joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5187ec
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x5188c6
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x5188d8
call fcn.004d6e04
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x518844
mov eax, 0x518938
call fcn.004d6b80
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x51882f
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x518897
cmp dword [esp], 0
jne 0x518879
mov eax, 0x518990
call fcn.004d6b80
jmp 0x5188a1
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x5189cc
call fcn.004d6e04
jmp 0x5188a1
mov eax, 0x518a34
call fcn.004d6b80
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x5188c6
push 0xfa
call sub.kernel32.dll_Sleep_1
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x518a9c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x518cda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x518c7f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x518b11
mov eax, 0x518cf8
call fcn.004d1e80
xor edx, edx
push ebp
push 0x518c14
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00403540
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x518bfd
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x518b79
mov eax, 0x518d1c
call fcn.004d1e80
xor edx, edx
push ebp
push 0x518be6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x518bb9
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x518bb9
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x518b97
pop dword fs:[0]
add esp, 8
push 0x518bed
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518c1b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x519354
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x519497
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x5194b0
mov edx, ebx
call fcn.00406914
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x519471
xor eax, eax
push ebp
push 0x51946a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5194cc
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0042ab20
test eax, eax
jne 0x51943b
test byte [ebp - 0x258], 0x10
jne 0x51943b
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00406640
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406914
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x51942d
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5193c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519471
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51949e
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x5194d8
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5195d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00406448
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0049c7c4
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x5195f4
call fcn.0042adf4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406914
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x519578
test esi, 0x10
jne 0x5195a8
test esi, 1
je 0x519578
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x5195a2
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406448
jmp 0x5195b5
inc edi
cmp edi, 0xa
je 0x5195b5
inc ebx
cmp ebx, 0x3e8
jne 0x519519
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5195df
lea eax, [ebp - 0x14]
call fcn.00406438
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x51a498
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51a540
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x51a55c
push ebx
push 0x51a56c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004069f8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403540
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x51a51e
mov eax, dword [0x596e88]
mov eax, dword [eax + 0x1a8]
call fcn.0051a3f0
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a547
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x51aee0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51b0ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0049d868
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004d2344
test al, al
jne 0x51af4d
xor eax, eax
push ebp
push 0x51af43
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.004d2834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51af4d
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [0x59e16c]
call fcn.004064d4
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x51af7c
mov eax, dword [0x596e88]
mov eax, dword [eax + 0x1a4]
call fcn.0051a3f0
push 0x80
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x59ab50]
push eax
push 0
mov ecx, 0x51b0dc
mov edx, 0x51b0e0
xor eax, eax
call fcn.0040a124
mov dword [ebp - 8], eax
push 0x51a5b0
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x59e198], eax
xor eax, eax
push ebp
push 0x51b097
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x596e78]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.0049d23c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x51b0fc
call fcn.0042adf4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.0049d11c
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00406854
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0051a498
mov dword [ebp - 0xc], eax
call fcn.0051a574
test al, al
jne 0x51b077
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x51b055
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b09e
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x51c420
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x51c6da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x596e78]
mov eax, dword [eax]
mov edx, 0x51c6f4
call fcn.00499ec8
push 5
mov eax, dword [0x596e78]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x51c6a1
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004f75a0
lea eax, [ebp - 0x10]
call fcn.0049d6e0
mov eax, dword [ebp - 0x10]
call fcn.0042a8a0
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0049d23c
mov edx, dword [ebp - 0x14]
mov eax, 0x59e16c
call fcn.00406448
call fcn.0051a7a8
lea ecx, [ebp - 0x18]
mov edx, 0x51c714
mov eax, dword [0x59e16c]
call fcn.0049c320
mov edx, dword [ebp - 0x18]
mov eax, 0x59e170
call fcn.00406448
lea ecx, [ebp - 0x1c]
mov edx, 0x51c72c
mov eax, dword [0x59e16c]
call fcn.0049c320
mov edx, dword [ebp - 0x1c]
mov eax, 0x59e174
call fcn.00406448
push 2
push 0
push 1
mov ecx, dword [0x59e16c]
mov dl, 1
mov eax, dword [0x49fa40]
call fcn.0049fd80
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51c578
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.0049fd40
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.0049fd18
cmp dword [ebp - 0xc], 0x67734d49
je 0x51c553
mov cl, 1
xor edx, edx
mov eax, dword [0x59e174]
call fcn.004a1004
jmp 0x51c562
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x59e16c]
call fcn.004a1004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c57f
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4313c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x4313e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4313e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4313d8
mov eax, 1
add ebx, ebx
jne 0x4313fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4313f0
jne 0x43140c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4313f0
xor ecx, ecx
sub eax, 3
jb 0x431420
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x431492
mov ebp, eax
add ebx, ebx
jne 0x43142b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x431438
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43145c
inc ecx
add ebx, ebx
jne 0x431448
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43143d
jne 0x431459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43143d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43147c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43146d
jmp 0x4313de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43147c
add edi, ecx
jmp 0x4313de
pop esi
mov edi, esi
mov ecx, 0x54b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43149a
cmp byte [edi], 1
jne 0x43149a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43149f
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x431517
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x31704]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x317e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4314cc
mov ecx, edi
jns 0x4314fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x317e4]
or eax, eax
je 0x431511
mov dword [ebx], eax
add ebx, 4
jmp 0x4314e9
call dword [esi + 0x317e8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x431548
cmp al, 0xef
ja 0x43153b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x43151d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x43152a
popal
jmp 0x41c7f2
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x405cd1
Capabilities:
Encode data using xor

Disassembly:
add dword [ebx - 0xc], ebp
pushal
and dh, al
stosd dword es:[edi], eax
xor eax, 0x642a5377
jg 0x405c04
xchg ecx, eax
mov dh, 0xba
mov al, 0xf2
or al, 0xfe
das
cmp al, 0xd2
mov ds, esp
sahf
push esi
insd dword es:[edi], dx
sbb eax, 0x38bd5fb1
invalid
push esp
adc edi, dword [edx - 0x2f]
movsd dword es:[edi], dword [esi]
sbb eax, 0xe242a9c4
cmc
inc edx
loop 0x405c2b
pop eax
mov byte [0xc7c0e0d6], al
mov al, byte [0xbe344621]
into
or al, 0x43
xor bl, byte [eax + 0x718b64df]
xor byte [ebx + 0x1c], 8
sbb al, 8
adc eax, 0xc682b067
popfd
cmp byte [edx + eax*2], bl
loop 0x405c33
test byte [esi + 0x49], bl
jb 0x405cbc
xchg esi, eax
aaa
add bh, byte [ebp - 0x6ef60860]
js 0x405c01
push ebp
and al, 0xb9
dec edi
popal
adc eax, 0x1e2d7dca
jne 0x405c82
aad 0x6a
mov al, 0xa5
cmp ebx, dword [edi*8 + 0x2a49209e]
add al, 0x65
xchg ebp, eax
ja 0x405caf
push eax
nop
sbb eax, edx
sal byte [eax + 0x68a48678], 1
fdivp st(6)
inc ecx
or al, 0x84
div dword [edi - 0x47]
std
or ch, byte [edx + 0x703ee5b4]
sub al, 0x8c
stosd dword es:[edi], eax
push ebp
dec eax
dec ebx
pop esp
dec eax
push esi
fstp dword [edx]
and eax, 0xb4e8d9cb
mov cl, 0xe2
dec byte [edi - 0x1e766b2f]
cmp al, 0xc1
mov edi, 0x540e2c7
stc
ret
inc eax
add eax, 0xda88c3f9
mov ch, 0x5e
pop esi
jnp 0x405c4c
add edx, eax
sal esp, 0x50
sal ebx, cl
cmp ch, cl
invalid
aaa
xchg esi, eax
imul ebp, dword [ecx], 0x64
scasb al, byte es:[edi]
dec edx
adc dword [esi + 0x44], 0x43
push es
jg 0x405d3a
push edi
in eax, 0xac
inc edi
xchg esp, eax
scasb al, byte es:[edi]
xor dl, al
push ebx
popfd
stosb byte es:[edi], al
push ss
sub al, 0x71
and edx, dword [esi]
and esp, esp
js 0x405cc3
arpl word [ebx + 0x7fb4cf80], di
xlatb
mov al, byte [0x259417ac]
outsb dx, byte [esi]
pop edx
push ebx
mov byte [0x1364760c], bh
cdq
movsb byte es:[edi], byte [esi]
jg 0x405d77
std
pop ecx
sub ebx, dword [ebx]
fisttp dword [edx + 0x74]
ja 0x405ca7
xchg ecx, eax
sbb al, 0x51
sbb al, 0x90
cmc
add eax, 0x91cf4210
xchg ecx, eax
pushal
dec eax
or ecx, edx
inc ecx
sub al, 0x2c
push ebx
wait
pop esp
lds edx, [ebx - 7]
test eax, 0x3a030c95
cmpsb byte [esi], byte es:[edi]
sub byte [edx], bl
add dword [ebx + esi*8], edi
cmp eax, 0x3d4f99d2
std
movsd dword es:[edi], dword [esi]
xchg dh, ch
fcom dword [edi - 0x638e44b9]
mov esi, 0x3e9110c6
pop eax
pop edi
fdecstp
sub dword [esp + ebp*2 + 0x75], 0xffffffbd
bound edx, qword [edi + 0x1355db01]
and edi, 0xfffffff6
xor al, 0x85
inc edi
cmpsb byte es:[esi], byte es:[edi]
pop edx
pop ebp
add ch, byte [ebx + 0x318c2128]
lodsb al, byte [esi]
outsb dx, byte [esi]
inc edx
inc ebp
xchg edx, eax
mov ebp, 0xaf06f480
scasd eax, dword es:[edi]
xor ebp, dword [ecx]
pop esi
bound ebp, qword [esp + ecx*4 + 0x4319e925]
mov ecx, 0xc67ef298
inc eax
mov edx, es
pop edi
out dx, al
push eax
int1
fadd qword [esp + ebx*8 + 0x6a]
int1
invalid