joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16284d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0162818a
ror dl, 0
setb bl
stc
js 0x1628539
jns 0x162851b
stosb byte es:[edi], al
lodsb al, byte ds:[esi]
retf
stc
lea ebx, [eax + ecx]
mov eax, 0x24d64622
jmp 0x1628567
stc
lea ebx, [eax + ecx]
mov eax, 0x24d64622
bswap eax
lea esp, [esp + 0x10]
xor dl, 0x98
neg bx
jb 0x162856b
mov ebx, esi
sub esp, 0x1c
mov byte [esp + 0x14], dl
push sp
mov dword [esp + 0xe], esi
jmp 0x1628576
bswap eax
jmp 0x1628544
jmp 0x16286d9
push sp
mov dword [esp + 0xe], esi
lea esp, [esp + 2]
jmp 0x16285c6
jmp 0x16285b0
and edx, 0x3c
stc
jno 0x16285f1
mov ax, si
xchg ebx, eax
lea eax, [ebp*4]
jmp 0x162862a
clc
jmp 0x162857e
lea esp, [esp + 0x1c]
sub dl, 0x3f
lea eax, [eax + esi]
not ebx
adc ax, 0xb7c3
jne 0x162857c
clc
jmp 0x162857e
xchg ebx, eax
lea eax, [ebp*4]
jmp 0x162862a
mov ax, si
jmp 0x16285db
mov ax, word [esp]
mov bx, word [esp]
jmp 0x1628612
mov bx, word [esp]
jmp 0x16285f6
mov eax, edi
lea eax, [eax + edx]
mov ebx, dword [eax]
jmp 0x162868d
sub ebp, 4
inc ebx
jo 0x162860c
mov bx, word [esp]
mov ax, word [esp]
mov bx, word [esp]
jmp 0x1628612
jmp 0x162866d
mov eax, ebp
mov dword [eax], ebx
mov eax, dword [esp]
lea ebx, [edx + esi]
bts edx, edi
jne 0x162863e
je 0x16286b2
inc ebx
les ebx, [edx + 0x3d]
int3
mov ebx, 0x7dc51e62
jmp fcn.0162869c
lea edx, [eax - 0x84]
mov ah, 0xd7
rdtsc
mov al, byte [esp]
jmp 0x1628654
mov ebx, 0x7dc51e62
jmp fcn.0162869c
mov ebx, esi
sub esp, 0x1c
mov byte [esp + 0x14], dl
jmp 0x1628570

Function at 0x16c7f9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
mov bx, si
rdtsc
sub esp, 0xc
pop ax
pop dword [esp]
jmp 0x16c7f3b
mov edx, ebx
not edx
cmc
mov eax, 0x7aa5d34f
and dx, ax
push ebx
jmp 0x16c7f15
lea edx, reloc.kernel32.dll_GetProcAddress
not bx
rdtsc
mov dh, 0x75
mov ax, 0xd3ed
shr ax, cl
jmp 0x16c7f7d
mov dword [esp], edx
bswap edx
std
mov dx, si
mov dx, word [esp]
push eax
jmp 0x16c7f2b
xchg dl, al
rdtsc
bswap eax
xchg edx, eax
pop word [esp]
lea esp, [esp]
jmp 0x16c7fd3
xchg dword [esp], eax
pop word [esp]
push dword [esp]
xchg word [esp + 3], dx
pop dword [esp]
stc
jmp 0x16c7f67
push word [esp + 3]
pop word [esp + 1]
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x16c7f57
lea edx, reloc.kernel32.dll_GetProcAddress
mov edx, dword [esp]
lea edx, [esp + 5]
rdtsc
add esp, 1
mov bx, 0x8094
jmp 0x16c7fe9
mov byte [esp], bh
mov bh, dl
mov eax, 0xa680b161
xchg word [esp], bx
mov dl, 0xe0
btr ax, dx
jmp 0x16c7fb3
btc bx, ax
neg edx
mov dx, bp
add esp, 0
mov byte [esp], dh
rdtsc
jmp 0x16c9fc5
mov bl, 0xd
mov byte [esp], al
add esp, 0
clc
xchg ebx, edx
inc edx
jmp 0x16c8679
cld
xchg bx, ax
bswap ebx
setae dh
mov dx, word [esp]
mov dl, byte [esp]
jmp 0x16c94bf

Function at 0x16c80ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, 0xa1fa
pushfd
xchg dword [esp + 3], edx
jmp 0x16c810e
Function at 0x16c831b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
lea edx, reloc.kernel32.dll_GetProcAddress
xchg byte [esp + 2], ah
xchg bx, ax
xchg byte [esp + 6], bh
mov ah, 0x91
jmp 0x16c82fc
xor dl, 0xac
not ebx
lea esp, [esp + 8]
bt bx, si
push word [esp + 3]
sete ah
jmp 0x16c82c2
xchg ebx, eax
pop dx
lea eax, [ebx*4]
rdtsc
pushal
mov dl, byte [esp + 0xa]
jmp 0x16c832b
mov ax, dx
push word [esp + 2]
push bx
mov edx, dword [esp + 7]
jmp 0x16c82e5
neg ebx
push sp
add esp, 0x1a
bsr dx, bx
lea esp, [esp + 0xa]
mov byte [esp + 1], ch
jmp 0x16c8370
lea eax, reloc.kernel32.dll_GetProcAddress
stc
mov ah, 0xcc
lea esp, [esp + 2]
lea esp, [esp + 1]
not ax
jmp 0x16c835a

Function at 0x16c83f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x16c8445
mov ax, word [esp + 0xa]
mov bx, word [esp + 0xa]
cmp ax, 0x3ca7
pop dword [esp + 1]
lea esp, [esp + 8]
mov bl, bh
jmp 0x16c842f
push word [esp + 5]
inc edx
push dword [esp + 5]
clc
pop word [esp + 3]
jmp 0x16c847c
mov eax, ebx
rdtsc
xchg dx, ax
add esp, 6
mov bh, 0x15
bsf dx, cx
jmp 0x16c83f4
mov edx, dword [esp + 4]
pop dword [esp + 4]
lea ebx, [ecx + esi]
rdtsc
mov byte [esp + 4], cl
setge dh
call fcn.016c8573
inc ecx
Function at 0x16c89e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
pop dword [esp + 0x18]
rdtsc
xchg dword [esp + 0x26], eax
dec ax
setae bl
jmp 0x16c8a1d
shr ah, 3
clc
push word [esp]
adc bx, 0x4467
jmp 0x16c89cc
mov byte [esp + 0xf], al
rdtsc
lea ebx, reloc.kernel32.dll_GetProcAddress
mov word [esp + 2], si
mov byte [esp + 0x1d], dh
mov ebx, dword [esp + 0xb]
jmp 0x16c8abf
rdtsc
xchg dword [esp + 3], edx
pop bx
not ah
std
pop dx
jmp 0x16c8a97
xchg byte [esp + 0x14], bl
push dword [esp + 0x24]
mov bh, bl
mov dword [esp + 3], esi
xchg bl, ah
jmp 0x16c8b9d
rcl bx, 7
rdtsc
mov ebx, esp
mov ebx, 0x6cd98c09
btc dx, cx
lea eax, [edi*4]
jmp 0x16c8a57
mov bx, word [esp + 0x15]
lea edx, [eax + ebx]
rdtsc
std
lea ebx, [eax*4]
rdtsc
jmp 0x16c8a66
shr ebx, 0x17
mov dx, si
pop edx
clc
lea eax, reloc.kernel32.dll_GetProcAddress
rdtsc
jmp 0x16c8a7d
not ax
and dl, dl
pushal
bsr ebx, ecx
pop word [esp + 0xe]
jmp 0x16c8b0c
clc
push dword [esp + 3]
add esp, 0xb
inc ebx
std
mov dh, bl
jmp 0x16c8ad2
xchg byte [esp + 0x22], al
pushal
lea esp, [esp + 0x49]
rol ah, cl
stc
not ax
jmp 0x16c8b37
mov dx, word [esp + 1]
mov ax, 0xb993
pushfd
mov dword [esp + 0x1e], ebx
mov byte [esp + 1], bl
stc
jmp 0x16c8af6
lea edx, reloc.kernel32.dll_GetProcAddress
lea ebx, reloc.kernel32.dll_GetProcAddress
mov edx, ebp
jmp 0x16c8b7c
rdtsc
mov bh, byte [esp]
mov edx, 0xe10bbf18
inc bx
stc
jmp 0x16c8b21
rol eax, cl
mov al, 0x2e
cld
mov dx, word [esp + 0xd]
mov byte [esp + 5], cl
lea edx, [eax + 0xe3]
jmp 0x16c8ae8
mov bx, word [esp]
dec dx
mov dx, word [esp]
not bx
mov bh, byte [esp]
jmp 0x16c8bc5
neg ah
std
xchg bx, ax
lea eax, [eax + eax]
lea ebx, [ebp*4]
rcr bl, cl
jmp 0x16c8b66
sub esp, 2
cmc
mov edx, dword [esp + 0x11]
pop edx
not ax
lea esp, [esp + 0x1b]
jmp 0x16c8b50
push dword [esp + 0x2a]
mov word [esp + 5], di
mov byte [esp + 0x1a], cl
pop ax
jmp 0x16c8bd6
mov bx, 0x88d2
pushal
neg ebx
pushfd
push dword [esp + 4]
sub esp, 0x12
jmp 0x16c8baf
mov ebx, ebp
rol ax, 2
lea eax, [ebp*4]
lea eax, [ecx + edx]
sub esp, 0x16
jmp 0x16c8c0d
lea esp, [esp + 0x52]
rcl edx, cl
bswap edx
rdtsc
xchg dl, al
mov bh, byte [esp]
jmp 0x16c8e96
mov byte [esp + 0x11], dh
dec bh
mov ebx, 0x4fdde0e0
pushal
call fcn.016c8c48
cmp al, 0xa9
cmp dword [eax - 0x55], ebx
add byte [eax + 0xf], cl
pushfd
ret 0x7489
setl dl
mov dword [esp + 0xe], esi
xor ebx, 0x672ddb8e
cld
push dword [esp + 6]
push dword [esp]
jmp 0x16c8c5e
lea esp, [esp + 4]
pushfd
sub esp, 9
mov eax, 0x77c6fece
mov dword [esp + 3], ebp
push dword [esp + 9]
jmp 0x16c8c76
rdtsc
sub esp, 7
bsr ebx, eax
mov dh, byte [esp + 6]
lea ebx, [ebx + 0xde]
xchg dword [esp], edx
jmp 0x16c8ca2
mov ax, dx
not al
setns bl
shl bh, cl
mov ax, 0xb390
mov dh, byte [esp]
jmp 0x16c8cd9
Function at 0x16c99f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov byte [esp], bh
lea esp, [esp + 2]
jmp 0x16c9b4a
add dx, di
push eax
bswap eax
neg ax
mov dx, 0xb426
rdtsc
jmp 0x16c9b60
push edx
lea edx, [eax*4]
mov dl, byte [esp]
neg dx
mov dx, 0xb97a
neg edx
jmp 0x16c9b28
sbb eax, ebp
lea eax, [eax + edi]
push ebp
mov dl, 0xeb
mov edx, dword [esp]
inc ah
jmp 0x16c9bc1
xchg dx, ax
cld
mov eax, dword [esp]
mov dl, 0x3c
btc bp, ax
mov dx, bx
jmp 0x16c9bd0
rcl eax, 0x18
lea eax, reloc.kernel32.dll_GetProcAddress
shl dx, cl
neg ebp
mov eax, edx
mov ax, bp
jmp 0x16c9b88
setge dh
cld
setae ah
mov ah, 0x63
xchg al, dl
mov dh, bl
jmp 0x16c9b9e
cld
setp ah
rdtsc
lea edx, [edx + edi]
mov ebp, dword [esp]
btr bp, ax
jmp 0x16c9c06

Function at 0x16c9dca
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [ebp*4]
push dword [esp + 0x20]
mov ah, 0x75
call 0x16c9dca
and al, 0x57
jmp 0x16c9e08
pop edx
mov dword [esp + 1], edi
lea eax, [ebx*4]
jmp 0x16c9e1f
mov dx, word [esp + 0x25]
xchg dword [esp + 0x19], edx
not dl
btr dx, ax
lea ebp, [edx + ebx]
add esp, 0x20
jmp 0x16c9df2
pop word [esp + 3]
mov bp, 0x6b6e
mov edx, 0x80fbc190
mov bp, di
mov word [esp + 1], dx
bswap edx
jmp 0x16c9e4f
Function at 0x16ca36e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg al, dl
push ecx
lea edx, [esi*4]
std
pop word [esp + 0x12]
jmp 0x16ca397
mov word [esp + 0x22], di
push dword [esp + 0x2b]
mov eax, edi
jmp 0x16ca358

Function at 0x16ca820
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 0x1e]
not ax
xchg dword [esp + 9], edx
jmp 0x16ca95f
dec dl
pop word [esp + 0x1c]
mov dx, word [esp + 0x21]
mov ebp, edx
jmp 0x16ca898
mov byte [esp + 0x16], bl
mov ebp, 0xe5aa2e13
neg bp
mov eax, 0xd7d7c1bc
cmc
mov edx, eax
jmp 0x16ca856
lea esp, [esp + 0x42]
bsf edx, esi
mov eax, 0xfe8cf33d
mov al, dh
neg al
jmp 0x16ca8ad
xchg dword [esp + 0xa], eax
bsf ebp, ecx
xchg byte [esp + 0x14], dl
neg dx
pop dword [esp + 0x1a]
pushal
jmp 0x16ca882
neg dh
mov dx, 0x148
lea eax, [ecx + ecx]
dec dl
xchg ah, al
not bp
jmp 0x16ca912
push ebp
xchg byte [esp + 0x1e], dl
lea eax, [ebx + ebp]
and eax, edx
rdtsc
mov dh, 0xda
jmp 0x16ca86c
mov word [esp + 0x15], di
add esp, 0x15
sub esp, 0x1b
cmc
mov ebp, dword [esp + 0x26]
jmp 0x16ca942
setno dl
inc eax
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
sub esp, 5
push word [esp + 0x14]
jmp 0x16ca8d4
mov eax, dword [esp]
sub esp, 0x1c
push word [esp + 0xe]
pop word [esp + 3]
neg bp
mov ax, word [esp + 0xc]
jmp 0x16ca8ea
mov edx, 0xd7f698e8
mov al, byte [esp]
inc bp
xchg ebp, edx
jmp 0x16cae36
inc bp
pushal
lea esp, [esp + 0x49]
neg bp
mov ax, word [esp]
bsr edx, ebx
jmp 0x16ca92c
or ebp, 0x3d49fa8c
lea eax, [esi - 1]
mov word [esp + 0xb], bx
shr bp, 2
mov dx, bx
mov bp, 0x451e
jmp 0x16ca8c4
pushal
bsf bp, di
pop dword [esp + 0x16]
pop ax
setg ah
jmp 0x16ca9d7
xor dh, ah
mov dword [esp], ebp
lea edx, [eax + 0xf5]
xchg dword [esp], edx
mov word [esp], ax
inc dl
jmp 0x16ca97d
mov bp, 0x179c
mov dx, bx
xchg byte [esp], ah
xor ax, 0x44c8
pop ax
jmp 0x16ca9f2
push dword [esp]
pop word [esp + 1]
mov ebp, esi
rdtsc
setge ah
jmp 0x16ca9a9
mov ax, si
lea esp, [esp + 0x1c]
mov dword [esp], ebx
bsf edx, ebx
lea eax, [edx*4]
mov edx, 0x4df14fbe
jmp 0x16ca9bf
mov al, byte [esp + 2]
mov bp, 0x6754
mov ah, 0x6d
clc
call fcn.016cac36
jbe 0x16caa07
xchg ebx, eax
test byte [0x8b6646a4], 0x44
and al, 5
movsb byte es:[edi], byte [esi]
inc esi
mov ax, word [esp + 5]
mov word [esp + 5], di
xchg dword [esp + 2], eax
btc ax, bx
pop dx
xchg dword [esp], ebp
jmp 0x16ca993
mov edx, ecx
mov edx, esp
push eax
push edi
rdtsc
mov dx, ax
jmp 0x16caa09
lea ebp, [edx*4]
lea ebp, [edx + ebp]
and eax, 0xf018d1d6
xchg ebp, eax
rdtsc
mov ah, byte [esp]
jmp 0x16cac6b

Function at 0x16cac36
Capabilities:
Access peb ldr_data

Disassembly:
sub ax, 0xa538
call fcn.016cab96
Function at 0x468b3c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689b3

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x41ecdc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415fe2
and dword [ebp - 0x14], 0
cmp dword [0x46b270], 0
mov dword [ebp - 0x18], eax
jne 0x41ed8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ee37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ee37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46b270], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46b274], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46b278], eax
call edi
push eax
call esi
mov dword [0x46b280], eax
test eax, eax
je 0x41ed8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46b27c], eax
mov eax, dword [0x46b27c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ede8
cmp dword [0x46b280], ecx
je 0x41ede8
push eax
call esi
push dword [0x46b280]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ede8
test ebx, ebx
je 0x41ede8
call edi
test eax, eax
je 0x41eddf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41eddf
test byte [ebp - 8], 1
jne 0x41ede8
or dword [ebp + 0x10], 0x200000
jmp 0x41ee1b
mov eax, dword [0x46b274]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ee1b
mov eax, dword [0x46b278]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b270]
call esi
test eax, eax
je 0x41ee37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ee39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410717
leave
ret

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x828844
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
fld xword [eax + 0x527273da]
clc
loop 0x401074
or dword [eax], esi
push esi
pop ebp
invalid
invalid
pop eax
sbb al, 0xc0
mov ebx, dword [ebp + 0x1e3009fd]
invalid
Function at 0x4b18b0
Capabilities:
Clear file content

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 1
push esi
push esi
push edi
push esi
pop ebx
mov dword [ebp - 8], esi
call fcn.004ae92b
push edx
pop ecx
mov dword [ebp - 0x18], eax
and eax, ecx
add esp, 0x10
mov dword [ebp - 0x14], ecx
cmp eax, 0xffffffff
je 0x4b1938
push 2
push esi
push esi
push edi
call fcn.004ae92b
mov ecx, eax
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4b19cf
jg 0x4b1912
test esi, esi
je 0x4b19cf
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x4b1944
call fcn.004a93f4
mov dword [eax], 0xc
call fcn.004a93f4
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.004b1a8e
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
jl 0x4b196c
jg 0x4b1965
cmp esi, 0x1000
jb 0x4b196c
mov eax, 0x1000
jmp 0x4b196e
mov eax, esi
push eax
push dword [ebp - 0xc]
push edi
call fcn.004add38
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b1995
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4b19b0
jg 0x4b1957
test esi, esi
je 0x4b19b0
jmp 0x4b1957
call fcn.004a93c0
cmp dword [eax], 5
jne 0x4b19aa
call fcn.004a93f4
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.004b1a8e
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4b1a35
or eax, eax
jg 0x4b1a41
jl 0x4b19d9
test esi, esi
jae 0x4b1a41
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004ae92b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
push edi
call fcn.004b14ba
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
push eax
pop ebx
mov eax, edx
push ebx
pop ecx
and ecx, eax
mov dword [ebp - 8], eax
cmp ecx, 0xffffffff
jne 0x4b1a41
call fcn.004a93f4
mov dword [eax], 0xd
call fcn.004a93c0
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x4b1938
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.004ae92b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
xor eax, eax
jmp 0x4b193f

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x633a4f1b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x79695fc3
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x53392d4b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x633037b1
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1f19ae
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
pushal
lea ecx, [ebp - 0x20]
sub ecx, esp
push ecx
lea eax, [esp + 0x24]
push eax
call fcn.001f1f73
mov eax, 0xfffefdfc
mov ecx, 0x40
mov dword [ebp + ecx*4 - 0x404], eax
sub eax, 0x4040404
dec ecx
jne 0x1f19d2
xor eax, eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
jmp 0x1f19f2
inc bl
dec esi
je 0x1f19e6
mov dl, byte ss:[ecx + ebp - 0x400]
add al, byte [ebx + edi]
add al, dl
mov dh, byte ss:[eax + ebp - 0x400]
mov byte ss:[ecx + ebp - 0x400], dh
mov byte ss:[eax + ebp - 0x400], dl
inc cl
jne 0x1f19ed
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
test edi, edi
je 0x1f1a71
xor eax, eax
xor edx, edx
xor ecx, ecx
xor ebx, ebx
inc bl
mov dl, byte ss:[ebx + ebp - 0x400]
add al, dl
mov cl, byte ss:[eax + ebp - 0x400]
mov byte ss:[ebx + ebp - 0x400], cl
mov byte ss:[eax + ebp - 0x400], dl
add cl, dl
mov cl, byte ss:[ecx + ebp - 0x400]
xor byte [esi], cl
inc esi
dec edi
jne 0x1f1a2d
xor eax, eax
lea edi, [ebp - 0x400]
mov ecx, 0x40
cld
rep stosd dword es:[edi], eax
popal
leave
ret 0x10

Function at 0x1f2211
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf4
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.001f1f73
lea eax, [ebp - 0x50c]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.001f1f8a
lea edx, [ebp - 0x50c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov esi, dword [esi]
mov edi, dword [esi + 0x30]
xor ecx, ecx
cmp byte [ecx + edx], 0
je 0x1f22f7
mov al, byte [edi]
mov ah, al
cmp al, 0x41
jb 0x1f2275
cmp al, 0x5a
ja 0x1f2275
add ah, 0x20
jmp 0x1f2280
cmp al, 0x61
jb 0x1f2280
cmp al, 0x7a
ja 0x1f2280
sub ah, 0x20
cmp byte [ecx + edx], al
je 0x1f228c
cmp byte [ecx + edx], ah
je 0x1f228c
jmp 0x1f2292
add edi, 2
inc ecx
jmp 0x1f225a
cmp esi, ebx
jne 0x1f2253
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x50c]
push eax
call fcn.001f2082
mov word [ebp - 8], ax
mov word [ebp - 6], ax
add word [ebp - 6], 2
lea eax, [ebp - 0x108]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1000519a
call fcn.001f2211
push 0x100051a4
push eax
call fcn.001f2301
call eax
mov eax, dword [ebp - 0x10c]
jmp 0x1f22fa
mov eax, dword [esi + 0x18]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x1f2301
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa68
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.001f1f73
lea eax, [ebp - 0x598]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.001f1f8a
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov dx, word [eax + esi + 0x18]
cmp dx, 0x20b
jne 0x1f2350
mov edx, dword [eax + esi + 0x88]
mov ecx, dword [eax + esi + 0x8c]
jmp 0x1f2358
mov edx, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x7c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
or eax, eax
je 0x1f23fb
lea eax, [edx + esi]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 8], edx
add dword [ebp - 8], esi
mov edx, dword [eax + 0x20]
mov dword [ebp - 0xc], edx
add dword [ebp - 0xc], esi
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x10], edx
add dword [ebp - 0x10], esi
xor ebx, ebx
mov edi, dword [ebp - 0xc]
jmp 0x1f23f6
mov eax, dword [edi + ebx*4]
add eax, esi
push eax
lea eax, [ebp - 0x598]
push eax
call fcn.001f20cf
or eax, eax
je 0x1f23f5
mov edx, dword [ebp - 0x10]
mov ax, word [edx + ebx*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add edx, esi
add eax, esi
add ecx, edx
cmp eax, edx
jbe 0x1f23f3
cmp eax, ecx
ja 0x1f23f3
mov esi, eax
mov edi, eax
mov al, 0x2e
repne scasb al, byte es:[edi]
sub edi, esi
mov ecx, edi
lea edi, [ebp - 0x198]
rep movsb byte es:[edi], byte [esi]
mov byte [edi - 1], 0
lea eax, [ebp - 0x198]
push eax
call fcn.001f2211
push esi
push eax
call fcn.001f2301
jmp 0x1f23fd
inc ebx
cmp ebx, dword [ebp - 4]
jb 0x1f2391
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 8