebp - 4]
shl eax, cl
or esi, eax
mov eax, dword [esp + 0x14]
add esi, edx
dec eax
mov dword [edi], esi
mov dword [esp + 0x14], eax
jne 0x63b91a
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x63b979
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 0x60]
mov dword [esp + 0x14], 0xc
mov ebx, dword [edi + 4]
mov edx, dword [edi]
mov ecx, dword [ebp + 4]
mov esi, ebx
shr esi, 7
sub edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
sub ebp, 8
shl eax, cl
mov ecx, esi
shr edx, cl
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov ecx, dword [ebp + 8]
mov edx, eax
shr edx, 4
lea esi, [ebx + ecx]
and edx, 0x1f
mov ecx, 0x20
mov ebx, esi
sub ecx, edx
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [edi + 4], ebx
mov dword [esp + 0x14], eax
jne 0x63b990
mov eax, dword [esp + 0x18]
mov esi, dword [edi]
mov ecx, ebx
mov edx, dword [eax + 4]
sub esi, edx
mov dword [edi], esi
mov eax, dword [eax]
sub ecx, eax
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x63ba04
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
mov eax, dword [esp + 0x90]
push ebx
push esi
mov esi, dword [esp + 0x94]
lea ebx, [eax + 7]
shr ebx, 3
and eax, 7
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
jne 0x63ba35
mov dword [esp + 0x10], 8
push ebp
push edi
lea eax, [ebx - 1]
xor edx, edx
xor ecx, ecx
xor edi, edi
test eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edi
jbe 0x63bb05
mov ebp, dword [esi]
xor ebp, ecx
mov ecx, dword [esi + 4]
xor ecx, edx
mov dword [esi], ebp
test edi, edi
mov dword [esi + 4], ecx
jne 0x63bad7
cmp ebx, 2
push edi
jbe 0x63baca
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0063be35
mov edi, dword [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x30], edi
lea eax, [esp + 0x30]
mov ebx, 0x19
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
add ecx, edx
mov ebp, edi
mov dword [eax + 4], ecx
mov edx, dword [eax]
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
add eax, 4
shl ebp, cl
mov ecx, edx
mov edx, ebp
mov ebp, edi
shr ebp, cl
or edx, ebp
mov ebp, dword [esp + 0x34]
xor ebp, edx
dec ebx
mov dword [esp + 0x34], ebp
jne 0x63ba8b
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jmp 0x63bae5
push 0
push esi
call fcn.0063be35
add esp, 0xc
jmp 0x63bae5
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0063b8f0
add esp, 8
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
inc edi
lea eax, [ebx - 1]
mov dword [esp + 0x10], ecx
cmp edi, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
jb 0x63ba54
mov eax, dword [esp + 0x18]
xor edi, edi
test eax, eax
jbe 0x63bb30
mov ebp, esi
lea ecx, [esp + 0x10]
sub ebp, ecx
mov cl, byte [esp + edi + 0x10]
lea eax, [esp + edi + 0x10]
mov dl, byte [ebp + eax]
xor cl, dl
inc edi
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp edi, eax
jb 0x63bb17
pop edi
cmp ebx, 2
pop ebp
jbe 0x63bb4b
lea eax, [esp + 0x28]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0063b8f0
add esp, 8
jmp 0x63bb6e
cmp ebx, 1
jne 0x63bb5d
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
push 0
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.0063be35
add esp, 0xc
cmp ebx, 1
jbe 0x63bba2
mov ecx, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
jbe 0x63bb89
mov dl, byte [esi + eax - 8]
mov byte [esi + eax], dl
inc eax
cmp eax, ecx
jb 0x63bb7d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi - 8], eax
mov dword [esi - 4], ecx
pop esi
xor eax, eax
pop ebx
add esp, 0x88
ret
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi], edx
mov dword [esi + 4], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x88
ret
Function at 0x63bbba
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
mov eax, dword [esp + 0x98]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
lea ebp, [eax + 7]
push esi
shr ebp, 3
and eax, 7
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], eax
jne 0x63bbed
mov dword [esp + 0x20], 8
xor edx, edx
cmp ebp, 1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
jbe 0x63bcd6
lea eax, [ebp - 2]
xor esi, esi
cmp eax, edx
mov dword [esp + 0x24], esi
jbe 0x63bcd6
jmp 0x63bc1d
xor edx, edx
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp esi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jne 0x63bc8d
push edx
lea edx, [esp + 0x34]
push edx
push ebx
call fcn.0063be35
mov esi, dword [esp + 0x3c]
add esp, 0xc
mov dword [esp + 0x38], esi
lea eax, [esp + 0x38]
mov edi, 0x19
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
add ecx, edx
mov ebp, esi
mov dword [eax + 4], ecx
mov edx, dword [eax]
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
add eax, 4
shl ebp, cl
mov ecx, edx
mov edx, ebp
mov ebp, esi
shr ebp, cl
or edx, ebp
mov ebp, dword [esp + 0x3c]
xor ebp, edx
dec edi
mov dword [esp + 0x3c], ebp
jne 0x63bc4e
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
jmp 0x63bc9b
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0063b979
add esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
xor edx, ecx
mov dword [ebx], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor eax, edx
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
add ebx, 8
inc esi
lea eax, [ebp - 2]
cmp esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], esi
jb 0x63bc1b
xor edx, edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
cmp ecx, edx
mov dword [esp + 0x14], edx
jbe 0x63bcfb
mov eax, ecx
lea esi, [ebx + 8]
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebp, 1
jne 0x63bd10
push edx
push edx
push ebx
call fcn.0063be35
add esp, 0xc
jmp 0x63bd98
cmp ebp, 2
jne 0x63bd22
push edx
push edx
push ebx
call fcn.0063be35
add esp, 0xc
jmp 0x63bd35
lea ecx, [esp + 0x38]
push ecx
push ebx
call fcn.0063b979
add esp, 8
cmp ebp, 1
jbe 0x63bd98
mov edx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x20]
xor esi, edx
mov edx, dword [esp + 0x14]
xor edx, eax
xor eax, eax
test edi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
jbe 0x63bd76
mov ecx, ebx
lea edx, [esp + 0x10]
sub ecx, edx
mov dl, byte [eax + ebx + 8]
lea esi, [esp + eax + 0x10]
inc eax
mov byte [esi + ecx], dl
mov dl, byte [esi]
mov byte [eax + ebx + 7], dl
cmp eax, edi
jb 0x63bd60
cmp ebp, 2
jne 0x63bd8a
push 0
push 0
push ebx
call fcn.0063be35
add esp, 0xc
jmp 0x63bd98
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0063b979
add esp, 8
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
xor edx, ecx
mov dword [ebx], edx
mov edx, dword [esp + 0x1c]
xor eax, edx
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret
Function at 0x6534e0
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
sub esp, 0x408
mov edx, dword [esp + 0x40c]
push edx
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x653550
lea eax, [esp + 4]
push eax
push 0x400
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
cmp byte [esp + 5], 0x3a
jne 0x653545
mov byte [esp + 0x404], 0x3d
mov al, byte [esp + 4]
mov byte [esp + 0x405], al
mov byte [esp + 0x406], 0x3a
mov byte [esp + 0x407], 0
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x408]
push eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
xor eax, eax
add esp, 0x408
ret
or eax, 0xffffffff
add esp, 0x408
ret

Function at 0x667da0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov esi, dword [ebp + 8]
cmp byte [0x78a030], 0
jne 0x667dc6
mov dword [0x78a02c], 0
mov byte [0x78a030], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [eax + 8], 0
mov ebx, dword [0x78a028]
jmp 0x667de3
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x667ded
mov eax, dword [ebx]
cmp dword [eax], esi
ja 0x667de0
test ebx, ebx
jne 0x667e00
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
xor edx, edx
mov ecx, eax
cmp eax, 1
je 0x667e39
lea eax, [eax]
lea ebx, [edx + ecx]
sar ebx, 1
cmp dword [edi + ebx*8], esi
ja 0x667e30
mov edx, ebx
jmp 0x667e32
mov ecx, ebx
mov ebx, edx
inc ebx
cmp ebx, ecx
jne 0x667e20
cmp esi, dword [edi + edx*8]
jb 0x667f1c
mov ecx, edx
inc ecx
cmp ecx, eax
je 0x667e53
cmp esi, dword [edi + edx*8 + 8]
jae 0x667f1c
mov ecx, dword [edi + edx*8 + 4]
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [eax]
movsx eax, byte [ecx]
and eax, 1
jne 0x667f12
movzx eax, word [ecx + 5]
mov dword [ebp - 0x10], eax
add ebx, 7
mov dword [ebp - 0x14], 0
test eax, eax
jle 0x667f12
mov edi, dword [ebx]
mov al, byte [edi]
cmp al, 0xe8
je 0x667e91
cmp al, 0xcc
jne 0x667e96
add edi, 5
jmp case.default.0x667eca
cmp al, 0xff
jne 0x667ee0
movzx eax, byte [edi + 1]
mov edx, eax
sar edx, 6
and eax, 7
add edi, 2
cmp edx, 3
je case.default.0x667eca
cmp eax, 4
jne 0x667eb4
inc edi
test edx, edx
jne 0x667ec2
cmp eax, 5
jne 0x667ec2
add edi, 4
jmp case.default.0x667eca
mov eax, edx
dec edx
cmp edx, 1
ja case.default.0x667eca
jmp dword [edx*4 + 0x6de71c]
inc edi
jmp case.default.0x667eca
add edi, 4
jmp case.default.0x667eca
call fcn.00678330
cmp edi, esi
jne 0x667f00
add ebx, 4
mov ecx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add ebx, 8
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x667e85
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x66a160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
mov ecx, dword [0x6de9d0]
push ecx
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x66a295
call dword [fcn.00a1215c]
test eax, eax
jne 0x66a290
push 0x288
call fcn.006618c0
pop ecx
mov esi, eax
test esi, esi
jne 0x66a1a0
xor eax, eax
pop esi
pop ebx
ret
mov ebx, 0x7d9620
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x78a098]
mov dword [esi], eax
mov dword [0x78a098], esi
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov dword [esi + 0xc], 0x6de9d4
mov dword [esi + 0x10], 0x6de9d4
mov eax, dword [esp + 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0x280], 0x6de9d8
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 1
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 0
or dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x27c], 0x6df878
mov dword [esi + 0x284], 0
push esi
mov eax, dword [0x6de9d0]
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
pop ebx
ret
xor eax, eax
pop esi
pop ebx
ret
mov eax, 1
pop esi
pop ebx
ret
Function at 0x677fc0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x150
mov ebx, dword [0xa0d068]
mov edx, dword [0xa0d078]
mov eax, dword [ebx + edx*4 - 4]
mov dword [ebp - 0x158], eax
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ebx, 0xfffffffe
sub ebx, ecx
add ebx, dword [ebp - 0x158]
jmp 0x678001
dec ebx
cmp ebx, dword [ebp - 0x158]
jbe 0x67801e
movsx eax, byte [ebx - 1]
push eax
push 0x6df834
call fcn.006426e0
pop ecx
pop ecx
test eax, eax
je 0x678000
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x158]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x150], eax
cmp eax, 0xffffffff
je 0x6780d7
lea esi, [ebp - 0x120]
sub ebx, dword [ebp - 0x158]
mov dword [ebp - 0x154], ebx
mov edi, esi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
add eax, dword [ebp - 0x154]
inc eax
push eax
call fcn.006618c0
pop ecx
mov edi, eax
push dword [ebp - 0x158]
push edi
call fcn.006425b0
pop ecx
pop ecx
push esi
lea eax, [ebx + edi]
push eax
call fcn.006425b0
pop ecx
pop ecx
call fcn.00677f70
test eax, eax
je 0x6780cb
mov ecx, dword [0xa0d068]
mov edx, dword [0xa0d078]
mov dword [ecx + edx*4 - 4], edi
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x150]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
je 0x6780cb
mov eax, dword [0xa0d078]
inc dword [0xa0d078]
test eax, eax
jne 0x678052
push dword [ebp - 0x150]
call dword [sym.imp.kernel32.dll_FindClose]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6780e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov dword [0x78a6ac], 1
mov dword [0xa0d078], 0
push 4
call fcn.006618c0
pop ecx
mov dword [0xa0d068], eax
test eax, eax
jne 0x678120
call fcn.00677f50
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov esi, eax
mov edi, esi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
inc eax
push eax
call fcn.006618c0
pop ecx
mov dword [0x78a6a8], eax
mov edi, eax
test edi, edi
jne 0x678159
call fcn.00677f50
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
inc esi
movsx eax, byte [esi]
push eax
push str.__t_r_n_v
call fcn.006426e0
pop ecx
pop ecx
test eax, eax
jne 0x678158
jmp 0x6782ac
call fcn.00677f70
test eax, eax
je 0x6782b5
mov dword [ebp - 0x10], 0
mov edx, dword [0xa0d078]
mov eax, dword [0xa0d068]
mov dword [eax + edx*4], edi
inc dword [0xa0d078]
xor ebx, ebx
jmp 0x678297
test ebx, ebx
jne 0x6781f0
movsx eax, al
push eax
push str.__t_r_n_v
call fcn.006426e0
pop ecx
pop ecx
test eax, eax
je 0x6781e0
inc esi
mov cl, byte [esi]
test cl, cl
je 0x6781d4
movsx eax, cl
push eax
push str.__t_r_n_v
call fcn.006426e0
pop ecx
pop ecx
test eax, eax
jne 0x6781b9
mov byte [edi], 0
inc edi
jmp 0x6782a1
cmp byte [esi], 0x22
jne 0x678212
inc esi
mov ebx, 1
jmp 0x678297
cmp al, 0x22
jne 0x678206
cmp byte [esi + 1], 0x22
jne 0x678206
mov byte [edi], 0x22
inc edi
add esi, 2
jmp 0x678297
cmp al, 0x22
jne 0x678212
inc esi
xor ebx, ebx
jmp 0x678297
mov al, byte [esi]
cmp al, 0x5c
jne 0x678254
cmp byte [esi + 1], 0x5c
jne 0x678254
mov ecx, 2
jmp 0x678226
inc ecx
mov al, byte [esi + ecx]
cmp al, 0x5c
je 0x678225
cmp al, 0x22
jne 0x67824d
and ecx, 0xfffffffe
je 0x678297
mov al, byte [esi]
mov byte [edi], al
inc edi
add esi, 2
sub ecx, 2
test ecx, ecx
jne 0x678236
jmp 0x678297
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
sub ecx, 1
jae 0x678247
jmp 0x678297
cmp al, 0x5c
jne 0x678267
cmp byte [esi + 1], 0x22
jne 0x678267
mov byte [edi], 0x22
inc edi
add esi, 2
jmp 0x678297
cmp al, 0x5c
jne 0x678280
mov dl, byte [esi + 1]
cmp dl, 0x3f
je 0x678278
cmp dl, 0x2a
jne 0x678280
mov byte [edi], dl
inc edi
add esi, 2
jmp 0x678297
test ebx, ebx
jne 0x678293
cmp al, 0x2a
je 0x67828c
cmp al, 0x3f
jne 0x678293
mov dword [ebp - 0x10], 1
mov byte [edi], al
inc esi
inc edi
mov al, byte [esi]
test al, al
jne 0x6781a1
cmp dword [ebp - 0x10], 0
je 0x6782ac
call fcn.00677fc0
cmp byte [esi], 0
jne 0x678172
mov byte [edi], 0
mov edx, dword [0xa0d078]
mov eax, dword [0xa0d068]
mov dword [eax + edx*4], 0
push 0x677f10
call fcn.00663940
pop ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40596d
pop dword [ebp - 0x24]
mov eax, 0xf607243a
sub eax, 0xf5c6cacd
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x15c94c7e
add dword [ebp - 0x34], 0x3888f8cd
mov dword [ebp - 0x30], 0x8add35c2
add dword [ebp - 0x30], 0xa7561683
mov dword [ebp - 0x2c], 0xc988dc22
add dword [ebp - 0x2c], 0x82c3680c
mov dword [ebp - 0x28], 0x6a3dc7f4
sub dword [ebp - 0x28], 0x6a3dc7f4
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x84998900
sub dword [ebp - 0x34], 0x10271faa
mov dword [ebp - 0x30], 0xe1818044
add dword [ebp - 0x30], 0x5feae131
mov dword [ebp - 0x2c], 0xd565acff
add dword [ebp - 0x2c], 0x8e09bf6d
mov dword [ebp - 0x28], 0xcc56f8f2
add dword [ebp - 0x28], 0x33a9070e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x91d651e2
sub eax, 0x9195e0e2
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x33193
push 0
call eax
mov ecx, 0x5282e5ef
sub ecx, 0x5282ac68
xor ebx, ebx
add ebx, eax
mov esi, 0xd1f9be8f
add esi, 0x2e474171
add esi, dword [ebp - 0x24]
mov edx, 0xcf43bfd8
xor dword [ebp - 8], eax
mov edi, dword [esi]
sub dword [ebp - 4], ebx
sub edi, edx
mov dword [ebp - 0x10], 0x411bdcb5
mov dword [ebx], edi
add dword [ebp - 0x14], 0xf5908969
add ebx, 0x81e707bc
add ebx, 0x7e18f848
add esi, 4
loop 0x405a86
add eax, 0xb4cc8c43
add eax, 0x4b344cac
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x403700
Capabilities:
Get file version info

Disassembly:
mov eax, 0x409c7f
call fcn.00409920
sub esp, 0x120
push ebx
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.00405078
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
jne 0x403748
push dword [ebp - 0x128]
push dword [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x403748
mov eax, dword [ebp - 0x12c]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov dword [ebp - 0x10], eax
push edi
mov byte [ebp - 4], 1
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, edi
jne 0x40378f
xor esi, esi
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCRT.dll_public:_void___thiscall_exception::constructor_void_]
lea eax, [ebp - 0x1c]
push 0x40eae0
push eax
mov dword [ebp - 0x1c], 0x40b468
call sub.MSVCRT.dll__CxxThrowException
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x4037af
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_HeapSize]
cmp esi, edi
jne 0x4037b9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor esi, esi
jmp 0x4037c8
push esi
push ebx
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00405091
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x403b53
Capabilities:
Open clipboard

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403b65
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
call dword [sym.imp.WINMM.dll_timeGetTime]
push 7
call dword [sym.imp.MSVCRT.dll_isgraph]
call fcn.004032cb
push 4
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
pop ecx
ret

Function at 0x403db0
Capabilities:
Open clipboard

Disassembly:
mov eax, 0x409d00
call fcn.00409920
sub esp, 0x1c
push str.RO0M38e5b6cpuEwRKUJybRoemoVdMHjSHjCkKgbkSuA2P2MTmXKq4X95VRt0XkibK8ICbUtngeK2Jq8VuwxIhiRs0bgyYXsLd8qc0Ju6sVxyVXD
call fcn.00405e95
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], 0x20019
push eax
push SysReAllocString
lea ecx, [ebp - 0x18]
call fcn.004050bf
cmp dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
je 0x403df9
push dword [ebp - 0x10]
call fcn.00405f4f
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00405843
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403e13
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret