joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016ab60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1016ab8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016ab8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401230
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
lea eax, [esp]
push str.install.txt
push 0x4097e8
push 0x408394
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
xor eax, eax
mov cl, byte [esp + eax]
mov byte [eax + str.install.txt], cl
inc eax
test cl, cl
jne 0x401255
push 0x4096e0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40127f
add esp, 0x400
ret
push 0x4096e0
call fcn.004013f0
add esp, 4
push 0x104
push 0x4095d8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4012a7
add esp, 0x400
ret
push 0x4095d8
call fcn.004013f0
add esp, 4
mov eax, 1
add esp, 0x400
ret

Function at 0x4012c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push ebp
push 0x4096e0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4012e3
pop ebp
add esp, 0x400
ret
push 0x4096e0
call fcn.004013f0
push 0x408390
push str.install.txt
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x40130e
pop ebp
add esp, 0x400
ret
mov al, byte [ebp + 0xc]
push ebx
push esi
push edi
test al, 0x10
jne 0x4013d2
mov ebx, dword [sym.imp.MSVCRT.dll_fgets]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x10]
push ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push 0x400
push eax
call ebx
mov al, byte [esp + 0x1c]
add esp, 0xc
cmp al, 0x34
jne 0x401384
lea ecx, [esp + 0x10]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push ecx
call esi
add esp, 8
test eax, eax
je 0x401384
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
or ecx, 0xffffffff
xor eax, eax
push str.DisplayName
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + ecx + 0x14]
push edx
call esi
mov edx, eax
add esp, 8
test edx, edx
jne 0x40138c
test byte [ebp + 0xc], 0x10
je 0x401328
jmp 0x4013d2
mov edi, str.DisplayName
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 1]
mov edx, 0x4091c8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4013a6
mov edi, 0x4091c8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx + 0x4091c6]
mov cl, byte [ecx + 0x4091c6]
cmp cl, 0xa
jne 0x4013d2
mov byte [eax], 0
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x400
ret
Function at 0x402520
Capabilities:
Delete file
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov al, byte [0x4091b8]
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov esi, 0x400
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
mov dword [esp + 0xc], esi
push ecx
push 0xf003f
stosw word es:[edi], ax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
stosb byte es:[edi], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402581
cmp eax, 2
jne 0x40265a
pop edi
mov eax, 1
pop esi
add esp, 0x40c
ret
lea edx, [esp + 0xc]
push ebx
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.WDRenameService
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea edi, [esp + 0x18]
je 0x4025ba
mov ecx, pe_nt_image_headers32
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x40262b
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40262b
lea eax, [esp + 0x18]
push 0x20
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
mov edi, dword [sym.imp.MSVCRT.dll__access]
mov esi, eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov byte [esi], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
test eax, eax
jne 0x40260d
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
jne 0x40260d
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00401e30
add esp, 8
inc esi
push 0
push esi
call edi
add esp, 8
test eax, eax
jne 0x40262b
push esi
call ebx
test eax, eax
jne 0x40262b
push eax
push esi
call fcn.00401e30
add esp, 8
mov ecx, dword [esp + 0xc]
push str.WDRenameService
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0xc]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop ebx
je 0x402573
cmp esi, 2
je 0x402573
pop edi
xor eax, eax
pop esi
add esp, 0x40c
ret

Function at 0x402670
Capabilities:
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x40267f
pop edi
xor eax, eax
pop esi
ret
mov al, byte [0x408940]
cmp al, 0x31
mov eax, dword [esp + 0x14]
jne 0x40270a
mov ecx, eax
and ecx, 4
cmp cl, 4
jne 0x4026a7
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.00401e30
add esp, 8
pop edi
pop esi
ret
and eax, 1
cmp al, 1
jne 0x40267a
mov edi, dword [esp + 0x10]
push 0
test edi, edi
je 0x4026dc
push edi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x4026d1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40267a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
ret
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x402702
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402702
push eax
push esi
call fcn.00401e30
add esp, 8
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop edi
pop esi
ret
Function at 0x403230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x408
push ebp
mov ebp, dword [esp + 0x414]
test ebp, ebp
push edi
je 0x403308
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403308
mov ecx, dword [esp + 0x414]
lea eax, [esp + 8]
push eax
push 0xa
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40330d
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push 0
lea eax, [esp + 0x24]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x400
call edi
mov esi, eax
cmp esi, 0x103
je 0x4032e0
test esi, esi
jne 0x4032f1
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.00403230
mov esi, eax
add esp, 8
test esi, esi
je 0x403280
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebp
add esp, 0x408
ret
mov ecx, dword [esp + 0x418]
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebp
add esp, 0x408
ret
mov eax, 0x3f2
pop edi
pop ebp
add esp, 0x408
ret

Function at 0x4035d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [esp + 0x240]
push 0x5c
push esi
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
lea edx, [esp + 0x138]
test eax, eax
je 0x40361a
inc eax
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40360e
jmp 0x403628
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40361e
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x4036df
lea ecx, [esp + 0x34]
lea edx, [esp + 0x138]
push ecx
push edx
call fcn.00403530
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esp, 8
test eax, eax
jne 0x403690
mov eax, dword [esp + 0x18]
push eax
push 1
push 1
call edi
mov esi, eax
push 0
push esi
call ebx
test eax, eax
jne 0x403690
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x4036df
lea edx, [esp + 0x34]
lea eax, [esp + 0x138]
push edx
push eax
call fcn.00403530
add esp, 8
test eax, eax
jne 0x4036cf
mov ecx, dword [esp + 0x18]
push ecx
push 1
push 1
call edi
mov esi, eax
push 0
push esi
call ebx
test eax, eax
je 0x403677
lea edx, [esp + 0x10]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x4036a0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x22c
ret
Function at 0x404240
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x158
push ebx
push esi
mov esi, dword [esp + 0x164]
push edi
xor ebx, ebx
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], ebx
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x64]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__fullpath]
lea ecx, [esp + 0x6c]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x14
cmp eax, ebx
je 0x40429e
mov ecx, eax
lea edx, [esp + 0x60]
sub ecx, edx
cmp ecx, 2
jle 0x404299
mov byte [eax], bl
jmp 0x40429e
jne 0x40429e
mov byte [eax + 1], bl
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0x50]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x16c]
mov cx, word [esp + 0x170]
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], cx
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x64]
push eax
push ecx
push ebx
push 0x80
push ebx
push ebx
push ebx
push esi
push ebx
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x38], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404320
cmp dword [esp + 0x174], ebx
je 0x404311
mov edx, dword [esp + 0x50]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x158
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x158
ret

Function at 0x404c00
Capabilities:
Get common file path

Disassembly:
mov al, byte [0x408020]
sub esp, 0x104
cmp al, 0x30
push esi
je 0x404c45
jle 0x404c8b
cmp al, 0x32
jg 0x404c8b
mov eax, dword [esp + 0x10c]
push 5
push 0
push eax
call fcn.00402670
add esp, 0xc
test eax, eax
je 0x404c8b
mov dword [0x4098f0], 1
mov eax, 1
pop esi
add esp, 0x104
ret
lea ecx, [esp + 4]
push ecx
push 0
push 0x408434
push 0x4096e0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x404c8b
mov esi, dword [esp + 0x10c]
lea edx, [esp + 4]
push 1
push edx
push esi
call fcn.00402670
add esp, 0xc
test eax, eax
jne 0x404c95
push 5
push eax
push esi
call fcn.00402670
add esp, 0xc
test eax, eax
jne 0x404c95
xor eax, eax
pop esi
add esp, 0x104
ret
push 5
lea eax, [esp + 8]
push 0
push eax
call fcn.00402670
add esp, 0xc
mov eax, 1
pop esi
add esp, 0x104
ret
Function at 0x404d60
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov al, byte [0x408940]
sub esp, 0x20
cmp al, 0x31
push ebp
push esi
jne 0x404d76
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push ebx
push 0xf003f
push 0
push 0
call dword [0x408968]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0xc], ebp
jne 0x404d97
mov esi, 0x81000001
jmp 0x404df6
mov eax, dword [esp + 0x30]
push edi
push 0x20
push eax
push ebp
call dword [0x408964]
mov ebx, eax
test ebx, ebx
jne 0x404dc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub esi, 0x424
neg esi
sbb esi, esi
and esi, 0x81000002
jmp 0x404dea
lea ecx, [esp + 0x14]
push ecx
push 1
push ebx
call dword [0x408944]
test eax, eax
jne 0x404e0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x426
jne 0x404dea
xor esi, esi
test ebx, ebx
pop edi
je 0x404df6
push ebx
call dword [0x408950]
test ebp, ebp
pop ebx
je 0x404e02
push ebp
call dword [0x408950]
mov eax, esi
pop esi
pop ebp
add esp, 0x20
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x404de8
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, 0x2710
ja 0x404e52
mov edx, dword [esp + 0x2c]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
push ebx
call dword [0x40894c]
test eax, eax
je 0x404e5d
cmp dword [esp + 0x18], 1
jne 0x404e23
mov ebp, dword [esp + 0x10]
jmp 0x404de8
mov ebp, dword [esp + 0x10]
mov esi, 0x81000009
jmp 0x404dea
mov ebp, dword [esp + 0x10]
mov esi, 0x81000005
jmp 0x404dea
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f030]
jne 0x401116
repz ret
jmp fcn.00401ea1

Function at 0x4086ae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a72
and dword [ebp - 4], 0
cmp dword [0x431814], 0
mov ebx, eax
jne 0x40875f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408810
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408810
push eax
call fcn.00406a00
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431814], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x431818], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43181c], eax
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x431824], eax
test eax, eax
je 0x40875f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x431820], eax
mov eax, dword [0x431820]
cmp eax, ebx
je 0x4087b7
cmp dword [0x431824], ebx
je 0x4087b7
push eax
call fcn.00406a7b
push dword [0x431824]
mov esi, eax
call fcn.00406a7b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087b7
test edi, edi
je 0x4087b7
call esi
test eax, eax
je 0x4087ae
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087ae
test byte [ebp - 0xc], 1
jne 0x4087b7
or dword [ebp + 0x10], 0x200000
jmp 0x4087f0
mov eax, dword [0x431818]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087f0
mov eax, dword [0x43181c]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431814]
call fcn.00406a7b
pop ecx
test eax, eax
je 0x408810
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408812
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc40
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x42f030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c0f114]
push ebx
mov ebx, dword [0x2c0ef60]
push esi
mov esi, dword [0x430050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cc81
push 0x42decc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c0f114]
mov dword [0x4319ec], esi
cmp eax, 0x114e
jne 0x40ccab
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.nanucucolumisocifozoguvex
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2c0f114]
cmp eax, 0x2f
jne 0x40cccd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cbb0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0xa4a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa4a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa4a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4a06a
add dl, dl
jne 0xa4a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4a0dc
xor eax, eax
add dl, dl
jne 0xa4a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4a17d
add dl, dl
jne 0xa4a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa4a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa4a075
mov eax, 1
add dl, dl
jne 0xa4a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa4a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa4a0e1
sub eax, ebx
mov ebx, 1
jne 0xa4a128
mov ecx, 1
add dl, dl
jne 0xa4a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa4a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa4a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa4a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa4a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa4a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa4a136
cmp eax, 0x7d00
jae 0xa4a16d
cmp eax, 0x500
jb 0xa4a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa4a075
cmp eax, 0x7f
ja 0xa4a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa4a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa4a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa4a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x405d43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x405d52
pop dword [ebp - 0x3c]
mov eax, 0x47f15f79
sub eax, 0x47b10227
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x4231207d
add dword [ebp - 0x4c], 0xc2124ce
mov dword [ebp - 0x48], 0x5ca5c485
add dword [ebp - 0x48], 0xd58d87c0
mov dword [ebp - 0x44], 0xf9e26f34
sub dword [ebp - 0x44], 0xad962b06
mov dword [ebp - 0x40], 0x71b7c156
add dword [ebp - 0x40], 0x8e483eaa
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa0e7429c
sub dword [ebp - 0x4c], 0x2c74d946
mov dword [ebp - 0x48], 0x18401762
sub dword [ebp - 0x48], 0xd6d3b5ed
mov dword [ebp - 0x44], 0xbeb3e457
add dword [ebp - 0x44], 0xa4bb8815
mov dword [ebp - 0x40], 0x9a92463b
add dword [ebp - 0x40], 0x656db9c5
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x69cba39e
sub eax, 0x698b328e
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3978d
push 0
call eax
mov ecx, 0x6304104c
add ecx, 0x9cfc41cd
xor ebx, ebx
add ebx, eax
mov esi, 0x7baa1da5
add esi, 0x8499425b
add esi, dword [ebp - 0x3c]
mov edi, 0x11cf5d21
sub edi, 0x70780c89
xor dword [ebp - 4], 0x10f48ea5
mov edx, dword [esi]
xor dword [ebp - 0x10], ecx
add edx, edi
xor dword [ebp - 0xc], edi
mov dword [ebx], edx
add dword [ebp - 0x34], 0x6cc4c7d6
add ebx, 4
add esi, 4
loop 0x405e71
add eax, 0x8809cde0
add eax, 0x77f76d57
mov ebx, eax
add eax, 0x3f0d9c28
add eax, 0xc0f263dd
mov ecx, 0x1a13034c
add ecx, 0xe62cfcb4
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc
Function at 0x7c30c4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7c30ce
pushal
call 0x7c30d4
pop ebp
sub ebp, 0x10
sub ebp, 0x3c30c4
jmp 0x7c30ea
mov eax, 0x3c30c4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ea
mov edx, 0x5a4918a7
xor byte [eax], dl
inc eax
dec ecx
jne 0x7c3101
jmp 0x7c3114
sub al, 0x6a
sub al, 0x2e
wait
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
pop di
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
push 0x1f
mov dword [0x1da7a7a7], eax
invalid
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40596d
pop dword [ebp - 0xc]
mov eax, 0x8090c58c
add eax, 0x7faf93e1
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd1872703
add dword [ebp - 0x1c], 0x7ccb1e48
mov dword [ebp - 0x18], 0x31af8cdb
add dword [ebp - 0x18], 0x83bf6a
mov dword [ebp - 0x14], 0xa402e78c
sub dword [ebp - 0x14], 0x57b6a35e
mov dword [ebp - 0x10], 0xe408af76
sub dword [ebp - 0x10], 0xe408af76
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb0369406
add eax, 0x5009dc5a
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb126848c
sub dword [ebp - 0x1c], 0x3cb41b36
mov dword [ebp - 0x18], 0x4f17b3ae
sub dword [ebp - 0x18], 0xdab5239
mov dword [ebp - 0x14], 0xf7d6d16d
sub dword [ebp - 0x14], 0x94676501
mov dword [ebp - 0x10], 0x283c7aad
add dword [ebp - 0x10], 0xd7c38553
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x38597
push 0
call eax
mov ecx, 0xf9920ea4
add ecx, 0x66e3fe4
xor ebx, ebx
add ebx, eax
mov edx, 0x410000
add edx, dword [ebp - 0xc]
mov edi, 0xc17ce6a2
add dword [ebp - 4], eax
mov esi, dword [edx]
add dword [ebp - 8], 0x728fb944
add esi, edi
xor dword [ebp - 4], ecx
mov dword [ebx], esi
sub dword [ebp - 4], ecx
add ebx, 4
add edx, 0x6aaa1adc
sub edx, 0x6aaa1ad8
loop 0x405a80
add eax, 0x2e67cd6
add eax, 0xfd1ab01d
mov ebx, eax
add eax, 0x809a7b99
add eax, 0x7f65846c
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941