joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c400
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x90
mov edx, dword [ebp + 0x7c]
push esi
push edi
mov edi, dword [ebp + 0x78]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
xor ecx, 0xa3b1bac6
mov dword [ebp - 0x20], ecx
movzx ecx, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
xor ecx, 0x56aa3350
mov dword [ebp - 0x1c], ecx
movzx ecx, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
xor ecx, 0x677d9197
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
xor ecx, 0xb27022dc
xor esi, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + esi - 0x14]
xor ecx, dword [esi + 0x472158]
xor ecx, dword [ebp + esi - 0x18]
xor ecx, dword [ebp + esi - 0x1c]
mov eax, ecx
shr eax, 0x18
movzx edx, byte [eax + 0x472048]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x472048]
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x472048]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + 0x472048]
or edx, eax
mov ecx, edx
mov eax, edx
ror ecx, 0x13
ror eax, 9
xor ecx, eax
xor ecx, dword [ebp + esi - 0x20]
xor ecx, edx
mov dword [ebp + esi - 0x10], ecx
mov dword [esi + edi], ecx
add esi, 4
cmp esi, 0x80
jb 0x42c4b4
pop edi
pop esi
add ebp, 0x70
leave
ret

Function at 0x42cc83
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x449044]
test eax, eax
je 0x42ccc2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ccc2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ccc2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42ccc2
cmp dword [ecx + 0x74], 0xe
jbe 0x42ccc2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4388b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4388dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4388dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x419fb9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4be5d0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QMessageLogger::constructor_char_const___int__char_const__]
mov ecx, eax
call dword [sym.imp.QL_Core.dll_public:_class_QDebug___thiscall_QMessageLogger::debug_void_]
push 0x41ee10
mov ecx, eax
mov dword [esp + 0x40], ebx
call dword [sym.imp.QL_Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QDebug::destructor_void_]
mov edx, dword [sym.imp.QL_Core.dll_struct_QMetaObject_const_QIODevice::staticMetaObject]
mov ecx, dword [sym.imp.QL_Core.dll_public:_void___thiscall_QIODevice::readyRead_void_]
mov edi, dword [sym.imp.QL_Core.dll_private:_static_bool___cdecl_QObject::disconnectImpl_class_QObject_const___void____class_QObject_const___void____struct_QMetaObject_const__]
push edx
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ecx
push esi
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x24], 0x4018f0
call edi
mov ecx, dword [sym.imp.QL_Network.dll_struct_QMetaObject_const_QNetworkReply::staticMetaObject]
mov eax, dword [sym.imp.QL_Network.dll_public:_void___thiscall_QNetworkReply::error_enum_QNetworkReply::NetworkError_]
push ecx
mov ecx, dword [esi + 0x40]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], eax
push esi
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x40], fcn.00401980
call edi
mov ecx, dword [esp + 0x6c]
add esp, 0x28
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QObject::deleteLater_void_]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
cmp byte [esi + 0xc], bl
je 0x401e66
mov ecx, dword [esi + 0x2c]
mov byte [esi + 0xc], bl
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QTimer::stop_void_]
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
call eax
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x401e4e
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 1
call eax
push ecx
lea edx, [esi + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, esi
call fcn.00417be0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret 4
Function at 0x40efe0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push 0xffffffffffffffff
push 0x41c10c
mov eax, dword fs:[0]
push eax
mov eax, 0x142c
call fcn.00419260
mov eax, dword [0x4be5d0]
xor eax, esp
mov dword [esp + 0x1428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4be5d0]
xor eax, esp
push eax
lea eax, [esp + 0x1440]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], ecx
push 0x1000
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x24], 0
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x40f04a
xor al, al
jmp 0x40f18a
mov esi, dword [esp + 0x18]
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1036]
push eax
shr esi, 2
mov word [esp + 0x1038], dx
call sub.QL_CR100.dll_memset
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x124a]
push edx
mov word [esp + 0x124c], cx
call sub.QL_CR100.dll_memset
add esp, 0x18
test esi, esi
je 0x40f188
lea ebx, [esp + 0x2c]
mov dword [esp + 0x14], esi
mov eax, dword [ebx]
test eax, eax
je 0x40f17b
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x40f174
push 0x104
lea eax, [esp + 0x1030]
push eax
push ebp
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x40f174
push 0x104
lea ecx, [esp + 0x1238]
push ecx
lea edx, [esp + 0x1034]
push edx
call fcn.00415f70
add esp, 0xc
test al, al
je 0x40f174
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x64]
mov eax, dword [eax]
add esi, 0x64
cmp eax, 1
je 0x40f118
test eax, eax
je 0x40f118
mov ecx, esi
call fcn.0040bbe0
mov edi, dword [esi]
push ebx
lea eax, [esp + 0x28]
push eax
mov ecx, esi
add edi, 8
call fcn.0040c490
cmp dword [eax], edi
jne 0x40f174
push 0xffffffffffffffff
lea ecx, [esp + 0x1238]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.QL_Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
add esp, 0xc
push eax
push ebx
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x1454], 0
call fcn.0040c4e0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1448], 0xffffffff
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QString::destructor_void_]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
dec dword [esp + 0x14]
jne 0x40f09e
mov al, 1
mov ecx, dword [esp + 0x1440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1428]
xor ecx, esp
call fcn.004191d2
add esp, 0x1438
ret
Function at 0x415180
Capabilities:
Encode data using xor

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov word [esp + 4], 0xcdfb
mov byte [esp + 6], 0xac
test edi, edi
jle 0x4151bd
push esi
mov esi, dword [esp + 0x10]
lea ecx, [ecx]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov al, byte [esp + edx + 8]
xor byte [ecx + esi], al
inc ecx
cmp ecx, edi
jl 0x4151a0
pop esi
pop edi
pop ecx
ret
Function at 0x4153a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41cef5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4be5d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
mov esi, dword [esp + 0x30]
mov ecx, esi
mov dword [esp + 0x24], 1
call dword [sym.imp.QL_Core.dll_public:_bool___thiscall_QFile::exists_void_const]
test al, al
je 0x415481
push ecx
mov eax, esp
mov dword [eax], 1
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
mov ecx, esi
mov dword [esp + 0x18], esp
call edx
test al, al
je 0x415481
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
mov ecx, esi
call edx
xor edi, edi
mov ecx, 0xa00000
test edx, edx
jg 0x41542b
jl 0x415427
cmp eax, ecx
jae 0x41542b
mov ecx, eax
mov edi, edx
push edi
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call dword [sym.imp.QL_Core.dll_public:_class_QByteArray___thiscall_QIODevice::read_long_long___int64__]
push 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x30], 2
call dword [sym.imp.QL_Core.dll_public:_static_class_QByteArray___cdecl_QCryptographicHash::hash_class_QByteArray_const___enum_QCryptographicHash::Algorithm_]
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.QL_Core.dll_public:_class_QByteArray____thiscall_QByteArray::operator_class_QByteArray__]
lea ecx, [esp + 0x14]
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.QL_Core.dll_public:_class_QByteArray___thiscall_QByteArray::toHex_void_]
mov ecx, eax
mov byte [esp + 0x24], 3
call dword [sym.imp.QL_Core.dll_public:_char____thiscall_QByteArray::data_void_]
test eax, eax
je 0x4154b1
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4154a6
sub ecx, esi
jmp 0x4154b4
or ecx, 0xffffffff
push ecx
push eax
call dword [sym.imp.QL_Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
mov esi, dword [esp + 0x34]
add esp, 8
mov dword [esi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 1
mov byte [esp + 0x24], 1
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call dword [sym.imp.QL_Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x415f70
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x41cf46
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x4be5d0]
xor eax, esp
mov dword [esp + 0x64c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4be5d0]
xor eax, esp
push eax
lea eax, [esp + 0x664]
mov dword fs:[0], eax
mov eax, dword [esp + 0x678]
mov ecx, dword [0x422e58]
mov dx, word [0x422e5c]
mov ebp, dword [esp + 0x674]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x260]
push eax
push 0x3ff
mov dword [esp + 0x58], ecx
mov word [esp + 0x5c], dx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4160c5
lea ebx, [esp + 0x260]
xor edi, edi
jmp 0x416000
mov cx, word [ebx]
push 0x104
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x58]
push eax
mov word [esp + 0x5c], cx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4160b1
xor ecx, ecx
mov eax, ebp
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416040
sub eax, edx
sar eax, 1
push eax
push ebp
lea ecx, [esp + 0x20]
call fcn.00415930
lea eax, [esp + 0x58]
mov dword [esp + 0x66c], edi
lea edx, [eax + 2]
jmp 0x416070
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416070
sub eax, edx
sar eax, 1
push eax
push edi
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x24]
call fcn.00415500
mov esi, eax
cmp esi, 0xffffffff
jne 0x4160ef
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x66c], eax
jb 0x4160b1
mov eax, dword [esp + 0x18]
push eax
call sub.QL_CR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4160b1
cmp word [ebx], di
jne 0x416000
xor al, al
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64c]
xor ecx, esp
call fcn.004191d2
add esp, 0x65c
ret
xor edx, edx
lea eax, [esp + 0x58]
mov word [esp + 0x34], dx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416110
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00415930
mov eax, ebx
mov byte [esp + 0x66c], 1
lea edx, [eax + 2]
jmp 0x416140
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416140
mov ecx, dword [esp + 0x44]
sub eax, edx
sar eax, 1
push eax
push ebx
inc ecx
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.00415d90
mov esi, 8
cmp dword [esp + 0x48], esi
jb 0x416179
mov edx, dword [esp + 0x34]
push edx
call sub.QL_CR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], esi
jae 0x416187
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x680]
push eax
push ecx
call dword [sym.imp.QL_CR100.dll_wcscpy_s]
add esp, 0xc
cmp dword [esp + 0x2c], esi
jb 0x4161b1
mov edx, dword [esp + 0x18]
push edx
call sub.QL_CR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
jmp 0x4160c7
Function at 0x4191d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4be5d0]
jne 0x4191dc
repz ret
jmp fcn.0041963e

Function at 0x419ba0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push edi
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0x419bca
or eax, 0xffffffff
pop edi
add esp, 0x14
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
push ebx
push esi
neg ecx
or ecx, eax
push ecx
call fcn.00419cbc
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0
test eax, eax
jle 0x419c6b
mov eax, edi
sub eax, esi
push ebp
mov dword [esp + 0x18], eax
jmp 0x419c14
mov eax, dword [esp + 0x18]
mov edi, dword [eax + esi]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
push ebx
call fcn.00419cbc
add esp, 4
push 0
push 0
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x14]
mov dword [esi], ebp
mov eax, dword [esp + 0x10]
inc ecx
add esi, 4
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x419c10
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
pop ebp
push edi
mov dword [esi + eax*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
push esi
push eax
call fcn.00401140
xor edi, edi
add esp, 8
mov ebx, eax
cmp dword [esp + 0xc], edi
jle 0x419ca8
mov eax, dword [esi + edi*4]
test eax, eax
je 0x419ca8
push eax
call sub.QL_CR100.dll_void___cdecl_operator_delete___void__
inc edi
add esp, 4
cmp edi, dword [esp + 0xc]
jl 0x419c91
push esi
call sub.QL_CR100.dll_void___cdecl_operator_delete___void__
add esp, 4
pop esi
mov eax, ebx
pop ebx
pop edi
add esp, 0x14
ret 0x10
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3dae3c3e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x40d25d81
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4b95ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b95cd
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.004b86ba
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b95f0
test byte [esp + 8], 2
je 0x4b95f0
call fcn.004b872d
mov dword [eax], 0xd
call fcn.004b8736
mov dword [eax], 5
jmp 0x4b95c9
xor eax, eax
ret

Function at 0x4ca322
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ca35a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c83af
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c8387
jmp 0x4ca366
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4cba14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cba56
call fcn.004d178d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4cba56
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4cba4d
xor eax, eax
jmp 0x4cba5e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cba64
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d1cbd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d1ceb
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4d1d09
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d1c23
jmp 0x4d1d09
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d1d09
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d1c23
test edi, edi
mov eax, edi
jne 0x4d1cf3
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x3df37b54
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3eab3c20
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4243d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00424044
push eax
push esi
push dword [ebp + 8]
call fcn.00423ff9
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00424044
push eax
push esi
push dword [ebp + 8]
call fcn.00423ff9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00424044
push eax
push esi
push dword [ebp + 8]
call fcn.00423ff9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00424034
inc ebp
outsd dx, dword [esi]
sub bl, cl
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
invalid
Function at 0x424710
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x42470b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x424729
movzx eax, ax
lea eax, [eax + eax*4]
or byte [ebx + 0x104c78c], 0
add byte [ebx + 0x108c794], cl
add byte [eax], al
or byte [ebx + 0x104c78c], 0
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x424787
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x42476e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x424777
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x424781
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x424763
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4246ed
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4247d4
dec eax
je 0x4247cb
sub eax, 3
je 0x4247c2
mov dword [ebp - 4], 0x40
jmp 0x4247f1
mov dword [ebp - 4], 4
jmp 0x4247d7
mov dword [ebp - 4], 0x20
jmp 0x4247d7
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x424823
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4247a3
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
invalid
invalid