joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4594e8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459693
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x459674
mov dl, 1
mov eax, dword [0x412f08]
call fcn.00403574
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043b4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x459663
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004473dc
test al, al
je 0x459656
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4596a4
lea eax, [ebp - 0x254]
call fcn.004098dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x459656
xor eax, eax
push ebp
push 0x45964f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4596dc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x459638
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404624
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x459638
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459656
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x459559
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00417784
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45969a
lea eax, [ebp - 0x260]
call fcn.004043b4
ret

Function at 0x459fdc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a4b7c]
cmp byte [eax + 0xa5], 0
jne 0x45a04d
cmp dword [0x4a4b94], 0
jne 0x45a00e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x459f98
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a4b94], eax
cmp dword [0x4a4b90], 0
jne 0x45a029
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a4b90], eax
cmp dword [0x4a4b98], 0
jne 0x45a04d
push esp
push 0
push 0
push 0x459f3c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a4b98], eax
pop edx
ret
Function at 0x45a6e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a4b7c]
cmp dword [eax + 0x30], 0
je 0x45a78a
cmp dword [ebx + 0x94], 0
jne 0x45a784
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a670
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45a784
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45a74a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45a784
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414f70
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45a759
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b2e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45b31d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044a4
jmp 0x45b32a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404408
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c454
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c495
mov eax, esi
call fcn.00442974
test al, al
je 0x45c495
mov eax, dword [ebx + 0x84]
call fcn.00442670
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c495
push 0
mov eax, dword [ebx + 0x84]
call fcn.00442670
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46b468
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x46b470
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x46b60c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 8]
mov edx, 0x46b624
mov eax, esi
call fcn.004692f0
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xc]
call fcn.00404408
lea ecx, [ebp - 0xc]
mov edx, 0x46b638
mov eax, esi
call fcn.004692f0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x28]
call fcn.00404408
lea ecx, [ebp - 0x10]
mov edx, 0x46b650
mov eax, esi
call fcn.004692f0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x10]
call fcn.00404408
lea ecx, [ebp - 0x14]
mov edx, 0x46b66c
mov eax, esi
call fcn.004692f0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x14]
call fcn.00404408
lea ecx, [ebp - 0x18]
mov edx, 0x46b688
mov eax, esi
call fcn.004692f0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x24]
call fcn.00404408
lea ecx, [ebp - 0x20]
mov edx, 0x46b6a0
mov eax, esi
call fcn.004692f0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408740
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
call fcn.00408cdc
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x24]
mov edx, 0x46b6b8
mov eax, esi
call fcn.004692f0
mov eax, dword [ebp - 0x24]
call fcn.00462a10
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x28]
mov edx, 0x46b6c8
mov eax, esi
call fcn.004692f0
mov eax, dword [ebp - 0x28]
call fcn.00462a10
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 4]
mov edx, 0x46b6e0
mov eax, esi
call fcn.004692f0
mov eax, dword [ebp - 4]
call fcn.004625c4
test al, al
je 0x46b5c3
mov eax, dword [ebp - 4]
call fcn.00408ca0
mov edi, eax
test edi, edi
jl 0x46b5b9
call fcn.0040a5bc
mov dword [ebp - 0x2c], edi
fild dword [ebp - 0x2c]
fdiv dword [0x46b6e8]
faddp st(1)
fstp qword [ebx + 0x38]
wait
jmp 0x46b5cf
xor eax, eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
jmp 0x46b5cf
mov eax, dword [ebp - 4]
call fcn.00462a10
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x46b6f4
mov eax, esi
call fcn.004692f0
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x48]
call fcn.00404408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b613
lea eax, [ebp - 0x30]
call fcn.004043b4
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004043d8
ret

Function at 0x47285c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4728b6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047284c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004613dc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00460fdc
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4728bd
lea eax, [ebp - 4]
call fcn.004043b4
ret
Function at 0x4786d8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4788f5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4a39c4]
cmp dword [eax], 1
jne 0x4788c7
mov eax, dword [esi + 0x48]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x478908
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete bl
test bl, bl
je 0x478769
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x478938
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete bl
test bl, bl
je 0x478892
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
cmp dword [ebp - 0x14], 0
je 0x478892
lea eax, [ebp - 0x10]
mov ecx, 0x21
xor edx, edx
call fcn.004044a4
mov edi, dword [ebp - 0x14]
sub edi, 1
jno 0x4787c4
call fcn.004034e0
test edi, edi
jl 0x478892
inc edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0x21
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404874
push eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jns 0x4787fc
call fcn.004034d8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x10]
call fcn.00404874
mov edx, eax
lea eax, [ebp - 0x12c]
call fcn.00403018
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x2c]
call fcn.00404618
push dword [ebp - 0x2c]
push 0x478954
push 0x478960
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404734
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404874
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x478888
mov eax, dword [ebp - 0x10]
call fcn.00404874
mov edx, eax
lea eax, [ebp - 0x130]
call fcn.004045ac
mov edx, dword [ebp - 0x130]
mov eax, dword [esi + 0x48]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x1c]
dec edi
jne 0x4787d4
cmp dword [ebp - 4], 0
je 0x4788a1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 8], 0
je 0x4788b0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esi + 0x48]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4788c7
mov eax, dword [esi + 0x48]
mov edx, dword [eax]
call dword [edx + 0x90]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4788fc
lea eax, [ebp - 0x130]
call fcn.004043b4
lea eax, [ebp - 0x2c]
call fcn.004043b4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004043d8
ret
Function at 0x47b6f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x47b722
cmp dword [ebx + 0x64], 0
jne 0x47b722
cmp dword [ebx + 0x6c], 0
jne 0x47b722
mov edi, esi
jmp 0x47b7a9
cmp edi, 0xffffffff
jne 0x47b72a
dec edi
jmp 0x47b7a9
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x47b7a9
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0047aaec
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x47b777
mov cx, word [esp]
sub cx, si
jmp 0x47b779
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x47b760
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x47b79f
mov cx, word [esp]
sub cx, si
jmp 0x47b7a1
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x47b788
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x47b806
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0047b494
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x47b7f1
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x47b806
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x47b702
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x481a78
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4a4f64
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x481a9a
shr eax, 1
xor eax, 0xedb88320
jmp 0x481a9c
shr eax, 1
dec edx
jne 0x481a88
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x481a81
mov byte [0x4a5364], 1
pop esi
pop ebx
ret

Function at 0x481ab8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4a5364], 0
jne 0x481acf
call fcn.00481a78
mov eax, edi
sub eax, 1
jno 0x481adb
call fcn.004034e0
test eax, eax
jl 0x481b01
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a4f64]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x481ae2
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x48b2c8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48b2f6
mov eax, ebx
call fcn.0048bd7c
cmp dword [ebx + 0x40], 0
je 0x48b2ef
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48b367
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x48b359
cmp dword [ebx + 8], 0
je 0x48b318
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48b32a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48b359
cmp dword [ebx + 8], 0
je 0x48b30b
cmp eax, 3
je 0x48b33d
dec eax
jne 0x48b30b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48b30b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48b30b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x48b385
cmp dword [ebx + 0x14], 0xcc
je 0x48b385
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048b390
pop ebx
ret

Function at 0x49c06c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.004043b4
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040945c
add esp, 0x18
pop ebx
ret
Function at 0x403555
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40228
call fcn.004184f0
mov eax, dword [0x423018]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40218]
xor ebx, ebx
mov dword [ebp - 0x40214], 1
push ebx
push eax
mov esi, ecx
lea eax, [ebp - 0x4020c]
push 0x200
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403768
cmp dword [ebp - 0x40218], 0x200
jne 0x403768
push 4
lea eax, [ebp - 0x4010b]
push 0x41fd94
push eax
call fcn.00418874
add esp, 0xc
test eax, eax
jne 0x4035d7
inc eax
mov byte [edi], al
jmp 0x40376a
push 5
lea eax, [ebp - 0x4010b]
push str.ustar
push eax
call fcn.00418874
add esp, 0xc
test eax, eax
jne 0x403768
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.00402f7a
add eax, 0x10
lea ecx, [ebp - 0x40210]
push 0x41fdc8
mov dword [ebp - 0x40210], eax
call fcn.0040377b
lea eax, [ebp - 0x4020c]
push eax
lea ecx, [ebp - 0x40210]
call fcn.0040377b
push ebx
push pe_nt_image_headers32
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x40210]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40224], eax
cmp eax, 0xffffffff
je 0x403759
push 8
lea eax, [ebp - 0x40190]
push ebx
push eax
call fcn.00419ad4
add esp, 0xc
mov dword [ebp - 0x40220], eax
push 1
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x40220]
mov edi, ecx
neg edi
add eax, ecx
and edi, 0x1ff
add edi, eax
test ecx, ecx
je 0x403706
mov eax, 0x40000
mov dword [ebp - 0x4021c], eax
cmp ecx, eax
jae 0x4036a8
mov eax, ecx
mov dword [ebp - 0x4021c], ecx
push ebx
lea ecx, [ebp - 0x40218]
push ecx
push eax
lea eax, [ebp - 0x4000c]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403700
push ebx
lea eax, [ebp - 0x40218]
push eax
push dword [ebp - 0x4021c]
lea eax, [ebp - 0x4000c]
push eax
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403700
mov ecx, dword [ebp - 0x40220]
sub ecx, dword [ebp - 0x4021c]
mov dword [ebp - 0x40220], ecx
jne 0x403691
jmp 0x403706
mov byte [ebp - 0x40214], bl
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x40214], bl
je 0x403742
cmp byte [esi + 8], bl
je 0x40372e
lea eax, [ebp - 0x40210]
push eax
lea ecx, [esi + 0xc]
call fcn.0040293d
mov eax, dword [esi + 0x18]
test eax, eax
je 0x403742
push dword [ebp - 0x40210]
push dword [esi + 0x1c]
call eax
pop ecx
pop ecx
cmp edi, 0xffffffff
je 0x403753
push ebx
push ebx
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov bl, byte [ebp - 0x40214]
lea ecx, [ebp - 0x40210]
call fcn.00402f5f
mov al, bl
jmp 0x40376a
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407182
leave
ret 4
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0xa0d0ae2
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x14214338
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401d60
Capabilities:
Encode data using xor
Hash data using murmur2
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
mov eax, dword [0x433010]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
mov ebx, dword [0x437a00]
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x1c], edx
mov eax, dword [ebx + 0x3c]
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
add ecx, ebx
mov dword [esp + 0x28], ecx
add eax, ebx
mov dword [esp + 0x14], eax
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x401f3a
mov edx, dword [eax]
xorps xmm0, xmm0
add edx, ebx
mov dword [esp + 0x3c], 0
mov eax, edx
mov dword [esp + 0x40], 0
movups xmmword [esp + 0x2c], xmm0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401dd1
sub eax, esi
lea ecx, [esp + 0x2c]
push eax
push edx
call 0x404300
mov edi, dword [esp + 0x3c]
lea ebx, [esp + 0x2c]
mov esi, edi
xor esi, 0x36c
cmp dword [esp + 0x40], 0x10
cmovae ebx, dword [esp + 0x2c]
push ebx
shr edi, 2
push edi
push 0x430560
call fcn.004010e0
add esp, 0xc
xor edx, edx
test edi, edi
je 0x401e41
nop word [eax + eax]
imul ecx, dword [ebx + edx*4], 0x5bd1e995
inc edx
imul esi, esi, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor esi, ecx
cmp edx, edi
jl 0x401e20
mov eax, dword [esp + 0x3c]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x401e6b
sub eax, 1
je 0x401e61
sub eax, 1
jne 0x401e79
movsx ecx, byte [ebx + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [ebx + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [ebx + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e995
xor esi, eax
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
cmp eax, dword [esp + 0x20]
je 0x401ee9
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
add eax, 4
mov dword [esp + 0x14], eax
cmp ecx, 0x10
jb 0x401ed8
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401eca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401f53
push ecx
push edx
call 0x407029
mov eax, dword [esp + 0x1c]
add esp, 8
mov ebx, dword [esp + 0x18]
inc ebp
cmp ebp, dword [esp + 0x24]
jb 0x401db0
jmp 0x401f3a
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + ebx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x40]
cmp ecx, 0x10
jb 0x401f3a
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401f30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401f53
push ecx
push edx
call 0x407029
add esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
add eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call 0x406fe6
add esp, 0x3c
ret
call 0x40e2fd
int3