joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure

Function at 0x78144ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x78144cef
pop dword [ebp - 0x24]
mov eax, 0x78144cef
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x41c52
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x37b7d321
add ecx, 0xc84872c6
mov edx, eax
mov ebx, 0x205fe3e9
sub ebx, 0xa84333e9
add ebx, dword [ebp - 0x24]
mov esi, 0xd6ebafd7
mov dword [ebp - 4], 0x81817b3e
mov edi, dword [ebx]
add dword [ebp - 0x10], edx
add edi, esi
xor dword [ebp - 8], eax
mov dword [edx], edi
sub dword [ebp - 8], edx
add edx, 0xbed1ed12
add edx, 0x412e12f2
add ebx, 4
loop 0x78144d3e
add eax, 0x10a6f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa19fcd5
add ecx, 0x6df9032b
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret
Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret

Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000dd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000dd8f
pop dword [ebp - 0x3c]
mov eax, 0xe1f8fe9
sub eax, 0xfe1eb25a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8ceb97fd
add dword [ebp - 0x4c], 0xc166ad4e
mov dword [ebp - 0x48], 0xc0a2db60
add dword [ebp - 0x48], 0x719070e5
mov dword [ebp - 0x44], 0x565db507
sub dword [ebp - 0x44], 0xa1170d9
mov dword [ebp - 0x40], 0x7cdb5ddc
sub dword [ebp - 0x40], 0x7cdb5ddc
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x39c74aad
sub eax, 0x29c5ea4d
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x940466e5
add dword [ebp - 0x4c], 0xe06e0271
mov dword [ebp - 0x48], 0x368682c3
add dword [ebp - 0x48], 0xae5deb2
mov dword [ebp - 0x44], 0x9b983a38
sub dword [ebp - 0x44], 0x3828cdcc
mov dword [ebp - 0x40], 0x9d1d82fc
sub dword [ebp - 0x40], 0x9d1d82fc
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1ef
push 0
call eax
mov ecx, 0x5220
xor esi, esi
add esi, eax
mov edx, 0xd4525184
add edx, 0x3bafe47c
add edx, dword [ebp - 0x3c]
mov ebx, 0x74711095
xor dword [ebp - 0x18], 0xb9811bb
mov edi, dword [edx]
xor dword [ebp - 0x10], 0x43ea9024
add edi, ebx
add dword [ebp - 8], eax
mov dword [esi], edi
add dword [ebp - 4], ecx
add esi, 0x9b94f423
sub esi, 0x9b94f41f
add edx, 0x999abcd1
sub edx, 0x999abccd
loop 0x1000dea2
add eax, 0x93c77d0f
sub eax, 0x93c641bc
xor ebx, ebx
add ebx, eax
add eax, 0x245af4a6
sub eax, 0x245af4a1
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x45a5a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
ja 0x45a5cc
jbe 0x45a605
add eax, 0xab9d3468
jmp 0x45bc71
add eax, 0x5a68198f
jmp 0x45bccf
lea esp, [esp + 0x1c]
jmp 0x45a612
pop dword [esp]
pop word [esp]
mov dword [esp + 0x1c], edi
jmp 0x45a5ef
or edx, esp
jg 0x45bcab
sbb dh, al
jmp 0x45bcad
sbb dh, al
jmp 0x45bcad
jmp 0x45bc95
mov eax, dword [eax + reloc.KERNEL32.dll_GetFileAttributesW]
bswap edx
lea edx, reloc.KERNEL32.dll_GetFileAttributesW
neg dx
jae 0x45bce5
jb 0x45a5dd
and al, 0xb2
and byte [edi - 0x4e], al
push es
xor ebp, ebx
mov ch, bl
sbb dword [edi], edi
test al, 0x3e
pop ecx
test al, 0x19
push ebx
lds edx, [ebp + 0x3c]
iretd
jmp 0x45bcea
jmp 0x45a5dd
mov edx, ebp
inc edx
jmp 0x45c32d
lea edx, [ebx*4]
mov esp, edi
ror dh, 6
jge 0x45bdc1
sets dh
and dl, ah
jmp 0x45bd5b
sets dh
and dl, ah
push eax
ret
jmp 0x45bd56
jns 0x45bcf3
lea edx, [ebx*4]
call fcn.0045c1ee
jmp 0x45c3ab
pushfd
pop edx
pushal
jmp 0x45c3d0
dec ebp
xchg dx, ax
mov edx, esi
pushfd
lea edx, [esp + 0x25]
xchg edx, eax
jmp 0x45c393
rol edx, 0xc
jbe 0x45c463
mov dx, 0x3d0
setge dh
call fcn.0045c40b
lea esp, cs:[esp + 0x20]
lea esp, [esp + 0x20]
inc bl
mov dx, word [esp]
not ax
seto dl
jmp 0x45c3ba
dec bl
mov eax, 0x91e8c167
mov eax, 0x7de98a73
mov dh, al
jmp 0x45c48c
mov dx, 0x3d0
setge dh
jmp 0x45c421
btr dx, bx
js 0x45c4a2
rol ah, cl
rdtsc
jmp 0x45e31c
rol ah, cl
rdtsc
jmp 0x45e31c
rol bl, 0
mov ah, byte [esp]
neg edx
jbe 0x45c4e4
bts ax, sp
neg ax
jmp 0x45c4ea
js 0x45c50e
mov edx, dword [esp]
mov edx, dword [esp]
jmp 0x45c514
neg ax
jmp 0x45c4ea
add eax, 0xe0ba5c1c
jmp 0x45c5c5
bts ax, sp
jmp 0x45c4ce
mov eax, ebx
mov dx, word [esp]
adc dl, cl
jmp 0x45c52c
neg dl
mov dx, 0xddcb
jmp 0x45c516
add eax, 0x5a68198f
jmp 0x45c622
mov edx, dword [esp]
mov edx, dword [esp]
jmp 0x45c4ac
shl eax, 2
lea edx, [eax + eax]
mov dl, bh
jmp 0x45c5db
ja 0x45c4f8
neg dl
mov dx, 0xddcb
call 0x45c53b
jae 0x45c5a5
sbb dl, dl
bswap edx
btr edx, ecx
xchg dword [esp], ebp
not dx
jmp 0x45c57b
mov dl, 0xaf
clc
xchg dword [esp], ebp
mov dx, word [esp]
or dx, sp
push ebp
jmp 0x45c598
lea edx, [ebx + ebp]
xor edx, 0x740a44f5
lea edx, [edi*4]
lea ebp, [ebp - 0x23]
not dh
lea edx, [ecx + 0x42]
jmp 0x45c565
sub esp, 0xb
lea esp, [esp + 3]
push dword [esp + 0xc]
ret 0x10
add al, cl
push esp
retf 0x5cad
mov dx, word [esp]
rol dx, cl
jns 0x45c5fd
js 0x45c5e7
dec edx
aad 0x45
sub al, 0xdf
push 0xffffffffffffffc4
ja 0x45c637
test eax, 0x148b66c8
and al, 0x8a
xor al, 0x24
mov dx, word [esp]
mov dh, byte [esp]
jmp 0x45c4d3
bts edx, ebx
dec edx
jmp 0x45c601
bts edx, ebx
dec edx
mov eax, dword [eax + reloc.KERNEL32.dll_GetFileAttributesW]
lea edx, [ecx + ebp]
jmp 0x45c63d
sub esp, 6
mov edx, ecx
pop word [esp]
jmp 0x45c69e
mov edx, dword [esp]
mov esp, edi
bts dx, si
jmp 0x45c647
mov ah, byte [0x796ec754]
mov dh, 7
sete dh
jmp 0x45c500
jns 0x45c60c
sub esp, 6
mov edx, ecx
jmp 0x45c654
pop word [esp]
jmp 0x45c69e
push eax
ret
neg ah
mov dh, byte [esp]
add bl, 0x26
setp dh
bts eax, esi
jmp 0x45c4c4
jmp 0x45db2f
rol bl, 0
not dh
xchg al, dl
cmp dx, 0x5993
jae 0x45e185
neg ah
mov dh, byte [esp]
call fcn.0045c6de
Function at 0x45a5c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], esi
call fcn.0045a599
pop dword [esp]
pop word [esp]
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x45a612
pushfd
jmp 0x45a4c1

Function at 0x45ac3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0045ad23
fcom qword [ecx - 0x3f]
mov al, byte [0xd25e9053]
inc eax
daa
shl byte [ecx - 0x2d], cl
dec edx
in eax, 0x14
xchg dword [eax - 0x72f1dbbc], ecx
and al, 0xe

Function at 0x45b4d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0045b48b
lea esp, [esp + 4]
add bl, 0x3c
sub esp, 0x1c
je 0x45b4f3
jne 0x45b4fa
aam 0x55
lds ebp, [edi + ebx*2 - 0x1408bb15]
jmp 0x45b4db
inc eax
jmp 0x45b53d
fisubr word [ecx]
dec eax
invalid
inc eax
jmp 0x45b53d
inc eax
neg edx
xchg byte [esp + 1], dh
not ax
mov al, 0xcd
jmp 0x45b529
mov al, 0xcd
bsr edx, edx
jmp 0x45b548
neg edx
xchg byte [esp + 1], dh
not ax
jmp 0x45b527
lea esp, [esp + 0x1c]
add bl, 0x76
mov eax, dword [esp]
dec dx
jle 0x45b58b
xchg al, dh
jmp 0x45b5fc
xchg al, dh
jmp 0x45b5fc
jmp 0x45b575
mov eax, 0xd77b3e11
mov ax, di
bsf eax, ecx
jmp 0x45b5d5
mov eax, ebx
mov al, dh
not ax
mov dl, byte [esp]
rol bl, 0
jmp 0x45b58d
and ebx, 0x3c
rdtsc
and dh, 0xc2
jle 0x45b5d9
mov dx, word [esp]
jmp 0x45b5de
mov ah, 0xf8
mov al, byte [esp]
mov dl, dh
dec bl
bswap edx
jmp 0x45b5a3
jae 0x45b5b2
jb 0x45b5b2
call fcn.0045b614
sub esi, 4
lea edx, [ecx + ebp]
xchg edx, eax
mov eax, 0x946b7eb5
xchg dx, ax
jmp 0x45b6c6
sub bl, 0x70
mov ax, 0x615a
lea eax, [edx*4]
rdtsc
lea eax, reloc.KERNEL32.dll_GetFileAttributesW
jmp 0x45b5c8
dec ecx
mov eax, 0x37841506
push ds
call fcn.0045b969
jge 0x45b6a0
jns 0x45b6d1
jmp 0x45b718
mov eax, dword [ebx + edi]
lea ebx, [edi*4]
not bx
not ebx
xor edx, 0xea6cdbe5
jnp 0x45b6b0
jp 0x45b6b0
mov al, 0x24
mov edx, 0xc6ea2cdd
push ecx
shl dword [eax - reloc.KERNEL32.dll_GetFileAttributesW], 0x4a
in eax, 0xb8
cdq
adc dword [eax - reloc.KERNEL32.dll_GetFileAttributesW], ebx
loop 0x45b6f9
invalid
sub al, 0x5a
test al, 0x30

Function at 0x45b969
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi], eax
sbb ebx, 0xecd4aedb
je 0x45b7d3
stc
xchg bx, dx
jmp 0x45b712
jmp 0x45b818
Function at 0x45bccd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
ja 0x45a5cc
jbe 0x45a605
add eax, 0xab9d3468
jmp 0x45bc71
add eax, 0x5a68198f
jmp 0x45bccf
lea esp, [esp + 0x1c]
jmp 0x45a612
pop dword [esp]
pop word [esp]
mov dword [esp + 0x1c], edi
jmp 0x45a5ef
or edx, esp
jg 0x45bcab
sbb dh, al
jmp 0x45bcad
sbb dh, al
jmp 0x45bcad
jmp 0x45bc95
mov eax, dword [eax + reloc.KERNEL32.dll_GetFileAttributesW]
bswap edx
lea edx, reloc.KERNEL32.dll_GetFileAttributesW
neg dx
jae 0x45bce5
jb 0x45a5dd
and al, 0xb2
and byte [edi - 0x4e], al
push es
xor ebp, ebx
mov ch, bl
sbb dword [edi], edi
test al, 0x3e
pop ecx
test al, 0x19
push ebx
lds edx, [ebp + 0x3c]
iretd
jmp 0x45bcea
jmp 0x45a5dd
mov edx, ebp
inc edx
jmp 0x45c32d
lea edx, [ebx*4]
mov esp, edi
ror dh, 6
jge 0x45bdc1
sets dh
and dl, ah
jmp 0x45bd5b
sets dh
and dl, ah
push eax
ret
jmp 0x45bd56
jns 0x45bcf3
lea edx, [ebx*4]
call fcn.0045c1ee
jmp 0x45c3ab
pushfd
pop edx
pushal
jmp 0x45c3d0
dec ebp
xchg dx, ax
mov edx, esi
pushfd
lea edx, [esp + 0x25]
xchg edx, eax
jmp 0x45c393
rol edx, 0xc
jbe 0x45c463
mov dx, 0x3d0
setge dh
call fcn.0045c40b
lea esp, cs:[esp + 0x20]
lea esp, [esp + 0x20]
inc bl
mov dx, word [esp]
not ax
seto dl
jmp 0x45c3ba
dec bl
mov eax, 0x91e8c167
mov eax, 0x7de98a73
mov dh, al
jmp 0x45c48c
mov dx, 0x3d0
setge dh
jmp 0x45c421
btr dx, bx
js 0x45c4a2
rol ah, cl
rdtsc
jmp 0x45e31c
rol ah, cl
rdtsc
jmp 0x45e31c
rol bl, 0
mov ah, byte [esp]
neg edx
jbe 0x45c4e4
bts ax, sp
neg ax
jmp 0x45c4ea
js 0x45c50e
mov edx, dword [esp]
mov edx, dword [esp]
jmp 0x45c514
neg ax
jmp 0x45c4ea
add eax, 0xe0ba5c1c
jmp 0x45c5c5
bts ax, sp
jmp 0x45c4ce
mov eax, ebx
mov dx, word [esp]
adc dl, cl
jmp 0x45c52c
neg dl
mov dx, 0xddcb
jmp 0x45c516
add eax, 0x5a68198f
jmp 0x45c622
mov edx, dword [esp]
mov edx, dword [esp]
jmp 0x45c4ac
shl eax, 2
lea edx, [eax + eax]
mov dl, bh
jmp 0x45c5db
ja 0x45c4f8
neg dl
mov dx, 0xddcb
call 0x45c53b
jae 0x45c5a5
sbb dl, dl
bswap edx
btr edx, ecx
xchg dword [esp], ebp
not dx
jmp 0x45c57b
mov dl, 0xaf
clc
xchg dword [esp], ebp
mov dx, word [esp]
or dx, sp
push ebp
jmp 0x45c598
lea edx, [ebx + ebp]
xor edx, 0x740a44f5
lea edx, [edi*4]
lea ebp, [ebp - 0x23]
not dh
lea edx, [ecx + 0x42]
jmp 0x45c565
sub esp, 0xb
lea esp, [esp + 3]
push dword [esp + 0xc]
ret 0x10
add al, cl
push esp
retf 0x5cad
mov dx, word [esp]
rol dx, cl
jns 0x45c5fd
js 0x45c5e7
dec edx
aad 0x45
sub al, 0xdf
push 0xffffffffffffffc4
ja 0x45c637
test eax, 0x148b66c8
and al, 0x8a
xor al, 0x24
mov dx, word [esp]
mov dh, byte [esp]
jmp 0x45c4d3
bts edx, ebx
dec edx
jmp 0x45c601
bts edx, ebx
dec edx
mov eax, dword [eax + reloc.KERNEL32.dll_GetFileAttributesW]
lea edx, [ecx + ebp]
jmp 0x45c63d
sub esp, 6
mov edx, ecx
pop word [esp]
jmp 0x45c69e
mov edx, dword [esp]
mov esp, edi
bts dx, si
jmp 0x45c647
mov ah, byte [0x796ec754]
mov dh, 7
sete dh
jmp 0x45c500
jns 0x45c60c
sub esp, 6
mov edx, ecx
jmp 0x45c654
pop word [esp]
jmp 0x45c69e
push eax
ret
neg ah
mov dh, byte [esp]
add bl, 0x26
setp dh
bts eax, esi
jmp 0x45c4c4
jmp 0x45db2f
rol bl, 0
not dh
xchg al, dl
cmp dx, 0x5993
jae 0x45e185
neg ah
mov dh, byte [esp]
call fcn.0045c6de
Function at 0x509ed1
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
jmp 0x509f16
sub esp, 0xa
xchg bl, dh
std
mov ch, bh
xchg dl, ah
mov si, dx
jmp 0x509f00
Function at 0x50a696
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, 0xd1
jmp 0x50a69f
not eax
stc
rdtsc
not bx
mov edx, ebp
mov ax, cx
jmp 0x50a7bb
rcl ch, 4
lea ebp, reloc.KERNEL32.dll_GetFileAttributesW
xchg word [esp], bp
lea esp, [esp]
mov bl, 0xc3
dec cl
jmp 0x50a6d0
mov dh, al
push word [esp]
lea eax, [esi + esi]
mov ecx, ebx
pop word [esp]
add esp, 0
jmp 0x50a6e6
xchg word [esp + 1], dx
btr dx, ax
shl eax, 0xd
xchg cx, bp
pop edi
inc dx
jmp 0x50a75c

Function at 0x445450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x440015
lea edi, [esi - 0x3f015]
push edi
jmp 0x44546a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x445471
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x445460
mov eax, 1
add ebx, ebx
jne 0x445483
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x445478
jne 0x445494
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x445478
xor ecx, ecx
sub eax, 3
jb 0x4454a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44551a
mov ebp, eax
add ebx, ebx
jne 0x4454b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4454c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4454e4
inc ecx
add ebx, ebx
jne 0x4454d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4454c5
jne 0x4454e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4454c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x445504
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4454f5
jmp 0x445466
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x445504
add edi, ecx
jmp 0x445466
pop esi
mov edi, esi
mov ecx, 0x25b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x445522
cmp byte [edi], 5
jne 0x445522
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x445527
lea edi, [esi + 0x43000]
mov eax, dword [edi]
or eax, eax
je 0x445596
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x49160]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x49188]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x445554
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x49190]
or eax, eax
je 0x445590
mov dword [ebx], eax
add ebx, 4
jmp 0x445571
call dword [esi + 0x4918c]
mov ebp, dword [esi + 0x49194]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4455ca
sub esp, 0xffffff80
jmp 0x404780
Function at 0x40601d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406041
xor eax, eax
test eax, eax
je 0x406053
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406053
xor ecx, ecx
jmp 0x406056
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x4060f6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422b14], 0
push esi
jne 0x40612d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406107
mov dword [ecx*4 + 0x422b10], eax
inc ecx
cmp ecx, 0x100
jl 0x406102
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40615e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422b10]
xor eax, esi
inc ecx
dec edx
jne 0x406140
pop edi
not eax
pop esi
ret 0xc

Function at 0x438cb8
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop eax
mov esi, 0xd2710be9
and edx, esi
call fcn.00438cf7
sub esp, 4
mov dword [esp], edx
pop edx
push 0x22df7310
pop esi
xor dword [edi], eax
add esi, 1
add edx, edx
and edx, edx
add edi, 1
dec esi
and esi, esi
sub edx, edx
cmp edi, ecx
jne fcn.00438cb8
inc esi
or esi, esi
ret
Function at 0x402d40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440e77
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, 7
xor ebx, ebx
xor edx, edx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x10], ebx
mov dword [ebp - 0x21c], edi
mov word [edi], dx
mov dword [ebp - 4], ebx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x2c], ebx
mov word [edi + 0x1c], dx
lea esi, [edi + 0x38]
mov dword [esi + 0x14], ecx
xor ecx, ecx
mov dword [esi + 0x10], ebx
mov word [esi], cx
mov edx, dword [ebp + 0xc]
push edx
push eax
lea eax, [ebp - 0x218]
push str._S___d_
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x218]
add esp, 0x10
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402dd0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
call fcn.00402c20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c039
mov esp, ebp
pop ebp
ret 8