joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x43c08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
push 2
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x401eba
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call edi
test eax, eax
je 0x401f1a
nop dword [eax]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00413e4c
add esp, 8
test eax, eax
je 0x401f0e
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call edi
test eax, eax
jne 0x401ee0
jmp 0x401f1a
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040afb3
mov esp, ebp
pop ebp
ret

Function at 0x404460
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428b0b
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push esi
mov eax, dword [0x43c08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00404a40
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc4]
push dword [ebp + 8]
call fcn.00404940
mov byte [esi], 0
lea eax, [ebp - 0xc4]
push eax
mov ecx, esi
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call sym.YZAgentService.exe_public:_void___thiscall_MD5::update_class_std::basic_istream_char__struct_std::char_traits_char____
lea ecx, [ebp - 0xb4]
call fcn.00406340
test eax, eax
jne 0x404524
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403670
mov ecx, esi
call sym.YZAgentService.exe_public:_class_MD5____thiscall_MD5::finalize_void_
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc4], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xc8], eax
lea ecx, [ebp - 0xb4]
call fcn.00405720
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc4], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xc8], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x54], vtable.std::ios_base.0
call fcn.0040a4ef
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404650
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428b3b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
push esi
push edi
mov eax, dword [0x43c08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push ecx
lea ecx, [ebp - 0xcc]
call fcn.00404a40
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xcc]
push dword [ebp + 0xc]
call fcn.00404940
cmp dword [ebp - 0x70], 0
mov eax, dword [ebp + 0x10]
jne 0x404738
mov ecx, dword [ebp + 8]
push 0x437ee4
mov dword [eax], 0xffffffff
call fcn.00402210
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xcc], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xd0], eax
lea ecx, [ebp - 0xbc]
call fcn.00405720
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xcc], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax + 4]
lea ecx, [edx - 0x18]
mov dword [ebp + edx - 0xd0], ecx
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x5c], vtable.std::ios_base.0
call fcn.0040a4ef
mov eax, dword [ebp + 8]
jmp 0x404837
mov dword [eax], 0
mov ecx, edi
mov byte [edi], 0
lea eax, [ebp - 0xcc]
push eax
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0x67452301
mov dword [edi + 0x50], 0xefcdab89
mov dword [edi + 0x54], 0x98badcfe
mov dword [edi + 0x58], 0x10325476
call sym.YZAgentService.exe_public:_void___thiscall_MD5::update_class_std::basic_istream_char__struct_std::char_traits_char____
lea ecx, [ebp - 0xbc]
call fcn.00406340
test eax, eax
jne 0x4047b3
mov eax, dword [ebp - 0xcc]
lea ecx, [ebp - 0xcc]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403670
mov ecx, edi
call sym.YZAgentService.exe_public:_class_MD5____thiscall_MD5::finalize_void_
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
call sym.YZAgentService.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_MD5::hexdigest_void_
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xcc], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xd0], eax
lea ecx, [ebp - 0xbc]
call fcn.00405720
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xcc], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax + 4]
lea ecx, [edx - 0x18]
mov dword [ebp + edx - 0xd0], ecx
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x5c], vtable.std::ios_base.0
call fcn.0040a4ef
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x404fbb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004059a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x404fdd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x404fdf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x405063
jg 0x404ff4
test esi, esi
je 0x405063
test ecx, ecx
jl 0x40503d
jg 0x404ffe
test eax, eax
je 0x40503d
cmp edi, ecx
jg 0x405012
jl 0x405008
cmp esi, eax
jae 0x405012
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.0040c4e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x405040
mov edx, dword [ebp + 8]
test edi, edi
jl 0x405063
jg 0x40504a
test esi, esi
je 0x405063
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x405063
push eax
push esi
push 1
push edx
call fcn.0041382e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4050ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405a80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4050cd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4050cf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x40516e
jg 0x4050ec
test esi, esi
je 0x40516e
test ecx, ecx
jl 0x405139
jg 0x4050f6
test eax, eax
je 0x405139
cmp ebx, ecx
jg 0x40510a
jl 0x405100
cmp esi, eax
jae 0x40510a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0040c4e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x405140
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x40516e
jg 0x40514a
test esi, esi
je 0x40516e
cmp dword [edi + 0x4c], 0
je 0x40516e
mov ecx, edi
call fcn.004060d0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0041319a
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x43c08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4055b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4055ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4055ec
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4056b8
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x405614
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405647
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00412eca
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x4056ce
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00403840
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4056a8
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041382e
add esp, 0x10
cmp edi, eax
jne 0x4056b8
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4055d7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040afb3
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4056b8
cmp eax, 1
jle 0x40568b
cmp eax, 3
jne 0x4056b8
jmp 0x405660
Function at 0x406190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43c08c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x406227
cmp byte [esi + 0x3d], 0
je 0x406227
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4061e0
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x406239
lea edi, [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x28], edi
sub eax, 0
je 0x4061f2
sub eax, 1
je 0x4061f6
sub eax, 2
je 0x406227
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
lea eax, [ebp - 0x24]
sub edi, eax
je 0x406210
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041382e
add esp, 0x10
cmp edi, eax
jne 0x4061e0
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
mov edi, dword [ebp - 0x28]
jmp 0x4061d1
Function at 0x408610
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x43c08c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x606]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x408812
cmp eax, 0x200
je 0x408812
mov ecx, 0x22
mov word [ebp - 0x608], cx
mov word [ebp + eax*2 - 0x606], cx
lea eax, [eax*2 + 4]
cmp eax, 0x404
jae 0x408837
push edi
xor ecx, ecx
push 0xf003f
push ecx
push ecx
mov word [ebp + eax - 0x608], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4086d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x200
lea ecx, [ebp - 0x204]
push ecx
push eax
call fcn.00401190
lea eax, [ebp - 0x204]
push eax
push 0x42a558
push 1
push dword [0x43cf80]
call fcn.00407770
add esp, 0x1c
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 0
push 0x42a594
push 0
push 0
lea eax, [ebp - 0x608]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x42a598
push section..data
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
jne 0x408757
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x200
lea ecx, [ebp - 0x204]
push ecx
push eax
call fcn.00401190
lea eax, [ebp - 0x204]
push eax
push str._Install_
push 1
push dword [0x43cf80]
call fcn.00407770
add esp, 0x1c
xor eax, eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea eax, [ebp - 0x624]
push eax
push 1
push ebx
mov dword [ebp - 0x624], 0x42a598
call esi
lea eax, [ebp - 0x620]
mov dword [ebp - 0x638], 0x1c20
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x638]
push eax
push 2
push ebx
mov dword [ebp - 0x62c], 3
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x61c], 0x493e0
mov dword [ebp - 0x618], 1
mov dword [ebp - 0x614], 0x493e0
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x60c], 0
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
push str._Install_GetModuleFileName
push 1
push dword [0x43cf80]
call fcn.00407770
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
call fcn.0040afb3
mov esp, ebp
pop ebp
ret
call fcn.0040b108
int3
Function at 0x41bf66
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041bde5

Function at 0x421382
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421042

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3eb21807
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1e870aea
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x4dba3e
Capabilities:
Encode data using xor

Disassembly:
pop eax
sar byte [ebx + 0xdb6114d], 0xdb
sub eax, dword [eax + 0x76]
pop ds
Function at 0x4036e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403741
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403724
cmp edi, 2
jb 0x403724
cmp byte [esi], cl
jne 0x403724
cmp byte [esi + 1], cl
jne 0x403724
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4e8150]
jmp 0x4036f5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4e8150]
test edi, edi
jne 0x4036f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403770
cmp cl, 0x23
jne 0x403757
cmp byte [esi], cl
jne 0x403757
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4e8150]
test cl, cl
jne 0x403748
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403880
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x403893
mov dword [ebx], 0
mov edx, 0x4e7d8c
call fcn.00403780
mov esi, eax
test esi, esi
je 0x403970
push esi
call fcn.004aa3d4
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x403967
push 2
push 0
push esi
call fcn.004aad71
add esp, 0xc
test eax, eax
jne 0x403967
push esi
call fcn.004aa3d4
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x403967
push 0
push dword [ebp + 8]
push esi
call fcn.004aad71
add esp, 0xc
test eax, eax
jne 0x403967
mov eax, dword [0x536900]
test eax, eax
je 0x403906
inc dword [eax + 0xb0]
push edi
call fcn.004b32d9
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x403967
push esi
push edi
push 1
push eax
call fcn.004ae65d
add esp, 0x10
push esi
cmp eax, edi
je 0x403951
call fcn.004aaa1e
mov eax, dword [0x536900]
add esp, 4
test eax, eax
je 0x40393f
dec dword [eax + 0xb0]
push dword [ebp + 8]
call fcn.004ae469
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.004aaa1e
add esp, 4
test ebx, ebx
je 0x40395f
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.004aaa1e
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x409870
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x4098ad
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x409893
cmp byte [esi], bl
jne 0x409893
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x4e8150]
test bl, bl
jne 0x409884
pop edi
pop esi
not ecx
pop ebx
jmp fcn.00409810
Function at 0x4172c0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x536900]
test bl, bl
je 0x417306
or edi, 0xffffffff
cmp bl, 0x23
jne 0x4172e7
cmp byte [esi], bl
jne 0x4172e7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4e8150]
test bl, bl
jne 0x4172d8
mov edi, dword [0x536900]
mov esi, dword [edi + 0x5a00]
xor ecx, ecx
not eax
test esi, esi
jle 0x41732c
mov edi, dword [edi + 0x5a08]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x417332
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x417320
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x421cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x421cf6
mov eax, dword [0x536900]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x421ce6
dec dword [eax + 0xb0]
push ecx
call fcn.004ae469
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x421d2a
mov eax, dword [0x536900]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x421d1a
dec dword [eax + 0xb0]
push ecx
call fcn.004ae469
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x421d5e
mov eax, dword [0x536900]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x421d4e
dec dword [eax + 0xb0]
push ecx
call fcn.004ae469
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x421dae
mov eax, dword [0x536900]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x421d9e
dec dword [eax + 0xb0]
push ecx
call fcn.004ae469
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x421de2
mov eax, dword [0x536900]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x421dd2
dec dword [eax + 0xb0]
push ecx
call fcn.004ae469
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x421e16
mov eax, dword [0x536900]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x421e06
dec dword [eax + 0xb0]
push ecx
call fcn.004ae469
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00424800