joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x4027e3
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_PhysicalToLogicalPoint]
nop dword [eax]
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0x15
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
xor byte [edi + ebp], 0x8f
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
xor byte [edi + ebp], 0x42
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0xa7
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0x19
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
xor byte [edi + ebp], 6
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0xb9
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0xf6
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0xf0
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add esp, 8
xor byte [edi + ebp], 0x9a
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0xba
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0x2a
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0xfc
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
xor byte [edi + ebp], 0x74
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0x7f
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
xor byte [edi + ebp], 7
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0x91
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x42af98
call fcn.00401100
add byte [edi + ebp], 0x27
add esp, 8
inc edi
cmp edi, ebx
jb 0x4025e0
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x4034f0
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x462e00], eax
push 0xda4c2ca8
push dword [0x462e00]
call fcn.00402ce0
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
call edx
push 0
call dword [sym.imp.ole32.dll_OleRun]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x403460
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AddAce]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40615c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40619b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40619b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40619b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40619b
cmp dword [ecx + 0x74], 0xe
jbe 0x40619b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41045c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4204c8
push 0x4204c0
push str.FlsAlloc
push 0x1e
call fcn.00410326
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410490
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d14c]
call esi
jmp 0x410496
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4104da
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4204d8
push 0x4204d0
push str.FlsGetValue
push 0x20
call fcn.00410326
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410511
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d14c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x412102
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00411da4

Function at 0x41210d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00411f33
Function at 0x41c630
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c65d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c65d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x614c7495
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x77a07554
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x589c7bd1
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x45f25ba7
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5a680ad5
mov edi, 0x67058dfd
xor edi, eax
mov ebx, edi
xor ebx, 0xffffffff
and ebx, 0x578f7628
and edi, 0xa87089d7
or edi, ebx
mov eax, 0
xor eax, edi
mov ebx, eax
xor ebx, 0xffffffff
and ebx, 0xffffffff
and eax, 0
or eax, ebx
and eax, 0x6ae2fbb1
and edi, 0x951d044e
or edi, eax
mov edx, 0x15c6102
mov ecx, 0x15c6106
xor ecx, edx
sub esp, ecx
xor eax, eax
mov ecx, esi
mov ebx, ecx
mov edi, ebx
push edi
pop esi
jmp 0x403f0a

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404dd0
add esp, 0x104
pop ebx
ret
Function at 0x404dda
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442b3c]
jne 0x404de4
repz ret
jmp fcn.00408bd2

Function at 0x40b66c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406834
and dword [ebp - 4], 0
cmp dword [0x444450], 0
mov ebx, eax
jne 0x40b71d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b7ce
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b7ce
push eax
call fcn.004067c2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x444450], eax
call esi
push eax
call fcn.004067c2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x444454], eax
call esi
push eax
call fcn.004067c2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x444458], eax
call esi
push eax
call fcn.004067c2
pop ecx
mov dword [0x444460], eax
test eax, eax
je 0x40b71d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004067c2
pop ecx
mov dword [0x44445c], eax
mov eax, dword [0x44445c]
cmp eax, ebx
je 0x40b775
cmp dword [0x444460], ebx
je 0x40b775
push eax
call fcn.0040683d
push dword [0x444460]
mov esi, eax
call fcn.0040683d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b775
test edi, edi
je 0x40b775
call esi
test eax, eax
je 0x40b76c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b76c
test byte [ebp - 0xc], 1
jne 0x40b775
or dword [ebp + 0x10], 0x200000
jmp 0x40b7ae
mov eax, dword [0x444454]
cmp eax, ebx
je 0x40b7ae
push eax
call fcn.0040683d
pop ecx
test eax, eax
je 0x40b7ae
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b7ae
mov eax, dword [0x444458]
cmp eax, ebx
je 0x40b7ae
push eax
call fcn.0040683d
pop ecx
test eax, eax
je 0x40b7ae
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444450]
call fcn.0040683d
pop ecx
test eax, eax
je 0x40b7ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b7d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sbb edi, 0x14
sbb edi, 0x3e
bswap edx
imul edx
sbb edi, 0x7a
bswap edi
inc edi
dec eax
rcl eax, 0x3a
rcl edx, 4
mov esi, 9
bswap eax
rcr edx, 0x2d
inc eax
add edx, 0x29
bswap esi
neg edx
add eax, 0xb
add edx, 0x5a
mov ebx, 0x64
rol edi, 0x2d
sbb edx, 0xae
and edi, 5
inc ebx
imul eax
add edx, 0xf6
rcr edi, 0x8b
rcl eax, 0x2a
imul ebx
neg esi
mov edx, 0xe3
inc esi
sbb edi, 0x3b
bswap esi
sub ebx, 0xf9
add edx, 0x34
neg eax
dec eax
not edx
rol edi, 0xeb
sbb ebx, 0x8f
dec esi
sub edi, 0xfe
rcl esi, 0x7c
rol ebx, 0xfa
mov eax, 0xa5
rcl edi, 0xc6
inc edx
not eax
or edx, 0x70
xor ecx, ecx
xor edi, edi
ror edx, 0xa3
bswap ebx
bswap eax
neg ebx
add eax, 0x27
or esi, 0xde
neg eax
add ebx, 0x74
rcl esi, 0x36
sub edi, 0xa7
mov edi, 0x3b
inc edi
rol edi, 0x4e
rcl eax, 0x69
not ebx
imul edx
add edx, 0xb5
not edx
rol eax, 0x55
sbb edx, 0x4b
imul edx
sbb eax, 0xc7
add esi, 0xfa
and ebx, 0xb5
or eax, 0x87
inc edx
not ebx
inc edx
or ebx, 0x38
dec edi
inc edx
add edi, 0xff
sub eax, 0x9c
rcl esi, 0x6b
neg esi
rcl edx, 0xfc
neg edx
imul esi
not esi
dec esi
or eax, 0x47
imul esi
not edi
rcl edx, 0x8f
and esi, 0xb
sbb edx, 0x1c
mov edx, 0x30
ror edx, 0x65
rol eax, 0xc8
ror ebx, 0x7f
mov ecx, dword [ebp + 0xc]
or esi, 0x37
rcr esi, 0x23
sbb esi, 0x6a
sub edx, 0x9b
rcl ebx, 0x63
neg eax
imul eax
not esi
bswap esi
mov eax, 0xfd
not ebx
not eax
not ebx
neg ebx
rol edx, 1
inc eax
bswap edi
neg eax
or eax, 0x5f
inc ebx
rcr edx, 0x5f
sbb esi, 0xa1
mov edx, 0x18
rcl edx, 0x1d
sbb edx, 0x1f
bswap esi
imul edi
add edi, 0xc9
inc ebx
neg edi
bswap edx
rcr eax, 0xf6
neg eax
sbb esi, 0x9c
sub ebx, 0x13
imul edi
rcl esi, 0x37
dec edi
bswap edx
mov eax, 0xbf
ror eax, 0x23
or esi, 0x11
or esi, 0x7e
bswap edx
neg ebx
sbb eax, 0xfb
inc edi
neg ebx
dec ebx
rol edx, 0xfa
mov edi, dword [ebp + 8]
mov eax, eax
mov eax, ebx
mov ebx, esi
not byte [edi]
mov esi, ebx
mov esi, ebx
xor esi, ebx
xor esi, ebx
xor ebx, eax
mov esi, ebx
mov esi, esi
xor eax, esi
xor esi, eax
add byte [edi], 0x48
xor ebx, ebx
mov ebx, esi
mov ebx, eax
mov esi, ebx
mov eax, esi
xor eax, esi
xor eax, esi
mov ebx, eax
mov esi, eax
sub byte [edi], 0x97
xor esi, ebx
mov ebx, esi
xor ebx, ebx
xor ebx, ebx
mov ebx, ebx
mov esi, eax
xor esi, eax
xor eax, eax
xor ebx, esi
imul byte [edi]
inc edi
loop 0x40f3e6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4559f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4f000]
push edi
jmp 0x455a0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x455a11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x455a00
mov eax, 1
add ebx, ebx
jne 0x455a23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x455a34
jne 0x455a53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x455a53
dec eax
add ebx, ebx
jne 0x455a40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x455a18
add ebx, ebx
jne 0x455a4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x455aa5
xor ecx, ecx
sub eax, 3
jb 0x455a6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x455ada
sar eax, 1
mov ebp, eax
jmp 0x455a76
add ebx, ebx
jne 0x455a76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x455a44
inc ecx
add ebx, ebx
jne 0x455a84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x455a44
add ebx, ebx
jne 0x455a91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x455a86
jne 0x455aa2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x455a86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x455ac4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x455ab6
jmp 0x455a06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x455ac4
add edi, ecx
jmp 0x455a06
pop esi
lea edi, [esi - 0xff0]
mov ecx, 0x641e
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x455b03
cmp byte [edi], 0
jne 0x455ae8
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x455ae6
lea edi, [esi + 0x53000]
mov eax, dword [edi]
or eax, eax
je 0x455b4b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x55000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5503c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x455b09
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x55044]
or eax, eax
je 0x455b45
mov dword [ebx], eax
add ebx, 4
jmp 0x455b26
call dword [esi + 0x55040]
mov ebp, dword [esi + 0x55048]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x455b7f
sub esp, 0xffffff80
jmp 0x401280
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..3ean
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7ef33a52
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
mov eax, section..7LWLf
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x34093d57
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4030d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, ecx
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0xc]
push 0x65
push ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x14], 0x823
mov dword [esp + 0x18], 0x403330
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x403126
xor eax, eax
mov ax, word [esi + 0x10]
push eax
push ebx
jmp 0x40312d
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 5
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], ecx
call fcn.00402fb0
add esp, 4
test ax, ax
jne 0x403167
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esi + 0x14]
mov dl, byte [esi + 0x18]
mov eax, ecx
neg eax
sbb eax, eax
and eax, 0xfffc0080
add eax, 0x40000
test dl, dl
je 0x403183
or al, 0x20
test ecx, ecx
mov edx, 0x80000000
jne 0x403191
mov edx, 0x80ca0000
cmp byte [esi + 0x19], 0
je 0x40319d
and edx, 0xefffffff
test ecx, ecx
je 0x4031a6
mov ecx, dword [ecx + 0x20]
jmp 0x4031a8
xor ecx, ecx
push 0
push ebx
push 0
push ecx
mov ecx, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
push ecx
mov ecx, dword [esp + 0x48]
push 0
push 0
push edx
push ecx
push ecx
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [esi + 0x20], eax
jne 0x4031da
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x28
ret 4
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, dword [esi + 0x20]
push 0x27
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
test al, al
jne 0x403224
mov esi, dword [esi + 0x20]
test esi, esi
je 0x403219
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x28
ret 4
mov al, byte [esi + 0x19]
test al, al
jne 0x40325a
mov ecx, dword [esi + 0x20]
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x20]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esi + 0x20]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x28
ret 4
Function at 0x405f3b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d180
cmp edx, dword [eax]
je 0x405f5d
add eax, 8
inc ecx
cmp eax, 0x40d210
jl 0x405f4e
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d180]
jne 0x40608b
mov eax, dword [0x40d858]
cmp eax, 1
je 0x406065
test eax, eax
jne 0x405f8e
cmp dword [0x40d0c0], 1
je 0x406065
cmp edx, 0xfc
je 0x40608b
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405fc5
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407260
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407890
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406008
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407890
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40bb24
push edi
call fcn.00408270
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407260
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407270
lea eax, [ebp - 0xa0]
push 0x40bb04
push eax
call fcn.00407270
push dword [esi + 0x40d184]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407270
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004081e7
add esp, 0x2c
pop edi
jmp 0x40608b
lea eax, [ebp + 8]
lea esi, [esi + 0x40d184]
push 0
push eax
push dword [esi]
call fcn.00407890
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret