joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x47f676eb
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x20092081
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4010df
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00404810
push ebx
push edi
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1003]
mov byte [ebp - 0x1004], bl
push ebx
rep stosd dword es:[edi], eax
push 0x80
push 3
push ebx
push ebx
stosw word es:[edi], ax
push 0x80000000
push dword [ebp + 0xc]
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40112c
xor eax, eax
jmp 0x401190
mov edi, dword [ebp + 0x10]
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1004]
push ebx
push eax
mov dword [ebp + 0xc], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp + 0xc]
push ebx
push eax
lea eax, [ebp - 0x1004]
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp + 0xc], ebx
je 0x401183
push dword [ebp + 0xc]
lea eax, [ebp - 0x1004]
push eax
mov eax, dword [edi]
add eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [edi], eax
jmp 0x401135
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x401194
Capabilities:
Create directory
Create process on windows
Extract resource via kernel32 functions
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push ebx
push esi
mov esi, 0x100000
push edi
push esi
call sub.MFC42.DLL_operatornew
xor ebx, ebx
push esi
push ebx
push eax
mov dword [ebp - 4], eax
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.MSVCRT.dll___p___argv]
add esp, 0x10
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call esi
mov eax, dword [eax]
push dword [eax]
push dword [ebp - 4]
call fcn.004010df
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], bl
mov byte [ebp - 0x24], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 5
push eax
call fcn.0040107c
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x128]
push str.c:_s.exe
push eax
and edi, 0x1ff
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x128]
push ebx
push 0x80
push 2
push ebx
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
mov dword [ebp - 8], eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push ebx
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x10]
push ebx
push eax
push edi
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call sub.MFC42.DLL_operatordelete
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x527]
mov byte [ebp - 0x528], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call esi
mov eax, dword [eax]
push dword [eax]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x528]
push str.cmd.exe__c_ping_127.0.0.1__n_2_s___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x528]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404860
Capabilities:
Create process on windows

Disassembly:
enter 0x8d8, 0
push ebx
push ecx
push edx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x10c]
call fcn.00401940
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x20c]
call fcn.00401940
mov eax, 0
mov dword [ebp - 0x5d6], eax
mov eax, 0
mov ecx, pe_nt_image_headers32
lea edi, [ebp - 0x460]
jecxz 0x4048a2
rep stosb byte es:[edi], al
lea ebx, [ebp - 0x6d8]
push ebx
lea eax, [ebp - 0x10c]
push eax
call fcn.00404ae0
lea edi, [ebp - 0x10c]
lea esi, [ebp - 0x6d8]
call fcn.00401940
mov eax, esi
push eax
lea ebx, [ebp - 0x20c]
push ebx
call fcn.00404ae0
lea edi, [ebp - 0x20c]
lea esi, [ebp - 0x6d8]
call fcn.00401940
push 0x41111f
lea eax, [ebp - 0x10c]
push eax
call fcn.00403000
test eax, eax
jne 0x40492c
cmp byte [ebp - 0x10b], 0x5c
je 0x40492c
mov esi, 0x411149
lea edi, [ebp - 0x6d8]
call fcn.00401b30
lea esi, [ebp - 0x10c]
call fcn.00401af0
mov edi, esi
lea esi, [ebp - 0x6d8]
call fcn.00401940
lea esi, [ebp - 0x10c]
lea edi, [ebp - 0x8d8]
call fcn.00401b30
mov esi, 0x411121
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x7d8]
call fcn.00401b30
lea esi, [ebp - 0x20c]
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x6d8]
call fcn.00401b30
mov esi, 0x411123
call fcn.00401af0
lea edi, [ebp - 0x360]
lea esi, [ebp - 0x6d8]
call fcn.00401940
lea eax, [ebp - 0x250]
push eax
push 0x44
call fcn.00404ac0
mov dword [ebp - 0x250], 0x44
mov dword [ebp - 0x464], 0x103
lea eax, [ebp - 0x260]
push eax
lea ebx, [ebp - 0x250]
push ebx
push 0
push 0
push 0x220
push 1
push 0
push 0
lea ecx, [ebp - 0x35f]
push ecx
push 0
call sub.kernel32.dll_CreateProcessA
test al, al
jne 0x404a4a
mov esi, 0x411125
lea edi, [ebp - 0x7d8]
call fcn.00401b30
lea esi, [ebp - 0x360]
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x6d8]
call fcn.00401b30
mov esi, 0x41112b
call fcn.00401af0
lea edi, [ebp - 0x460]
lea esi, [ebp - 0x6d8]
call fcn.00401940
push dword [0x411145]
push 0x41112d
lea eax, [ebp - 0x45f]
push eax
push 0
call sub.user32.dll_MessageBoxA
mov ebx, 0
mov dword [ebp - 0xc], ebx
push 0
call sub.user32.dll_PostQuitMessage
push 0
call fcn.00403220
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 0x260]
call sub.kernel32.dll_GetExitCodeProcess
test al, al
jne 0x404a88
inc dword [ebp - 0x5d6]
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0x5d6], 1
jle 0x404a88
mov eax, 0
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0x103
je 0x404a4a
push dword [ebp - 0x260]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x25c]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x464]
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x408dd0
Capabilities:
Create process on windows

Disassembly:
enter 0x560, 0
push ebx
push ecx
push edx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
call fcn.00401940
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x208]
call fcn.00401940
lea eax, [ebp - 0x360]
push eax
lea ebx, [ebp - 0x108]
push ebx
call fcn.00404ae0
lea edi, [ebp - 0x108]
lea esi, [ebp - 0x360]
call fcn.00401940
mov eax, esi
push eax
lea ebx, [ebp - 0x208]
push ebx
call fcn.00404ae0
lea edi, [ebp - 0x208]
lea esi, [ebp - 0x360]
call fcn.00401940
lea eax, [ebp - 0x250]
push eax
push 0x44
call fcn.00404ac0
mov dword [ebp - 0x250], 0x44
mov dword [ebp - 0x20c], 0x412229
lea esi, [ebp - 0x108]
lea edi, [ebp - 0x560]
call fcn.00401b30
mov esi, 0x41220f
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x460]
call fcn.00401b30
lea esi, [ebp - 0x208]
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x360]
call fcn.00401b30
mov esi, 0x412211
call fcn.00401af0
mov edi, 0x412228
lea esi, [ebp - 0x360]
call fcn.00401940
lea eax, [ebp - 0x260]
push eax
lea ebx, [ebp - 0x250]
push ebx
push 0
push 0
push 0x220
push 0
push 0
push 0
push 0x412229
push 0
call sub.kernel32.dll_CreateProcessA
test al, al
jne 0x408f0d
cmp dword [0x41783f], 1
jg 0x408efd
push 0
push 0x412213
push dword [ebp - 0x20c]
push 0
call sub.user32.dll_MessageBoxA
cmp dword [0x41783f], 0
jne 0x408f0d
push 0
call fcn.00403220
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x64f190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66895f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00650796
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x64f21b
push eax
push esi
call fcn.00650b99
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.006508e6
int3

Function at 0x651e57
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x651e78
jl 0x651e6f
test edi, edi
jne 0x651e78
xor eax, eax
xor edx, edx
jmp 0x651f39
cmp dword [ebx + 0x38], 0
je 0x651e8d
push eax
push edi
push dword [ebp + 8]
call fcn.00651f3f
jmp 0x651f39
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x651ed4
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x651ed4
cmp eax, edi
jb 0x651eae
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00653aa0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x651eda
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x651f2e
mov ecx, ebx
call fcn.006516bf
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x651f19
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00658735
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x651f2e
jmp 0x651eec
test edx, edx
je 0x651f2e
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00658735
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x65202e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x652050
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00652113
jmp 0x65210e
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x652076
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x65207b
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x6520db
jg 0x652090
test esi, esi
je 0x6520db
test ecx, ecx
jl 0x6520d6
jg 0x65209a
test eax, eax
je 0x6520d6
cmp edi, ecx
jg 0x6520ac
jl 0x6520a4
cmp esi, eax
jae 0x6520ac
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00653aa0
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x6520de
mov ecx, dword [ebp + 8]
jmp 0x6520e8
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x652102
jg 0x6520e8
test esi, esi
je 0x652102
cmp dword [ebx + 0x4c], 0
je 0x652102
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00658da1
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x6530b6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6530f5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6530f5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6530f5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6530f5
cmp dword [ecx + 0x74], 0xe
jbe 0x6530f5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x65f247
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065f0bd

Function at 0x668670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x66869d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x66869d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40380b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403834
cmp al, 0x22
je 0x40382c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403820
cmp byte [esi], 0x22
jne 0x40383e
inc esi
jmp 0x40383e
cmp al, 0x20
jle 0x40383e
inc esi
cmp byte [esi], 0x20
jg 0x403838
mov al, byte [esi]
test al, al
je 0x403848
cmp al, 0x20
jle 0x403831
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004038b6
push 0x405004
push section..data
call fcn.0040389c
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403878
movzx eax, word [ebp - 0x14]
jmp 0x40387b
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004038ce
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401311
Capabilities:
Encode data using xor

Disassembly:
jmp 0x417620
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x417771
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
nop dword [eax]
call esi
add byte [edi + ebp], 0x69
call esi
add byte [edi + ebp], 0x92
call esi
xor byte [edi + ebp], 0xdc
call esi
add byte [edi + ebp], 0x62
call esi
add byte [edi + ebp], 0x3f
call esi
add byte [edi + ebp], 0xf8
call esi
add byte [edi + ebp], 0x44
call esi
xor byte [edi + ebp], 0x9a
call esi
add byte [edi + ebp], 0x5a
call esi
add byte [edi + ebp], 0x3e
call esi
xor byte [edi + ebp], 0x90
call esi
add byte [edi + ebp], 0xb7
call esi
add byte [edi + ebp], 0xc
call esi
add byte [edi + ebp], 0x4f
call esi
add byte [edi + ebp], 0x58
call esi
add byte [edi + ebp], 0x99
call esi
xor byte [edi + ebp], 0xc7
call esi
add byte [edi + ebp], 0xcb
call esi
add byte [edi + ebp], 7
call esi
add byte [edi + ebp], 0x46
call esi
add byte [edi + ebp], 0x49
call esi
sub byte [edi + ebp], 0x80
call esi
add byte [edi + ebp], 0x9d
call esi
add byte [edi + ebp], 0xfd
call esi
add byte [edi + ebp], 0xbd
call esi
xor byte [edi + ebp], 0x7e
call esi
add byte [edi + ebp], 0xee
call esi
add byte [edi + ebp], 0xf9
call esi
add byte [edi + ebp], 0xa3
call esi
add byte [edi + ebp], 0xe0
call esi
add byte [edi + ebp], 0xbe
call esi
xor byte [edi + ebp], 0x18
call esi
xor byte [edi + ebp], 0x58
call esi
xor byte [edi + ebp], 0x75
call esi
add byte [edi + ebp], 0xc6
call esi
add byte [edi + ebp], 0x2e
call esi
xor byte [edi + ebp], 0x9e
call esi
add byte [edi + ebp], 0xf2
call esi
add byte [edi + ebp], 0xa1
call esi
xor byte [edi + ebp], 0xcf
call esi
add byte [edi + ebp], 0x57
call esi
xor byte [edi + ebp], 0x1b
call esi
add byte [edi + ebp], 3
call esi
xor byte [edi + ebp], 0x5b
call esi
add byte [edi + ebp], 0x22
call esi
xor byte [edi + ebp], 0x1b
call esi
add byte [edi + ebp], 0xcc
call esi
add byte [edi + ebp], 0x42
call esi
add byte [edi + ebp], 0x47
inc edi
cmp edi, ebx
jb 0x417640
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x402e0a
Capabilities:
Terminate process

Disassembly:
jmp 0x42b239
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x42b24a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00404a11
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x402f09
Capabilities:
Query environment variable

Disassembly:
jmp 0x45d7b9
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x45d7ca
pop esi
ret
push ebx
push edi
push esi
call fcn.0045d6a0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403666
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45d7f2
push ebx
push esi
push edi
call fcn.0040487c
add esp, 0xc
push 0
call fcn.0040514b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40542a
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
jmp 0x417a90
sub esp, 0x30
mov eax, dword [0x57f708]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0x3c]
push edi
mov dword [esp + 0x18], 0
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
add ecx, ebx
mov dword [esp + 0x20], ecx
add eax, ebx
mov dword [esp + 0x10], eax
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x417c6a
nop word [eax + eax]
mov edx, dword [eax]
xorps xmm0, xmm0
add edx, ebx
mov dword [esp + 0x34], 0
mov eax, edx
mov dword [esp + 0x38], 0
movups xmmword [esp + 0x24], xmm0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417b01
sub eax, esi
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.004046c9
mov edi, dword [esp + 0x34]
lea ebx, [esp + 0x24]
mov esi, edi
xor esi, 0x14d
cmp dword [esp + 0x38], 0x10
cmovae ebx, dword [esp + 0x24]
push ebx
shr edi, 2
push edi
push str._x_and__p
call fcn.00401e6f
add esp, 0xc
xor edx, edx
test edi, edi
je 0x417b71
nop word [eax + eax]
imul ecx, dword [ebx + edx*4], 0x5bd1e991
inc edx
imul esi, esi, 0x5bd1e991
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e991
xor esi, ecx
cmp edx, edi
jl 0x417b50
mov eax, dword [esp + 0x34]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x417b9b
sub eax, 1
je 0x417b91
sub eax, 1
jne 0x417ba9
movsx ecx, byte [ebx + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [ebx + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [ebx + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor esi, eax
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e991
mov eax, ecx
shr eax, 0xf
xor eax, ecx
cmp eax, dword [esp + 0x48]
je 0x417c19
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
add eax, 4
mov dword [esp + 0x10], eax
cmp ecx, 0x10
jb 0x417c08
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417bfa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417c83
push ecx
push edx
call fcn.004017fd
mov eax, dword [esp + 0x18]
add esp, 8
mov ebx, dword [esp + 0x14]
inc ebp
cmp ebp, dword [esp + 0x1c]
jb 0x417ae0
jmp 0x417c6a
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + ebx]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x38]
cmp ecx, 0x10
jb 0x417c6a
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417c60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417c83
push ecx
push edx
call fcn.004017fd
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
add eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004029cd
add esp, 0x30
ret
call fcn.00403c6a
int3
Function at 0x45b5a6
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x57f708]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x45b5f1
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0045bb67
test al, al
jne 0x45b5eb
sub edx, 2
cmp edx, edi
jne 0x45b5d1
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x45b613
lea eax, [edi + 2]
cmp edx, eax
je 0x45b613
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0045b19f
add esp, 0x10
jmp 0x45b70d
push esi
lea ecx, [ebp - 0x255]
call fcn.0045bb67
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45b656
push dword [ebp - 0x25c]
jmp 0x45b603
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x45b693
cmp word [ebp - 0x226], 0
je 0x45b6b4
cmp word [ebp - 0x226], ax
jne 0x45b693
cmp word [ebp - 0x224], 0
je 0x45b6b4
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0045b19f
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x45b700
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x45b66d
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x45b6e8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x45b70d
push 0x45aa85
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040473c
add esp, 0x10
jmp 0x45b6dd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004029cd
leave
ret