joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a556
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x1001a82c
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x6d56276e
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x6d559734
push 0xffffffffffffffff
call fcn.10011756
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x1001a5c0
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.1001a5d8
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x1001a820
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x1001a7f4
Function at 0x1002a026
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1002a048
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1002a048
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1002a048
ret
cmp word [ebx + 4], 0x14c
jne 0x1002a048
test word [ebx + 0x16], 2
je 0x1002a048
test word [ebx + 0x16], 0x100
je 0x1002a048
cmp word [ebx + 0x18], 0x10b
jne 0x1002a048
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1002a048
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1002a0d4
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1002a068
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10010fb3
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1002a048
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1002a0d4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1002a048
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1002a048
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1002a048
ret
cmp word [ebx + 4], 0x14c
jne 0x1002a048
test word [ebx + 0x16], 2
je 0x1002a048
test word [ebx + 0x16], 0x100
je 0x1002a048
cmp word [ebx + 0x18], 0x10b
jne 0x1002a048
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1002a048
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1002a0d4
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1002a068
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10010fb3
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1002a048
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1002a18b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1002a1e4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1002a18b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1002a19a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042fe3d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1002a1eb
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10011061
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1002a28a
add edi, 4
add eax, 2
dec ecx
jne 0x1002a1d0
call 0x1002a237
loope 0x1002a22d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1002a287
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1002a298
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1002a24b
cmp eax, ecx
ja 0x1002a24b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1002a2d5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002a2cb
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.10011540
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1002a19a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1002a1e4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1002a18b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1002a19a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042fe3d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1002a1eb
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10011061
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1002a28a
add edi, 4
add eax, 2
dec ecx
jne 0x1002a1d0
call 0x1002a237
loope 0x1002a22d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1002a287
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1002a298
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1002a24b
cmp eax, ecx
ja 0x1002a24b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1002a2d5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002a2cb
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.10011540
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x531901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x531941
mov cl, byte [ebp + 0x14]
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
mov byte [edx + eax], cl
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x531913
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x531947
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x531984
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
xor cl, byte [ebp + 0x14]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x531959
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401e19
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401e54
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401e50
lea ebx, [ebx]
cmp esi, eax
jae 0x401e54
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401e40
cmp esi, eax
jb 0x401e5a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40f2ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40f30d
call fcn.00412697
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40f30d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40f328
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040ee84
test ebx, ebx
mov esi, eax
je 0x40f326
test edi, edi
je 0x40f326
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4204f0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42051e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42053c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042045a
jmp 0x42053c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42053c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042045a
test edi, edi
mov eax, edi
jne 0x420526
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x45c958]
test ecx, ecx
je 0x4205ff
jmp 0x4204ef
ret 8
Function at 0x42a502
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push ebx
push edx
sub esi, esi
add esi, 0x30
mov ebx, dword fs:[esi]
push ds
push ecx
mov ecx, dword [ebx + 8]
dec ebx
mov edx, dword [ebx + 0xd]
lea esi, [edx]
add esi, 0xc
mov ebx, dword [esi]
push ds
push edi
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x42a54a
mov edx, ebx
add edx, 0x30
mov edx, dword [edx]
mov edi, dword [edx]
and edi, 0xdf00df
mov edx, dword [edx + 0xb]
add edx, edi
shr edx, 1
sub edx, 0x192299a5
cmp edx, 0
je 0x42a550
mov edx, dword [ebx]
lea ebx, [edx]
jmp 0x42a51d
call fcn.0042a653
call fcn.0042a614
push eax
call fcn.0042a609
mov ebx, edi
mov eax, dword [ebx]
add eax, esi
mov ebx, dword [eax + 0xb]
add ebx, ebx
sub ebx, 0xe8c6ca
cmp ebx, 0
jne 0x42a578
jmp 0x42a57d
add edi, 4
jmp 0x42a560
mov ebx, edx
add ebx, 0x20
mov ebx, dword [ebx]
sub edi, esi
sub edi, ebx
shr edi, 1
mov ebx, dword [edx + 0x24]
add ebx, edi
add ebx, esi
mov edi, dword [ebx]
shl edi, 0x10
shr edi, 0xe
mov ebx, dword [edx + 0x1c]
add ebx, esi
add ebx, edi
mov edi, dword [ebx]
add edi, esi
mov ebx, 0x95000
push esi
mov edx, 0x1bb000
lea eax, [0x40]
push ecx
add edx, ecx
push ebx
push esp
push eax
push ebx
push edx
call edi
pop ebx
pop ecx
push eax
mov esi, 0x1737c0
lea ebx, [0x1d9000]
add esi, ecx
add ebx, ecx
mov edx, 0x2854
call fcn.0042a61f
lea esi, [0x5427]
mov edx, 0x1b0a4
mov ebx, 0x1bb000
add ebx, ecx
lea edi, [0x41]
imul esi, edi
add esi, 0x27d9
add esi, ecx
call fcn.0042a61f
jmp 0x42a659
lea edx, [0x2d3]
mov esi, 0x10000000
lea ebx, [0x1bb000]
add ebx, ecx
mov edi, 5
imul edx, edi
add edx, 0x1e1
sub ebx, edx
lea edx, [ebx]
sub edx, esi
lea esi, [0x1765c0]
add esi, ecx
Function at 0x437b52
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042f6d9
xor ebx, ebx
cmp dword [0x45d578], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x437c27
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x437b92
xor eax, eax
jmp 0x437ceb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x437b8b
push eax
call fcn.0042f676
mov dword [esp], 0x44af2c
push edi
mov dword [0x45d578], eax
call esi
push eax
call fcn.0042f676
mov dword [esp], 0x44af18
push edi
mov dword [0x45d57c], eax
call esi
push eax
call fcn.0042f676
mov dword [0x45d580], eax
lea eax, [ebp - 8]
push eax
call fcn.0042d6b3
test eax, eax
pop ecx
pop ecx
je 0x437bf5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043016f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x437c27
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042f676
cmp eax, ebx
pop ecx
mov dword [0x45d588], eax
je 0x437c27
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f676
pop ecx
mov dword [0x45d584], eax
mov eax, dword [0x45d584]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x437ca0
cmp dword [0x45d588], esi
je 0x437ca0
push eax
call fcn.0042f6e2
pop ecx
call eax
cmp eax, ebx
je 0x437c6d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x45d588]
call fcn.0042f6e2
pop ecx
call eax
test eax, eax
je 0x437c6d
test byte [ebp - 0x18], 1
jne 0x437ca0
lea eax, [ebp - 0xc]
push eax
call fcn.0042d6ea
test eax, eax
pop ecx
je 0x437c88
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043016f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x437c97
or dword [ebp + 0x10], 0x200000
jmp 0x437cd1
or dword [ebp + 0x10], 0x40000
jmp 0x437cd1
mov eax, dword [0x45d57c]
cmp eax, esi
je 0x437cd1
push eax
call fcn.0042f6e2
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x437cd1
mov eax, dword [0x45d580]
cmp eax, esi
je 0x437cd1
push dword [ebp - 4]
push eax
call fcn.0042f6e2
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x45d578]
call fcn.0042f6e2
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x441030
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4596d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00440fc5
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042bae0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x44107f
cmp dword [ebp - 0x1c], 5
jb 0x441097
jmp 0x441093
cmp dword [ebp - 0x10], 1
jne 0x441097
cmp dword [ebp - 0x1c], 4
ja 0x441093
jne 0x441097
cmp dword [ebp - 0x18], 0
jbe 0x441097
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44ca70
call fcn.00440eb6
test eax, eax
jge 0x4410b8
mov byte [0x45d675], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042a50c
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push 0x2c
push 0
push 0x403370
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x403374], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x403370], eax
mov eax, 0x40304c
mov dword [0x403378], eax
call fcn.00402510
call fcn.004023f6
call fcn.00402170
call fcn.00402060
mov edi, 0x40300e
mov ecx, 0x34
xor byte [edi], 0x89
inc edi
dec ecx
jne 0x401067
mov dword [0x40337c], 0xe8
push dword [0x40337c]
call fcn.00402090
mov dword [0x403380], eax
mov edx, 0x40301a
lea ecx, [0x403384]
call fcn.00402008
push dword [0x403384]
call fcn.00402030
push eax
mov eax, dword [0x403384]
push eax
push dword [0x40337c]
push dword [0x403380]
call fcn.00401171
mov edx, 0x403026
lea ecx, [0x403388]
call fcn.00402008
mov edx, 0x40300e
lea ecx, [0x40338c]
call fcn.00402008
mov dword [0x403390], 4
push 0x403394
push 0
push 5
push 4
push 4
call fcn.00402365
mov ebp, dword [0x403394]
mov dword [ebp], 0
mov eax, 0x403032
push eax
pop dword [ebp + 4]
mov eax, 0x40302d
push eax
pop dword [ebp + 8]
mov dword [ebp + 0xc], 3
push dword [0x403394]
push dword [0x403390]
mov eax, dword [0x40338c]
push eax
mov eax, dword [0x403388]
push eax
push dword [0x403380]
call fcn.00402197
push 0
call 0x401166
push dword [0x403370]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00402080
call fcn.004020f6
ret

Function at 0x401171
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esp], 0
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp]
jl 0x401231
mov ebp, 0x403134
mov ebx, ebp
add ebx, dword [esp]
mov eax, ebx
call fcn.004020b0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 4], ebx
mov ebx, dword [esp + 4]
and ebx, ebx
jl 0x4011c5
mov ebx, dword [esp + 4]
cmp ebx, dword [esp + 0x24]
jge 0x4011c5
mov eax, 1
jmp 0x4011c7
xor eax, eax
and eax, eax
je 0x401228
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 4]
mov eax, edi
cdq
idiv dword [esp + 0x2c]
mov edi, edx
add ebx, edi
mov eax, ebx
call fcn.004020b0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0xc], ebx
mov ebp, 0x40304c
mov ebx, ebp
add ebx, dword [esp]
mov eax, ebx
call fcn.004020b0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 8], ebx
mov ebx, dword [esp + 8]
xor ebx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.004020c0
jmp 0x401228
inc dword [esp]
jno 0x401181
xor eax, eax
add esp, 0x10
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x406739
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x469c7c], 0
jne 0x406777
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40674d
mov dword [ecx*4 + 0x469c78], eax
inc ecx
cmp ecx, 0x100
jl 0x406748
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4067a4
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x469c78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406785
not eax
pop ebp
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x56b16a67
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x52322282
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43ea34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x43ea30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43ea30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x79296701
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x7cf507a8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219