joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4308e4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x43091a
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x43090d
cmp esi, ecx
jae 0x430a06
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x430998
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
and eax, 0xff
shr ecx, 8
and ecx, 0xff
movzx eax, byte [eax + str.cw]
movzx ecx, byte [ecx + str.cw]
or edx, eax
mov eax, dword [ebp - 8]
shl edx, 8
movzx eax, byte [eax + 0x44a650]
xor ecx, eax
or ecx, edx
jmp 0x4309ec
cmp edi, 6
jbe 0x4309ec
cmp edx, 4
jne 0x4309ec
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x43092c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x431d5a
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
mov edi, ecx
push ecx
lea esi, [edi + 4]
mov ecx, esi
call fcn.0040898e
test al, al
je 0x431d72
pop edi
xor al, al
pop esi
ret
push 0xc
call fcn.0043440f
pop ecx
test eax, eax
je 0x431d8d
push edi
push 0x431d0e
mov ecx, eax
call fcn.004116d0
jmp 0x431d8f
xor eax, eax
push eax
mov ecx, esi
call fcn.0040bf3d
mov ecx, esi
call fcn.00408928
pop edi
mov ecx, eax
pop esi
jmp fcn.00411910
Function at 0x43d182
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456178]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004366b2
mov dword [ebp - 0x14], eax
cmp dword [0x45a890], esi
jne 0x43d275
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43d202
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43d355
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43d355
push 0x449580
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d355
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45a890], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45a894], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45a898], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a8a0], eax
test eax, eax
je 0x43d272
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a89c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43d29a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43d28d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43d2af
push 4
pop eax
jmp 0x43d357
cmp dword [ebp - 0x14], esi
je 0x43d2af
push dword [0x45a890]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43d294
mov eax, dword [0x45a89c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x43d30d
cmp dword [0x45a8a0], edi
je 0x43d30d
push eax
call ebx
push dword [0x45a8a0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43d30d
test eax, eax
je 0x43d30d
call ecx
test eax, eax
je 0x43d302
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43d302
test byte [ebp - 8], 1
jne 0x43d30d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43d33d
mov eax, dword [0x45a894]
cmp eax, edi
je 0x43d33a
push eax
call ebx
test eax, eax
je 0x43d33a
call eax
mov esi, eax
test esi, esi
je 0x43d33a
mov eax, dword [0x45a898]
cmp eax, edi
je 0x43d33a
push eax
call ebx
test eax, eax
je 0x43d33a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45a890]
call ebx
test eax, eax
je 0x43d355
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43d357
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004332ea
mov esp, ebp
pop ebp
ret
Function at 0x40891c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
mov edi, edi
call fcn.0040893c
dec edi
and ebx, edi
xor dword [edx], ecx
inc edx
cmp edx, esi
jne fcn.0040891c
inc edi
ret
Function at 0x409694
Capabilities:
Terminate process

Disassembly:
push ebp
cmp eax, 1
jae 0x40969f
mov eax, 1
push 4
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x4096b5
mov eax, ebp
pop ebp
ret
push 0x10
push 0x4e3a0c
push 0x4e3a1c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop ecx
jmp 0x4096b1

Function at 0x40a930
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x2c
mov esi, ecx
mov dword [esp + 0x24], edx
mov ebx, esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
push 4
cmp esi, eax
ja 0x40a94f
mov ebx, eax
cmp esi, 1
mov eax, esi
jae 0x40a95b
mov eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x40aabf
push 4
cmp ebx, 1
jae 0x40a97b
mov ebx, 1
push ebx
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40aa9d
mov edi, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], esi
mov edx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov eax, ebp
call fcn.00409a90
mov eax, dword [esp + 0x50]
test eax, eax
jbe 0x40aa17
mov eax, dword [esp + 0x50]
cmp eax, 0x320
jbe 0x40aa81
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
shl edi, 2
mov edx, ecx
mov dword [esp + 0x24], edi
sub edx, ebx
sub ebx, ecx
xor eax, eax
cmp edx, edi
mov dword [esp + 0x1c], eax
mov edx, eax
setg dl
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov eax, ecx
mov dword [esp + 0x1c], edx
cmp ebx, edi
setg al
mov ebx, dword [esp + 0x18]
or edx, eax
je 0x40aa81
mov eax, edi
push eax
push ebx
mov edx, dword [esp + 0x30]
push edx
call fcn.0041d7d0
add esp, 0xc
test ebx, ebx
je 0x40aa46
test esi, esi
je 0x40aa30
lea eax, [ebx + esi*4]
mov dword [eax - 4], 0
add eax, 0xfffffffc
cmp ebx, eax
jne 0x40aa22
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
test ebx, ebx
je 0x40aa46
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
test ebp, ebp
je 0x40aa77
test esi, esi
je 0x40aa60
lea eax, [ebp + esi*4]
mov dword [eax - 4], 0
add eax, 0xfffffffc
cmp ebp, eax
jne 0x40aa52
mov eax, dword [ebp]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
test ebp, ebp
je 0x40aa77
push ebp
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
add esp, 0x2c
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x28]
xor eax, eax
mov edx, dword [ebx + eax*4]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, edi
jb 0x40aa8b
jmp 0x40aa17
push 0x10
push 0x4e3a0c
push 0x4e3a1c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop ecx
jmp 0x40a98f
push 0x10
push 0x4e3a0c
push 0x4e3a1c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop ecx
jmp 0x40a96f
Function at 0x40b4dc
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x14
mov ebp, edx
mov ebx, ecx
test ebp, ebp
mov edi, dword [esp + 0x28]
je 0x40b500
lea eax, [ebx + ebp*4]
mov dword [eax - 4], 0
add eax, 0xfffffffc
cmp ebx, eax
jne 0x40b4f2
mov eax, dword [ebx]
mov dword [esp], eax
mov edx, dword [esp]
mov ecx, edi
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x40b523
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x40b50c
add eax, 0xffffffff
test eax, eax
jne 0x40b533
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret 4
fldz
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
shr eax, 0x1f
fadd qword [eax*8 + 0x4254f0]
fmul qword [0x425520]
fcom st(1)
fnstsw ax
sahf
jp 0x40b556
jb 0x40b597
fld st(0)
fnstcw word [esp]
movzx eax, word [esp]
or eax, 0xc00
mov dword [esp + 8], eax
fldcw word [esp + 8]
fistp qword [esp + 0xc]
fldcw word [esp]
fild dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov esi, edx
shr esi, 0x1f
fadd qword [esi*8 + 0x4254f0]
lea esi, [edx + 1]
fsubp st(1)
fcompp
fnstsw ax
sahf
ja 0x40b59d
mov esi, edx
jmp 0x40b59d
fstp st(0)
fstp st(0)
xor esi, esi
push 1
push esi
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
test eax, eax
je 0x40b6ad
movsx edx, byte [edi]
test edx, edx
je 0x40b623
movsx ecx, byte [edi]
mov dword [esp], ebx
mov dword [esp + 4], ebp
xor edx, edx
mov ebx, edx
cmp ecx, 0x30
jb 0x40b610
cmp ecx, 0x39
ja 0x40b5d5
add ecx, 0xffffffd0
jmp 0x40b5f1
cmp ecx, 0x61
jb 0x40b5e4
cmp ecx, 0x66
ja 0x40b610
add ecx, 0xffffffa9
jmp 0x40b5f1
cmp ecx, 0x41
jb 0x40b610
cmp ecx, 0x46
ja 0x40b610
add ecx, 0xffffffc9
test esi, esi
jbe 0x40b610
lea ebp, [eax + esi]
movzx edx, byte [ebp - 1]
shl edx, 4
add edx, ecx
mov byte [ebp - 1], dl
mov ecx, edx
shr ecx, 8
add ebp, 0xffffffff
cmp eax, ebp
jb 0x40b5f8
movsx ecx, byte [ebx + edi + 1]
add ebx, 1
test ecx, ecx
jne 0x40b5c6
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
test ebp, ebp
je 0x40b638
lea edx, [ebx + ebp*4]
mov dword [edx - 4], 0
add edx, 0xfffffffc
cmp ebx, edx
jne 0x40b62a
mov edx, dword [ebx]
mov dword [esp], edx
mov ecx, dword [esp]
lea edx, [esi - 1]
test ebp, ebp
jbe 0x40b6a9
mov dword [esp], esi
xor edi, edi
test edx, edx
jl 0x40b67b
mov dword [esp + 4], ebp
xor esi, esi
xor ecx, ecx
movzx ebp, byte [edx + eax]
shl ebp, cl
add ecx, 8
or esi, ebp
add edx, 0xffffffff
js 0x40b66d
cmp ecx, 0x20
jl 0x40b658
mov ebp, dword [esp + 4]
mov dword [ebx + edi*4], esi
add edi, 1
cmp edi, ebp
jb 0x40b64c
mov esi, dword [esp]
test esi, esi
je 0x40b68c
mov byte [esi + eax - 1], 0
add esi, 0xffffffff
jne 0x40b682
movzx edx, byte [eax]
mov byte [esp], dl
movzx ecx, byte [esp]
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov eax, edi
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret 4
xor edi, edi
jmp 0x40b67e
push 0x10
push 0x4e3a0c
push 0x4e3a40
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp]
push 1
mov dword [esp + 4], eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [esp + 4]
add esp, 4
jmp 0x40b5b1
Function at 0x40bbd4
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4e3a0c
push dword [esp + 0xc]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop ecx
ret

Function at 0x40bbf4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x18
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x3c]
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
movzx edi, byte [esi + 5]
shl ebx, 8
or eax, ebx
movzx ebx, byte [esi + 2]
shl ebx, 0x10
or eax, ebx
movzx ebx, byte [esi + 3]
shl ebx, 0x18
or eax, ebx
movzx ebx, byte [esi + 4]
shl edi, 8
or ebx, edi
movzx edi, byte [esi + 6]
shl edi, 0x10
or ebx, edi
movzx edi, byte [esi + 7]
shl edi, 0x18
or ebx, edi
cmp ecx, 1
jb 0x40bd08
lea edi, [esp + 4]
mov dword [esp + 8], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp], eax
lea esi, [esp]
push 1
push dword [esp + 0x3c]
add ecx, 0xffffffff
push esi
mov dword [esp + 0x20], ecx
mov dword [edx], ebx
call fcn.0040ce14
mov ecx, dword [esp + 0x20]
add esp, 0xc
movzx edx, byte [ebp]
xor edx, dword [esp]
add ebp, 1
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov byte [esi], dl
add esi, 1
mov dword [esp + 0x10], esi
shr eax, 8
mov edi, ebx
shl edi, 0x18
or eax, edi
shr ebx, 8
mov dword [esp + 0xc], eax
shl edx, 0x18
or ebx, edx
cmp ecx, 1
jae 0x40bc61
mov edi, dword [esp + 8]
mov esi, dword [esp + 0x3c]
mov dword [edi], 0
mov byte [esi], al
mov edx, eax
shr edx, 8
mov byte [esi + 1], dl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 2], cl
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi + 4], bl
mov eax, ebx
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 6], al
shr ebx, 0x18
mov byte [esi + 7], bl
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret
lea edi, [esp + 4]
jmp 0x40bcc9
Function at 0x40bd10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x18
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x3c]
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
movzx edi, byte [esi + 5]
shl ebx, 8
or eax, ebx
movzx ebx, byte [esi + 2]
shl ebx, 0x10
or eax, ebx
movzx ebx, byte [esi + 3]
shl ebx, 0x18
or eax, ebx
movzx ebx, byte [esi + 4]
shl edi, 8
or ebx, edi
movzx edi, byte [esi + 6]
shl edi, 0x10
or ebx, edi
movzx edi, byte [esi + 7]
shl edi, 0x18
or ebx, edi
cmp ecx, 1
jb 0x40be2a
lea edi, [esp + 4]
mov dword [esp + 8], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp], eax
lea esi, [esp]
push 1
push dword [esp + 0x3c]
add ecx, 0xffffffff
push esi
mov dword [esp + 0x20], ecx
mov dword [edx], ebx
call fcn.0040ce14
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [esp + 0xc]
movzx edx, byte [ebp]
add ebp, 1
shr eax, 8
mov esi, ebx
shl esi, 0x18
or eax, esi
mov dword [esp + 0xc], eax
shr ebx, 8
mov edi, edx
shl edi, 0x18
or ebx, edi
xor edx, dword [esp]
mov eax, dword [esp + 0x10]
mov byte [eax], dl
add eax, 1
mov dword [esp + 0x10], eax
cmp ecx, 1
jae 0x40bd7d
mov edi, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x3c]
mov dword [edi], 0
mov byte [esi], al
mov edx, eax
shr edx, 8
mov byte [esi + 1], dl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 2], cl
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi + 4], bl
mov eax, ebx
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 6], al
shr ebx, 0x18
mov byte [esi + 7], bl
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
ret
lea edi, [esp + 4]
jmp 0x40bdeb
Function at 0x4138b4
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], 0x67452301
xor eax, eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x58], eax
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x41c314
Capabilities:
Encode data using xor

Disassembly:
push edi
push ebp
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x14]
mov dword [0x490384], 0
xor ecx, ecx
movzx edx, byte [eax + ecx + 8]
xor byte [eax + ecx], dl
mov edi, dword [0x490384]
lea ecx, [edi + 1]
mov dword [0x490384], ecx
cmp edi, 8
jb 0x41c32a
push 0x48fec0
push eax
call fcn.0041b1c8
add esp, 8
mov edx, 0x4903b4
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
xor eax, eax
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], eax
mov byte [ebp + 0x18], al
push 0x4903b4
push 0x48fec0
push dword [esp + 0x20]
push ebp
push dword [esp + 0x20]
call fcn.0040bbf4
add esp, 0x14
pop ebp
pop edi
ret

Function at 0x41c398
Capabilities:
Encode data using xor

Disassembly:
push edi
push ebp
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x14]
mov dword [0x490384], 0
xor ecx, ecx
movzx edx, byte [eax + ecx + 8]
xor byte [eax + ecx], dl
mov edi, dword [0x490384]
lea ecx, [edi + 1]
mov dword [0x490384], ecx
cmp edi, 8
jb 0x41c3ae
push 0x48fec0
push eax
call fcn.0041b1c8
add esp, 8
mov edx, 0x4903b4
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
xor eax, eax
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], eax
mov byte [ebp + 0x18], al
push 0x4903b4
push 0x48fec0
push dword [esp + 0x20]
push ebp
push dword [esp + 0x20]
call fcn.0040bd10
add esp, 0x14
pop ebp
pop edi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x405e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44e55b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4040f4
call fcn.00406a91
push 4
mov dword [esp + 0x18], 0
call fcn.0040766a
mov edi, eax
add esp, 4
test edi, edi
je 0x405ea4
push ebx
call fcn.00406969
mov dword [edi], eax
call fcn.00406728
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406a52
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405e98
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406a7a
pop ebx
jmp 0x405ea6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4080e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x451648]
jne 0x4080eb
repz ret
jmp fcn.0040c7dc
Function at 0x411c1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x451648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b34c
and dword [ebp - 0x14], 0
cmp dword [0x453f8c], 0
mov dword [ebp - 0x18], eax
jne 0x411ccf
push 0x403f00
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411d77
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403ef4
push ebx
call edi
test eax, eax
je 0x411d77
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403ee4
push ebx
mov dword [0x453f8c], eax
call edi
push eax
call esi
push 0x403ed0
push ebx
mov dword [0x453f90], eax
call edi
push eax
call esi
push 0x403eb4
push ebx
mov dword [0x453f94], eax
call edi
push eax
call esi
mov dword [0x453f9c], eax
test eax, eax
je 0x411ccf
push 0x403e9c
push ebx
call edi
push eax
call esi
mov dword [0x453f98], eax
mov eax, dword [0x453f98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411d28
cmp dword [0x453f9c], ecx
je 0x411d28
push eax
call esi
push dword [0x453f9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411d28
test ebx, ebx
je 0x411d28
call edi
test eax, eax
je 0x411d1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411d1f
test byte [ebp - 8], 1
jne 0x411d28
or dword [ebp + 0x10], 0x200000
jmp 0x411d5b
mov eax, dword [0x453f90]
cmp eax, dword [ebp - 0x18]
je 0x411d5b
push eax
call esi
test eax, eax
je 0x411d5b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411d5b
mov eax, dword [0x453f94]
cmp eax, dword [ebp - 0x18]
je 0x411d5b
push eax
call esi
test eax, eax
je 0x411d5b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x453f8c]
call esi
test eax, eax
je 0x411d77
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411d79
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004080e1
leave
ret
Function at 0x44cf60
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0x7d7ce4], 0x37
jne 0x44cffb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
lea ecx, [esp + 0x410]
push ecx
push 0
push 0x403f80
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov edx, dword [0x7d8cd8]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x458d34]
mov byte [edx + esi], cl
add esp, 0x80c
ret