joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2920d2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 3
pop ebx
mov edi, eax
xor edx, edx
mov esi, ecx
mov ecx, ebx
div ecx
push 0x40
push 0x3000
mov dword [ebp - 4], eax
mov eax, edi
sub eax, edx
add eax, ebx
xor edx, edx
div ecx
lea eax, [eax*4 + 1]
push eax
push 0
call dword [0x403034]
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x2921d0
cmp edi, ebx
jb 0x292180
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x404000]
mov byte [ecx], al
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
and eax, ebx
shl eax, 4
shr edx, 4
or eax, edx
mov al, byte [eax + 0x404000]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx edx, byte [esi + 2]
and eax, 0xf
shl eax, 2
shr edx, 6
or eax, edx
mov al, byte [eax + 0x404000]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + 0x404000]
inc ecx
mov byte [ecx], al
inc ecx
add esi, ebx
sub edi, ebx
dec dword [ebp - 4]
jne 0x292122
test edi, edi
jbe 0x2921d0
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x404000]
mov byte [ecx], al
mov dl, byte [esi]
and dl, bl
inc ecx
shl dl, 4
cmp edi, 1
jbe 0x2921a7
mov al, byte [esi + 1]
shr al, 4
or dl, al
movzx eax, dl
mov al, byte [eax + 0x404000]
mov byte [ecx], al
inc ecx
cmp edi, 2
jae 0x2921bc
mov al, 0x3d
jmp 0x2921ca
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + 0x404000]
mov byte [ecx], al
mov byte [ecx + 1], 0x3d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x12b3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.012b378f
jae 0x12b370e
xor ecx, ecx
call fcn.012b378f
jae 0x12b373d
xor eax, eax
call fcn.012b378f
jae 0x12b374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.012b378f
adc al, al
jae 0x12b372f
jne 0x12b3779
stosb byte es:[edi], al
jmp 0x12b3711
call fcn.012b379b
sub ecx, ebx
jne 0x12b3756
call fcn.012b3799
jmp 0x12b3775
lodsb al, byte [esi]
shr eax, 1
je 0x12b3783
adc ecx, ecx
jmp 0x12b3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.012b3799
cmp eax, 0x7d00
jae 0x12b3772
cmp ah, 5
jae 0x12b3773
cmp eax, 0x7f
ja 0x12b3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12b3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x130ecb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffffffffff
lea edx, [ebx + 8]
push dword [edx + 0x34]
lea esi, [edx - 8]
add dword [esp], ebx
pop ecx
add edx, dword [ecx + 0x78]
add esi, dword [edx + 0x18]
pop ecx
lodsd eax, dword [esi]
add ecx, 1
cmp dword [edx + 0x10], ecx
lea edi, [eax + ebx + 4]
je 0x130ed30
nop
cmc
and al, 0xff
xor eax, eax
imul eax, eax, 0xf
push eax
movzx eax, byte [edi - 4]
neg eax
sub edi, 0xfffffff1
add dword [esp], eax
lea edi, [edi - 0xe]
pop eax
cmp byte [edi - 4], 0xa
jmp 0x130ee3e
ret
add ecx, ecx
add edi, ebx
add ecx, ebx
mov esi, dword [edx + 1]
mov ax, word [ecx + esi]
cwde
push dword [edi + eax*4]
add dword [esp], ebx
pop esi
mov eax, dword [esp]
add esp, 8
jmp eax
ja 0x130ece1
mov eax, 0xfc8e2a94
xor dword [esp - 4], eax
mov eax, dword [esp + 4]
sub dword [esp - 4], eax
jne 0x130ecce
add edx, 0x1b
push dword [edx - 7]
pop edi
jmp 0x130ed49
Function at 0x405c47
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ab4], 0
push esi
jne 0x405c7e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c58
mov dword [ecx*4 + 0x422ab0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c53
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405caf
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ab0]
xor eax, esi
inc ecx
dec edx
jne 0x405c91
pop edi
not eax
pop esi
ret 0xc

Function at 0x407af0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x407b0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407b11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407b00
mov eax, 1
add ebx, ebx
jne 0x407b23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407b18
jne 0x407b34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407b18
xor ecx, ecx
sub eax, 3
jb 0x407b48
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407bba
mov ebp, eax
add ebx, ebx
jne 0x407b53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407b60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407b84
inc ecx
add ebx, ebx
jne 0x407b70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407b65
jne 0x407b81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407b65
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407ba4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407b95
jmp 0x407b06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407ba4
add edi, ecx
jmp 0x407b06
pop esi
mov edi, esi
mov ecx, 0x2d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x407bc2
cmp byte [edi], 1
jne 0x407bc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x407bc7
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407c36
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x708c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407bf4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7090]
or eax, eax
je 0x407c30
mov dword [ebx], eax
add ebx, 4
jmp 0x407c11
call dword [esi + 0x70a0]
mov ebp, dword [esi + 0x7094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407c6a
sub esp, 0xffffff80
jmp 0x401d10
Function at 0x409790
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409863
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40987c
push ebx
push 0x409888
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409810
mov al, 0x62
call fcn.00409368
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409764
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409819
call fcn.00409764
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40986a
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x40991c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099d0
jmp 0x4099c5
cmp dword [esi + 0x10], 0x1000
jne 0x4099b1
test byte [esi + 0x15], 1
jne 0x4099b1
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409970
cmp eax, 2
je 0x409970
cmp eax, 0x10
je 0x409970
cmp eax, 0x20
jne 0x409985
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409985
mov bl, 1
xor ebp, ebp
jmp 0x409996
mov eax, dword [esi]
add eax, ebp
call fcn.00409914
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409989
test bl, bl
je 0x4099b1
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099d0
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409948
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xb7bff0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x684000]
push edi
jmp 0xb7c00a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xb7c011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7c000
mov eax, 1
add ebx, ebx
jne 0xb7c023
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xb7c034
jne 0xb7c053
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7c053
dec eax
add ebx, ebx
jne 0xb7c040
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xb7c018
add ebx, ebx
jne 0xb7c04f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xb7c0a5
xor ecx, ecx
sub eax, 3
jb 0xb7c06b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xb7c0da
sar eax, 1
mov ebp, eax
jmp 0xb7c076
add ebx, ebx
jne 0xb7c076
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7c044
inc ecx
add ebx, ebx
jne 0xb7c084
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb7c044
add ebx, ebx
jne 0xb7c091
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xb7c086
jne 0xb7c0a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xb7c086
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xb7c0c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xb7c0b6
jmp 0xb7c006
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xb7c0c4
add edi, ecx
jmp 0xb7c006
pop esi
mov edi, esi
mov ecx, 0x6d31d9
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xb7c0ff
cmp byte [edi], 9
jne 0xb7c0e4
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xb7c0e2
lea edi, [esi + 0x779000]
mov eax, dword [edi]
or eax, eax
je 0xb7c150
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x77cbc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x77cbfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xb7c105
mov ecx, edi
jns 0xb7c134
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x77cc04]
or eax, eax
je 0xb7c14a
mov dword [ebx], eax
add ebx, 4
jmp 0xb7c122
call dword [esi + 0x77cc00]
mov ebp, dword [esi + 0x77cc08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xb7c184
sub esp, 0xffffff80
jmp 0x41c7d4
Function at 0x406690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4921e8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4af5e0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov eax, dword [0x4af5e0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov word [esp + 0x41], ax
mov byte [esp + 0x43], al
mov eax, dword [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
push 0x49b2f0
xor ebx, ebx
push ecx
mov byte [esp + 0x30], bl
call fcn.00461414
lea eax, [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406720
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x10]
call fcn.004034d0
lea eax, [esp + 8]
push eax
push edi
push esi
mov dword [esp + 0x60], ebx
call fcn.004065d0
cmp dword [esp + 0x20], 0x10
jb 0x40675c
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045f0f8
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045fa9a
add esp, 0x50
ret 4

Function at 0x4069e0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [0x4b48f8]
push 0x14
call fcn.0045f603
add esp, 4
test eax, eax
jne 0x4069f9
xor al, al
pop esi
ret
lea ecx, [esi + 4]
push ecx
push 0
push eax
push 0x406a40
push 0
push 0
mov dword [eax], 0x406a80
mov dword [eax + 4], 0
mov dword [eax + 8], 0x7d0
mov dword [eax + 0xc], 0x4b48f5
mov dword [eax + 0x10], esi
call fcn.00462e25
add esp, 0x18
mov dword [esi], eax
test eax, eax
setne al
pop esi
ret
Function at 0x410c60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x48fbf8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4af5e0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0040ad80
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410cc0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00410dc0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0040ad80
cmp dword [esp + 0x28], 8
jb 0x410d0d
mov eax, dword [esp + 0x14]
push eax
call fcn.0045f0f8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4185d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491d1c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4af5e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [0x4b38f4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4b38f4
call edx
add eax, 0x10
mov dword [esi + 0xc], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], ebx
mov byte [esi + 0x14], bl
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x24]
push 0x20
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], eax
mov byte [esi + 8], bl
call fcn.0045f603
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x18], 2
cmp eax, ebx
je 0x418651
mov ecx, eax
call fcn.0047a040
jmp 0x418653
xor eax, eax
mov byte [esp + 0x18], 1
push 0xf4
mov dword [esi + 4], eax
call fcn.0045f603
mov edi, eax
add esp, 4
mov dword [esp + 0x24], edi
mov byte [esp + 0x18], 3
cmp edi, ebx
je 0x418684
lea ecx, [edi + 0xc]
push ecx
call fcn.0043eb90
mov dword [esi], edi
jmp 0x418686
mov dword [esi], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x41b1b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x490868
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4af5e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.0041c590
xor edi, edi
lea eax, [esp + 0xc]
mov dword [esp + 0x30], edi
mov ecx, dword [esi + 4]
push eax
call fcn.0047a320
test al, al
je 0x41b21f
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x18]
test ecx, 0xfffffffc
je 0x41b21f
mov ecx, dword [esi + 4]
push 1
push 0x4e20
push edi
push 0x49d08c
call fcn.0047a140
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x41b249
mov edx, dword [esp + 8]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.0041df40
mov eax, dword [esp + 0x28]
push eax
call fcn.0045f0f8
add esp, 0x14
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.0045f0f8
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4813d2
Capabilities:
Encode data using xor

Disassembly:
out dx, al
lahf
mov dl, 0xea
jle 0x48140b
aad 0xfc
aas
int3
pop ebp
sbb al, dl
xchg esp, eax
daa
stc
rol dword [edx + 0x15], 1
jo 0x48147b
and al, 0x8e
add dword [esi], 0x55
fiadd dword [ebx - 0x18c4cc58]
inc esp
out 0x10, al
xchg edx, eax
fiadd word [0x153de22b]
loope 0x481458
jg 0x481423
add byte [eax], 0
add dword [eax + 0x69010008], eax
pop edi
cwde
add byte [eax], al
add byte [eax], al
scasd eax, dword es:[edi]
add dword [ecx], eax
or al, 0x18
sub al, dl
jnp 0x481454
push es
ret 0x80c1
adc dword [eax + 0x16346ca0], 0x8342050c
xor byte [eax + 0x4a354484], dl
xor al, 0x16
or al, 5
inc edx
xor dword [eax], 0xffffff90
test byte [ebp + esi + 0x4a], al
mov edx, 0x5684bfaf
jns 0x48145a
fistp dword [ebx + 0x55c9d539]
adc eax, 0x972e5c37
adc ch, byte [edx]
invalid

Function at 0x486860
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [esi]
rcr dword [edi - 0x32d121c0], cl
lds edx, [eax + 0x6d5d884f]
adc al, 0x32

Function at 0x48d5f0
Capabilities:
Execute syscall

Disassembly:
stosd dword es:[edi], eax
cmp al, 0x5e
add ah, cl
mov esp, dword [edx + 0x1d]
push ds
sahf
jae 0x48d5f4
bound ebx, qword [0x4739e1e]
mov ecx, ecx
and ch, byte [0x2cc42969]
mov ch, 0x60
imul ebp, dword [ecx], 0x60b52cc4
pop esi
jae 0x48d62b
jne 0x48d667
syscall
ret
jge 0x48d5ea
xor eax, 0x572727f
insd dword es:[edi], dx
out 0x31, eax
mov dword [0x5d8b9f68], esi
test dword [edx - 0x2b], edi
out 0xa0, eax
xlatb
loopne 0x48d5e4
pop edx
and dword [esp + esi*8 - 0x37e916d8], esp
ficom word [edi - 0xea0e121]
inc ebp
invalid
fadd dword [edx + esi + 0x42b04f41]
stc
out 0x46, eax
out dx, eax
in eax, dx
xchg ebx, eax
fnstcw word [edi + 0x4a]
mov edx, 0xa4414c40
retf 0x72ee
Function at 0x410914
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4109c8
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004108a4
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x4109a1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4109d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x4109ef
test ebp, ebp
je 0x4109ef
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4109f7
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x410a37
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x410a93
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x410a8e
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x410a79
test dl, dl
je 0x410a75
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x410a79
add ecx, 2
add eax, 2
test dl, dl
jne 0x410a59
xor eax, eax
jmp 0x410a7e
sbb eax, eax
or eax, 1
test eax, eax
je 0x410a9d
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x410a46
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x410ab4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00410914
test eax, eax
jne 0x410acc
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.004109d4
mov esi, eax
test esi, esi
jne 0x410b02
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x410b1c
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret