joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x408ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x408cef
pop dword [ebp - 4]
mov eax, 0x606fe4f0
add eax, 0x9fd0a7ff
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xa8065223
sub dword [ebp - 0x14], 0x59b40cd8
mov dword [ebp - 0x10], 0x2085207c
add dword [ebp - 0x10], 0x11ae2bc9
mov dword [ebp - 0xc], 0xb1f29021
sub dword [ebp - 0xc], 0x65a64bf3
mov dword [ebp - 8], 0xce9cf456
sub dword [ebp - 8], 0xce9cf456
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x3dcf6d1f
sub dword [ebp - 0x14], 0xc95d03c9
mov dword [ebp - 0x10], 0x7bd8d36f
add dword [ebp - 0x10], 0xc5938e06
mov dword [ebp - 0xc], 0x4f4c0f8
sub dword [ebp - 0xc], 0xa185548c
mov dword [ebp - 8], 0x568754f4
sub dword [ebp - 8], 0x568754f4
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3b12a
push 0
call eax
mov ecx, 0x1d87c540
sub ecx, 0x1d8776d7
xor edi, edi
add edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 4]
mov edx, 0xd29ab367
sub edx, 0x1cc1ef86
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
add edi, 0xff23a74d
sub edi, 0xff23a749
add ebx, 4
loop 0x408e03
add eax, 0xb2698e62
add eax, 0x4d979e15
mov ebx, eax
add eax, 0xc579bb29
sub eax, 0xc579bb24
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x40ab28
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ba5f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040790f
and dword [ebp - 0x14], 0
cmp dword [0x4be718], 0
mov dword [ebp - 0x18], eax
jne 0x40abdb
push 0x40248c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ac83
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402480
push ebx
call edi
test eax, eax
je 0x40ac83
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402470
push ebx
mov dword [0x4be718], eax
call edi
push eax
call esi
push 0x40245c
push ebx
mov dword [0x4be71c], eax
call edi
push eax
call esi
push 0x402440
push ebx
mov dword [0x4be720], eax
call edi
push eax
call esi
mov dword [0x4be728], eax
test eax, eax
je 0x40abdb
push 0x402428
push ebx
call edi
push eax
call esi
mov dword [0x4be724], eax
mov eax, dword [0x4be724]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ac34
cmp dword [0x4be728], ecx
je 0x40ac34
push eax
call esi
push dword [0x4be728]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ac34
test ebx, ebx
je 0x40ac34
call edi
test eax, eax
je 0x40ac2b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ac2b
test byte [ebp - 8], 1
jne 0x40ac34
or dword [ebp + 0x10], 0x200000
jmp 0x40ac67
mov eax, dword [0x4be71c]
cmp eax, dword [ebp - 0x18]
je 0x40ac67
push eax
call esi
test eax, eax
je 0x40ac67
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ac67
mov eax, dword [0x4be720]
cmp eax, dword [ebp - 0x18]
je 0x40ac67
push eax
call esi
test eax, eax
je 0x40ac67
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4be718]
call esi
test eax, eax
je 0x40ac83
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ac85
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ae93
leave
ret

Function at 0x40ae93
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ba5f8]
jne 0x40ae9d
repz ret
jmp fcn.0040dce5
Function at 0x4a21a0
Capabilities:
Accept command line arguments
Delete directory
Get common file path

Disassembly:
mov eax, 0x1420
call fcn.0040e090
cmp dword [0x23006a4], 0x37
jne 0x4a2257
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x403478
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x824]
push eax
push 0x403490
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0xc20]
push edx
push 0
push 0x4034e8
push 0x403500
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x4035a0
push 0x403648
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov eax, dword [0x23006a8]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x4c3834]
mov byte [eax + esi], dl
add esp, 0x1420
ret

Function at 0x4a2280
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x64
mov edx, dword [0x4bb358]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx]
push ebx
mov ebx, dword [0x4bb360]
push ebp
mov ebp, dword [0x4bb364]
push esi
mov esi, dword [ecx + 4]
mov dword [esp + 0x1c], edx
mov edx, dword [0x4bb35c]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0xc6ef3720
mov dword [esp + 0x28], 0x9e3779b9
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0x20
jmp 0x4a22d4
mov eax, dword [esp + 0x18]
mov edx, eax
mov edi, eax
shr edx, 5
shl edi, 4
add edi, ebx
add edx, ebp
xor edx, edi
mov edi, dword [esp + 0x10]
add edi, eax
xor edx, edi
sub esi, edx
mov eax, esi
shl eax, 4
mov dword [0x22f6654], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
add dword [esp + 0x14], eax
mov edi, dword [esp + 0x10]
add edi, esi
cmp dword [0x23006a4], 0x1be
jne 0x4a2330
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esp + 0x78]
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x24]
mov dword [0x22f6658], 0xff6b3619
xor edx, edi
xor dword [esp + 0x14], edx
mov dword [0x22f665c], 0xffffffff
mov eax, dword [esp + 0x14]
sub dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x10], eax
dec dword [esp + 0x1c]
jne 0x4a22d0
cmp dword [0x23006a4], 0x8d4
jne 0x4a239b
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x64
ret 4
mov edx, dword [esp + 0x18]
pop edi
mov dword [ecx + 4], esi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
add esp, 0x64
ret 4
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str.55222
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4017fa
cmp dword [ebp - 0x118], 0
je 0x4017fa
jmp 0x40185c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x40185c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4360b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4360d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4360cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401ae0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x4017fa
mov esp, ebp
pop ebp
ret

Function at 0x401860
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x40187c
xor eax, eax
jmp 0x401945
push ebp
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
call fcn.00401300
mov esp, ebp
pop ebp
ret

Function at 0x401b20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4360c0], 0x24e1
mov eax, dword [0x4360c0]
sub eax, 0x24e1
mov dword [0x4360c0], eax
mov ecx, 1
test ecx, ecx
je 0x401bcb
mov edx, dword [0x4360c0]
cmp edx, dword [ebp + 0xc]
jb 0x401b57
jmp 0x401bcb
cmp dword [0x4360c0], 0
jne 0x401b75
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401b75
xor eax, eax
jmp 0x401bcb
mov eax, dword [ebp + 8]
add eax, dword [0x4360c0]
mov ecx, dword [eax]
add ecx, dword [0x4360c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4360c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x1a79
mov eax, dword [0x4360c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4360c0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4360c0]
add ecx, 4
mov dword [0x4360c0], ecx
jmp 0x401b3d
mov esp, ebp
pop ebp
ret
Function at 0x401750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x4016f3
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
nop
jmp 0x40170a
xor edi, edi
nop
jmp 0x401717
jmp 0x401725
xor eax, eax
nop
lodsb al, byte [esi]
nop
cmp al, 0x61
jmp 0x401737
jl 0x401749
nop
jmp 0x401746
sub al, 0x20
nop
ror edi, 0xd
nop
add edi, eax
dec ecx
nop
jne 0x401717
nop
push edx
jmp 0x401761
mov edx, dword [edx + 0x10]
jmp 0x401774
push edi
jmp 0x40177f
mov eax, dword [edx + 0x3c]
nop
jmp 0x401794
add eax, edx
nop
jmp 0x4017a5
mov eax, dword [eax + 0x78]
test eax, eax
je 0x401912
add eax, edx
push eax
nop
mov ebx, dword [eax + 0x20]
add ebx, edx
nop
mov ecx, dword [eax + 0x18]
nop
test ecx, ecx
je 0x401910
nop
nop
jmp 0x4017d4
dec ecx
nop
xor edi, edi
mov esi, dword [ebx + ecx*4]
nop
jmp 0x4017e9
add esi, edx
nop
jmp 0x4017f6
nop
jmp 0x401806
xor eax, eax
nop
jmp 0x401819
ror edi, 0xd
lodsb al, byte [esi]
nop
add edi, eax
nop
jmp 0x40182f
cmp al, ah
nop
jmp 0x40183e
jne 0x4017f6
nop
jmp 0x401853
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jmp 0x401866
jne 0x4017bd
nop
jmp 0x401878
pop eax
mov ebx, dword [eax + 0x24]
nop
jmp 0x40188c
add ebx, edx
jmp 0x40189f
mov cx, word [ebx + ecx*2]
jmp 0x4018ad
mov ebx, dword [eax + 0x1c]
nop
jmp 0x4018be
add ebx, edx
mov eax, dword [ebx + ecx*4]
jmp 0x4018d3
add eax, edx
nop
mov dword [esp + 0x24], eax
nop
pop ebx
nop
pop ebx
jmp 0x4018ec
popal
jmp 0x4018fa
pop ecx
pop edx
nop
push ecx
nop
jmp 0x40190e
jmp eax
nop
pop eax
jmp 0x401920
pop edi
nop
pop edx
mov edx, dword [edx]
jmp 0x4016e3

Function at 0x4026c0
Capabilities:
Encode data using xor

Disassembly:
or dword [esi], ebp
add byte [eax], al
mov dword [ebp - 0x74], 0
cmp eax, 1
jle 0x4026e3
movsb byte es:[edi], byte [esi]
dec eax
dec dword [ecx + 0x45dbef4d]
hlt
mov dword [ebp + 0x63], 0xd6000000
invalid

Function at 0x40b6d1
Capabilities:
Terminate process

Disassembly:
add byte [ebx + 0x408ba300], cl
inc ecx
add byte [edi + ebx*4], bl
add al, byte [eax]
add byte [ebx + 0x41027a3d], al
sbb eax, dword [eax]
jne 0x40b6bd
invalid
push 0x40b944
push ebp
adc eax, sym.imp.MSVCRT.dll___setusermatherr
rol byte [eax], 0x59
inc eax
add byte [ecx - 0x18], bl
jo 0x40b6c2
call 0x96b932
push esi
add byte [eax + 0xc], ch
shr al, 1
shr byte [eax + 8], 1
rol byte [eax], 1
push 0xd0e8d00c
push 0x40d008
call 0x205eb9c5
mov eax, dword [0x410b90]
mov dword [ecx - 0x27ba7257], ebp
push eax
push dword [0xd00b8c]
lea eax, [ebp - 0x20]
ja 0x40b69b
inc ebp
aam 0x50
lea eax, [ebp - 0x1c]
push eax
call dword [0xa4407be8]
push 0x40d004
push 0x40d011
push ebp
sub byte [edx], al
add byte [edx], ch
stc
adc eax, 0x40b0e3
xchg esi, eax
dec ebp
loopne 0x40b6ba
cmp bh, 0x75
loopne 0x40b712
push dword [ebp - 0x16]
jne 0x40b6ff
adc ebp, dword [ebx + 0x581de8e4]
push edx
add esp, 0x30
xor byte [ecx - 0xaf23bb], cl
adc eax, sym.imp.MSVCRT.dll_exit
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov dword [0x88ba245], eax
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
loope 0x40b71f
jmp 0x40b73a
invalid
pop ecx
Function at 0x40b750
Capabilities:
Encode data using xor
Terminate process

Disassembly:
in al, 0xe8
sbb eax, 0x83f2ff58
les esi, [eax]
push ebx
push ecx
xor edi, edi
mov eax, dword [esi + 0x10]
or eax, eax
jge 0x40b717
inc edi
mov esp, dword [edx - 0x2708c2dc]
neg edx
sbb eax, 7
mov dword [esp + 0x10], eax
mov dword [esp - 0x19], edx
mov edi, dword [edi]
and al, 0x18
or eax, eax
jge 0x40b758
mov edx, dword [ebp + edi*2 + 0x14]
neg eax
mul dword [ecx]
sbb eax, 0xfffffff2
mov dword [esp + 0x2a], eax
mov dword [esp + 0x14], edx
fcmovb st(0), st(0)
jne 0x40b7aa
sal byte [ebp + 0x1b], 0x8b
dec esp
and al, 0x14
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
bound ebp, qword [ebx + ebx*8 - 0x8f353eb]
int1
mov eax, edx
invalid
mov ebx, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x55]
push ebp
mov eax, dword [ebp + esi*4 + 0xc]
push cs
jmp 0x40b78c
Function at 0x4330e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x4330f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x4331d6
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00433a50
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x4331d1
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00433a50
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x4331aa
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x4331aa
xor eax, eax
jmp 0x4331d6
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x4330ef
mov esp, ebp
pop ebp
ret

Function at 0x433a50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x433a85
xor eax, eax
jmp 0x433a8f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret

Function at 0x432004
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219