joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403220
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x18]
push 0x41e3df
push ebp
call fcn.0040dfe6
add esp, 8
mov dword [esp], eax
mov eax, 0x24238f6e
mov ebx, 0x609c7462
nop word cs:[eax + eax]
nop
cmp eax, 0x986c1ee
jle 0x403360
cmp eax, 0x422512cd
jg 0x403290
cmp eax, 0x986c1ef
je 0x4032b3
cmp eax, 0x24238f6e
jne 0x403250
cmp dword [esp], 0
mov eax, 0xc5f7be20
mov ecx, 0x986c1ef
jmp 0x403351
cmp eax, 0x422512ce
je 0x4033df
cmp eax, 0x609c7462
jne 0x403250
mov eax, 0xc8f2ef53
cmp eax, 0x986c1ee
jg 0x40325b
jmp 0x403360
mov ecx, dword [0x424004]
mov eax, dword [0x424008]
lea edx, [ecx - 1]
imul edx, ecx
mov ecx, edx
and edx, 0x9792fcaf
not ecx
and ecx, 0x686d0350
or edx, ecx
mov ecx, edx
xor edx, 0x28280210
xor ecx, 0x9792fcaf
and edx, 0x3828feb7
mov esi, ecx
and ecx, 0xfffffffe
and esi, 0xc7d70148
or esi, edx
xor esi, 0xc7d70149
or ecx, esi
mov edx, ecx
and ecx, 0xd2e26d80
not edx
and edx, 0x2d1d927f
or ecx, edx
xor ecx, 0xd2e26d80
sete cl
setne dl
cmp eax, 9
setg ch
cmp eax, 0xa
setl al
and cl, ch
and al, dl
or cl, al
mov al, ch
xor ch, dl
and al, dl
or ch, al
mov eax, 0xc8f2ef53
mov dl, ch
xor dl, cl
test ch, ch
cmovne eax, ebx
test cl, cl
mov ecx, 0xc8f2ef53
cmove eax, ebx
test dl, dl
cmove eax, ecx
cmp eax, 0x986c1ee
jg 0x40325b
nop
cmp eax, 0xc5f7be20
je 0x403382
cmp eax, 0xc8f2ef53
je 0x4033f4
cmp eax, 0xf49e69bb
jne 0x403250
jmp 0x403472
push 2
push 0
push dword [esp + 8]
call fcn.0040e3e3
add esp, 0xc
push dword [esp]
call fcn.0040e706
add esp, 4
mov esi, eax
push dword [esp]
call fcn.0040de91
add esp, 4
push 0x41e3df
push ebp
call fcn.0040dfe6
add esp, 8
mov edi, eax
push esi
call fcn.0040ed5b
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
push edi
push esi
push 1
push eax
call fcn.0040e1d2
add esp, 0x10
push edi
call fcn.0040de91
add esp, 4
mov eax, 0xf49e69bb
cmp eax, 0x986c1ee
jg 0x40325b
jmp 0x403360
mov eax, dword [0x424004]
mov ecx, dword [0x424008]
lea edx, [eax - 1]
imul edx, eax
mov eax, edx
and edx, 0x3e43c2b6
not eax
and eax, 0xc1bc3d49
or edx, eax
mov eax, edx
xor edx, 0xc1bc3d48
xor eax, 0x3e43c2b6
and eax, 0xfffffffe
or edx, eax
cmp edx, 0xffffffff
setne al
sete dl
cmp ecx, 9
setg ah
cmp ecx, 0xa
setl cl
xor cl, dl
mov dl, ah
xor ah, al
and dl, al
or ah, dl
mov edx, 0x422512ce
mov al, ah
xor al, cl
cmovne edx, ebx
test ah, ah
mov eax, 0x422512ce
cmovne eax, edx
test cl, cl
cmove eax, edx
cmp eax, 0x986c1ee
jg 0x40325b
jmp 0x403360
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ae8c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40aecb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40aecb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40aecb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40aecb
cmp dword [ecx + 0x74], 0xe
jbe 0x40aecb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40e792
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004155c0
mov eax, dword [0x4235d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00414067
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x40e7d4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x40e930
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00415510
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x424e08]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0041533c
mov ecx, dword [esi*4 + 0x424e08]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x40e929
cmp eax, dword [ecx + edi + 0x24]
jne 0x40e929
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e929
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041533c
add esp, 0x14
test edx, edx
jl 0x40e929
jg 0x40e89f
test eax, eax
jb 0x40e929
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x40e929
jl 0x40e8b9
cmp dword [ebp - 0x1008], eax
ja 0x40e929
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x40e8d7
test ebx, ebx
je 0x40e910
cmp ecx, edi
jae 0x40e910
mov al, byte [ecx]
cmp al, 0xd
jne 0x40e8f1
lea eax, [edi - 1]
cmp ecx, eax
jae 0x40e8fd
cmp byte [ecx + 1], 0xa
jne 0x40e8fd
inc ecx
jmp 0x40e8fd
movzx eax, al
movsx eax, byte [eax + 0x423d60]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x40e8d7
cmp edx, ebx
jne 0x40e8d7
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x40e92e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040a4a2
leave
ret

Function at 0x40fdd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fdfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fdfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41014d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bdcc
push 0x41bdc4
push str.FlsAlloc
push 0x1f
call fcn.004104d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410181
push dword [ebp + 8]
mov ecx, esi
call dword [section..10cfg]
call esi
jmp 0x410187
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4101cb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bddc
push 0x41bdd4
push str.FlsGetValue
push 0x21
call fcn.004104d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410202
push dword [ebp + 8]
mov ecx, esi
call dword [section..10cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41020a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bde4
push 0x41bddc
push str.FlsSetValue
push 0x22
call fcn.004104d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410244
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..10cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4137bc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x413859
push ebx
push esi
call fcn.0041385c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004136c0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x413806
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413858
push edi
push eax
call fcn.004121d4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x413826
call fcn.0041165a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413857
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004136c0
add esp, 0x20
test eax, eax
jne 0x413845
push edi
call fcn.0041165a
jmp 0x41384d
push ebx
call fcn.0041165a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x414e3d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x424e08]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x414e7d
cmp byte [ebx], 0xa
jne 0x414e7d
or byte [edi + eax + 0x28], 4
jmp 0x414e82
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x414f81
mov dl, byte [eax]
cmp dl, 0x1a
je 0x414f64
inc eax
cmp dl, 0xd
je 0x414eae
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x414ed4
cmp eax, ecx
jae 0x414ee2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x414e96
jmp 0x414f81
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x414f5f
cmp dword [ebp - 0x10], 0
je 0x414f5f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x424e08]
test byte [eax + edi + 0x28], 0x48
je 0x414f39
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x414f24
mov byte [esi], dl
jmp 0x414f35
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x424e08]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x414f81
cmp byte [ebp - 1], 0xa
jne 0x414f48
cmp esi, ebx
jne 0x414f48
mov byte [esi], 0xa
jmp 0x414f80
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004152de
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x414f81
mov byte [esi], 0xd
jmp 0x414f80
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x424e08]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x414f7e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x414f81
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x414f8a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x424e08]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x414fd0
cmp word [ebx], dx
jne 0x414fd0
or byte [eax + edi + 0x28], 4
jmp 0x414fd5
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x415138
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x415118
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x415016
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41504c
cmp eax, edx
jae 0x41505a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x414ff1
jmp 0x415138
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415113
cmp dword [ebp - 0x18], 0
je 0x415113
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x424e08]
test byte [eax + edi + 0x28], 0x48
je 0x4150e9
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4150ad
mov word [esi], cx
jmp 0x4150e4
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x424e08]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x424e08]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x424e08]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x415138
pop eax
cmp word [ebp - 4], ax
jne 0x4150f9
cmp esi, ebx
jne 0x4150f9
mov word [esi], ax
jmp 0x415135
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004152de
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x415138
push 0xd
pop eax
jmp 0x4150f4
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x424e08]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x415132
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x415138
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4186c8
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041885f
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x418837
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x418837
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4187ec
jg 0x418724
test eax, eax
je 0x4187e2
push 1
push 0x1000
call fcn.00411d96
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x418747
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4187d9
push 0x8000
push ebx
call fcn.0040dd3d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x418770
jg 0x41876b
cmp ecx, 0x1000
jb 0x418770
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00415e4d
add esp, 0x10
cmp eax, 0xffffffff
je 0x4187b5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x41876b
jl 0x41879c
test ecx, ecx
jne 0x41875d
push dword [ebp - 0xc]
push ebx
call fcn.0040dd3d
push esi
call fcn.0041165a
add esp, 0xc
xor ebx, ebx
jmp 0x418845
cmp byte [edi + 0x24], 0
je 0x4187cc
cmp dword [edi + 0x20], 5
jne 0x4187cc
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4187d7
mov ebx, dword [edi + 0x18]
jmp 0x4187d9
xor ebx, ebx
push esi
call fcn.0041165a
pop ecx
jmp 0x418845
test ecx, ecx
jg 0x4187ae
jl 0x4187ec
test eax, eax
jae 0x4187ae
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004152de
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x41880c
cmp byte [edi + 0x1c], 0
je 0x4187ae
jmp 0x41883d
push ebx
call fcn.00413c1d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4187ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x418845
cmp byte [edi + 0x1c], 0
je 0x418842
mov ebx, dword [edi + 0x18]
jmp 0x418845
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004152de
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x795260
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x45dd6782
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0xbe2370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xbe238e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xc0b074
push ecx
mov edi, eax
call fcn.00bf6198
mov esi, eax
add esp, 8
test esi, esi
jne 0xbe23cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00bf602e
push esi
call fcn.00bf5fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xbe5850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xbe58ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xc10720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xbe58ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00bf61e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xbe58ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xc10720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xbe592a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00bf7082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xbe5957
mov word [eax], si
add eax, 2
push eax
call fcn.00bf7030
add esp, 4
jmp 0xbe5959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xbe58ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xbe58b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xbe5ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret