joyce8/EMBER2024-capa huggingface dataset:
Function at 0x92a970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.0092b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x92a9ce
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x92a9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0092b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x92aa4f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x92aa60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0092b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x92aacf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x92aae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0092b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x92ab43
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x92ab50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x970]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0092b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x92abaf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x92abc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x974]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0092b000
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x92ac16
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x92b400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x92b466
cmp dword [esi + 0x18], 0
je 0x92b481
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0092cd10
add esp, 8
test eax, eax
jne 0x92b45e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x92b440
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x92b481
mov eax, dword [esi + 0x18]
test eax, eax
je 0x92b481
cmp eax, ecx
je 0x92b45e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x92b474
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x92b490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x92b4e8
cmp dword [esi + 0x18], 0
je 0x92b4e8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0092cd10
add esp, 8
test eax, eax
jne 0x92b4f0
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x92b4d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x92b500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x92b558
cmp dword [esi + 0x18], 0
je 0x92b558
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0092cd10
add esp, 8
test eax, eax
jne 0x92b560
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x92b540
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x92b610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x92b654
cmp dword [eax + 0x18], 0
je 0x92b654
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x92b647
mov esp, ebp
pop ebp
ret

Function at 0x92b660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0092be50
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x92b6eb
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0092c470
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00924de0
add esp, 0x10
test eax, eax
jne 0x92b6f3
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x92b6c0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x92bb30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x92bb3e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x92bb3a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x92bb3a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x92bb80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x92bba4
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x92bba4
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x92bbac
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0092bf80
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0092be00
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0092bdd0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x92bc3e
mov dword [ebp + 0xc], edx
jmp 0x92bbe9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x92bc00
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x92bc16
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x92bc23
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0092bdd0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x92bbe7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x92bc50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x92bc70
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x92bc70
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x92bc74
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x92bcf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x92bd10
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x92bd10
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x92bd14
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x92bd10
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x92c9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x92cc2c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0092be50
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x92cbbc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x92cbb2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0091abe0
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x92cbdd
inc eax
cmp byte [esi + eax], 0
jne 0x92cbd6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0092bdd0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x92cbfa
inc edi
cmp byte [edi + ebx], 0
jne 0x92cbf3
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x92cc0a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x92cc02
test esi, esi
je 0x92cc1f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0092be20
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4018d1
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x40190e
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x401907
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x401913
add edx, 0x28
cmp edx, esi
jne 0x4018f8
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401910
Function at 0x44a8ba
Capabilities:
Encode data using xor

Disassembly:
leave
std
das
invalid
mov eax, 0x89b7e8
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x44a93a
arpl word [edx + esi], si
mov ebx, 0x12acb457
in eax, dx
ror byte [ebx], 1
dec ebp
test dword [ecx + 0x74], esi
cld
and byte [ebp - 0x69c9c163], dl
push ecx
sub ecx, eax
jmp 0x44a888
dec edi
invalid
xor eax, 0x927c9d5e
lodsd eax, dword [esi]
cwde
not dh
adc ebp, dword [ebp + 0x57]
pop ss
out dx, eax
cld
mov bh, 0xf9
sbb al, bh
sbb byte [edi - 0x7d], cl
ja 0x44a999
in eax, dx
inc eax
push esi
dec edx
and edi, eax
nop
cmp al, 0x9c
xlatb
jns 0x44a92a
push esi
sar byte [ecx], cl
mov ch, 0x3a
adc edx, dword [eax + 0x2a]
out dx, eax
invalid
cmp ah, dh
test al, 0x30
adc eax, 0x9cb77dc3
div byte [eax]
div byte [edi]
adc dl, byte [ebp + 0x258cfb3d]
dec esp
loopne 0x44a957
add ebx, esp
pop ebx
invalid
Function at 0x412402
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41242e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4124cb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4124f5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412470
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4124fa
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4124f5
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3e160f72
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x25801063
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401470
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x425544]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push esi
lea eax, [esp + 8]
push 0x104
push eax
call fcn.00415859
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push ecx
push edx
push esi
call fcn.00414ff5
mov ecx, dword [esp + 0x114]
add esp, 0xc
pop esi
xor ecx, esp
call fcn.00414cc2
add esp, 0x108
ret
Function at 0x402560
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x32c
mov eax, dword [0x425544]
xor eax, esp
mov dword [esp + 0x328], eax
mov eax, dword [esp + 0x334]
push ebx
push ebp
push esi
push edi
mov edi, dword [0x428078]
push str.IPMx
push 0x423061
mov ebx, ecx
mov dword [esp + 0x18], eax
call fcn.00414cd1
lea esi, [esp + 0x24]
add esp, 8
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
add ecx, 1
test dl, dl
jne 0x4025a5
push eax
call fcn.00414f67
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
lea edx, [esp + 0x20]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
push ebx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
movzx ecx, word [esp + 0x340]
push 0xa
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x402602
mov eax, 0x3039
jmp 0x402755
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4025f8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
call fcn.00406797
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4025f8
add esi, 1
push 0x5d
push esi
call fcn.00416390
mov dword [esp + 0x1c], eax
mov byte [eax], 0
mov eax, esi
add esp, 8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402650
sub eax, edx
lea edx, [esp + 0x1c]
push edx
mov ebx, eax
lea eax, [esp + 0x230]
push 0x104
push eax
call fcn.00415859
add esp, 0xc
lea ecx, [esp + 0x22c]
push ecx
lea edx, [esp + 0x128]
push 0x104
push edx
call fcn.00415859
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
add esp, 0xc
lea eax, [esp + 0x124]
push eax
call ebp
push 0
lea ecx, [esp + 0x128]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
mov dword [esp + 0x18], 0
je 0x4025f8
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x1c]
push eax
sub edi, ebx
sub edi, 2
push edi
add ecx, 1
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push edx
lea edi, [esp + 0x20]
mov dword [0x428070], 0x401980
call fcn.004010e0
mov eax, edi
push eax
call ebp
sub esp, 0x1c
mov edx, edi
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00402dd0
call fcn.00402ac0
mov eax, edi
add esp, 0x1c
push eax
call fcn.00414f67
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x338]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414cc2
add esp, 0x32c
ret