joyce8/EMBER2024-capa huggingface dataset:
Function at 0x80f350
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb9e834]
sub esp, 0x434
push ebx
push ebp
push esi
mov esi, dword [0x81f884]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x80f549
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x80f386
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0xb9e834], 0x1c
jne 0x80f39d
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x816700]
mov ebx, dword [0x816708]
mov ebp, dword [0x81670c]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x816704]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x80f3e6
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0xb9e7a4], edi
mov eax, dword [esp + 0x1c]
add dword [0xb9e7a4], eax
mov eax, dword [0xb9e7a4]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0xb9e834], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x80f47d
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0xb9e834], 0x979
mov dword [0xb9e7a8], 0xff6b3619
mov dword [0xb9e7ac], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x80f4c1
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0xb9e834]
cmp eax, 0x93
je 0x80f4e7
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x80f3e0
cmp eax, 0x8d4
jne 0x80f4fe
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], eax
cmp dword [0xb9e834], 0x17
jne 0x80f538
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea ecx, [esp + 0x40]
push ecx
push 0x404250
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x80f380
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x434
ret
Function at 0x403520
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45a008], 0x8088405
inc edx
mov dword [ebx + 0x45a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41bb28
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41bb7b
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov esi, ebx
push esi
call fcn.004072e4
test eax, eax
jne 0x41bb71
cmp word [esi], 0x5a4d
jne 0x41bb71
lea eax, [ebx + 0x3c]
add ebx, dword [eax]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x41bb71
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41bb8a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41e944
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + ebx*2 + 0x42], dh
add al, cl
inc edx
inc ecx
add byte [eax - 0x5bffbde9], bl
pop eax
inc edx
add byte [eax], bl
inc esp
inc ecx
add byte [eax], ch
pop ss
inc edx
add byte [ecx + ebx*2], al
inc edx
add ah, ah
pop ss
inc edx
add byte [ecx + ebx*2 + 0x42], al
add byte [eax + 0x59], dh
inc edx
add byte [ecx + ebx], ch
inc edx
add byte [eax], dh
sbb dword [edx], eax
test byte [ecx + 0x42], bl
add byte [eax + 0x8004219], dh
pop esp
inc edx
add byte [edx + ebx], dl
inc edx
add byte [eax], ah
pop esp
inc edx
add byte [esp + ebx*2], ah
inc edx
add byte [eax], ch
sbb al, byte [edx]
and byte [eax + 0x42], bl
add byte [ecx + ebx], dh
inc edx
add byte [ecx + ebx + 0x5ac40042], bh
inc edx
add byte [esp + ebx*2], bh
inc edx
add byte [esp + ebx*2 + 0x42], ah
add byte [eax + 0x5c], bh
inc edx
add byte [0x6f634954], al
outsb dx, byte [esi]
mov eax, eax
mov ah, 0xe8
inc ecx
add byte [edi], al
add eax, 0x6f634954
outsb dx, byte [esi]
inc esp
call 0xe3b9e902
inc ecx
add byte [eax], al
add byte [eax], cl
inc edi
jb 0x41e92a
jo 0x41e933
imul esp, dword [ebx + 0x73], 0xc0850000
add byte [ebp + 0x3b0e74c0], al
add eax, 0x45d914
je 0x41e8e2
cmp eax, dword [0x45d914]
je 0x41e8e2
push eax
call fcn.0040749c
ret
inc eax
add byte [ecx + ebp*8 + 0x54100041], dl
push edx
jae 0x41e9a5
jne 0x41e9aa
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x41e8cf
inc eax
add byte [ecx + 0x31c289d1], cl
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e94a
ret
xchg esi, edi
inc dword [ebx + ebx*8 - 0x3974f882]
jle 0x41e9b3
mov eax, esi
call fcn.00404340
pop esi
pop ebx
ret
Function at 0x470641
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x47065e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x47064f
add dl, dl
jne 0x470669
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4706b5
xor eax, eax
add dl, dl
jne 0x470676
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x470752
add dl, dl
jne 0x470685
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x470690
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47069b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4706a6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4706b0
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x470655
mov eax, 1
add dl, dl
jne 0x4706c3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4706ce
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4706ba
sub eax, 2
jne 0x4706fd
mov ecx, 1
add dl, dl
jne 0x4706e3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4706ee
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4706da
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x470655
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x470714
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x47071f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x47070b
cmp eax, 0x7d00
jae 0x470742
cmp eax, 0x500
jb 0x47073d
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x470655
cmp eax, 0x7f
ja 0x470745
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x470655
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x47076e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x470655
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40ed58
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x40eae0
call fcn.0040ed7a
sub eax, 0xd3f46fa9
xor dword [ecx], edi
add eax, 0x5bbd4bb2
inc ecx
cmp ecx, edx
jne fcn.0040ed58
mov esi, esi
ret
Function at 0x4021b2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov cl, byte [0x404050]
mov edx, eax
mov ebx, eax
shl edx, cl
mov eax, 0x404054
add edx, dword [0x404050]
call fcn.004020f3
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x4039aa
push eax
sub edi, fcn.00403144
push edi
push fcn.00403144
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x402229
mov eax, fcn.00403144
mov ebx, esi
mov edx, edi
call fcn.004020f3
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00402d42
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
call fcn.0040151f
lea eax, [esi + 0x1c000]
lea edi, [esi + 1]
imul edi, eax
mov ebx, 0x404054
or bl, 1
xor edx, edx
mov eax, esi
div ebx
lea ebx, [ebp - 2]
add eax, 0x404054
mov edx, edi
call fcn.00403144
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438c9b
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
mov edx, dword [esp]
add esp, 4
and ecx, ecx
call fcn.00438cda
add eax, eax
add ecx, 0xdf4779a8
xor dword [ebx], edx
inc eax
mov ecx, 0xfa7c5bca
inc ebx
add ecx, eax
sub eax, ecx
add eax, 1
cmp ebx, edi
jne fcn.00438c9b
add eax, eax
add ecx, 0x8246656f
inc eax
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40897d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add ecx, 0x8f6119bd
sub ecx, ecx
call fcn.0040899f
add ecx, ecx
sub esi, 0x5b9420da
xor dword [eax], edi
inc eax
cmp eax, edx
jne fcn.0040897d
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x398f1c97
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1a78626d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401cca
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov esi, ebx
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x1d
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xa4
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x4f
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xef
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x91
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x2c
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x74
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x31
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x59
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x52
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x34
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x68
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xae
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x8e
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xe
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 7
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x35
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x41
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x33
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x19
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xd5
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x40
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x9f
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x63
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x16
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x8e
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x6b
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 3
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x3a
inc esi
cmp esi, 0x37000
jb 0x401cd7
pop edi
pop esi
pop ebx
ret
Function at 0x401e44
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x10]
mov edi, dword [eax]
mov ebp, edi
xor ebp, 0x14d
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x14], 0x10
jb 0x401e66
mov esi, dword [esi]
shr edi, 2
xor ebx, ebx
mov dword [esp + 0x18], edi
test edi, edi
je 0x401ec3
mov dword [esp + 0x14], edi
mov edi, esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
push 4
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00408b60
imul ecx, dword [esp + 0x1c], 0x5bd1e991
add esp, 0xc
imul ebp, ebp, 0x5bd1e991
add edi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov dword [esp + 0x10], eax
sub dword [esp + 0x14], 1
jne 0x401e79
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
and eax, 3
sub eax, 1
je 0x401ee9
sub eax, 1
je 0x401edf
sub eax, 1
jne 0x401ef7
movsx ebx, byte [esi + edi*4 + 2]
shl ebx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ebx, eax
movsx eax, byte [esi + edi*4]
xor eax, ebx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov eax, ebp
shr eax, 0xd
xor eax, ebp
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0x10
ret

Function at 0x401f13
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x435018]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x46f000]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x401f82
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.0040249c
test esi, esi
je 0x401f6f
lea ecx, [esp + 0x1c]
call fcn.00401e44
test eax, eax
je 0x401f6f
cmp eax, dword [esp + 0x14]
je 0x401f9a
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00402d5a
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x401f4a
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407f54
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00402d5a
jmp 0x401f84
Function at 0x4021e5
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x435018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Cleared
call fcn.00401176
pop ecx
call fcn.00403975
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
clc
jae 0x402219
call 0x63dab8
add byte [eax], al
mov eax, 0x23
cmp eax, 0x100
jl 0x402227
call 0x3dcb871f
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x46f000], eax
stc
jb 0x402245
call 0x541b554b
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_WindowFromDC]
push 8
call fcn.00407f62
pop ecx
push 4
mov edi, eax
call fcn.00407f62
pop ecx
lea esi, [edi + 4]
push esi
push ebx
push eax
push 0x4044bf
push ebx
push ebx
mov dword [eax], 0x4021d8
call fcn.0040c76b
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x40232a
mov ecx, edi
call fcn.00401c8b
push 0xc
mov dword [ebp - 0x10], 0x422e28f6
mov dword [ebp - 0xc], 0x440762a0
mov dword [ebp - 8], 0x3f443958
call fcn.00404461
pop ecx
mov edi, eax
lea eax, [ebp - 0x10]
push 0xc
push eax
push edi
lea esi, [edi + 0xc]
call fcn.00408b60
add esp, 0xc
push 3
call fcn.00402334
push eax
call fcn.00403b38
lea eax, [edi + 0xc]
mov dl, bl
pop ecx
cmp edi, eax
je 0x402307
mov esi, edi
lea ebx, [edi + 0xc]
movss xmm0, dword [esi]
mov cl, dl
comiss xmm0, dword [0x4327e8]
lea eax, [ecx + 1]
movzx edx, al
movzx eax, cl
cmovbe edx, eax
add esi, 4
cmp esi, ebx
jne 0x4022d9
lea esi, [edi + 0xc]
push 0
pop ebx
cmp dl, 5
jbe 0x402307
or ebx, 0xffffffff
test edi, edi
je 0x402319
sub esi, edi
and esi, 0xfffffffc
push esi
push edi
call fcn.00403f7c
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407f54
leave
ret
push 6
mov dword [esi], ebx
call fcn.004047b5
int3
Function at 0x404940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x40139c
call fcn.004059a0
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3