joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aeb0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000aeb9
ret
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x10010707
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10010716
pop dword [ebp - 0x20]
mov eax, 0x19e5870e
add eax, 0xf61b8008
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x39675
push 0
mov eax, 0x225c7aaa
add eax, 0xeda566b2
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xdc4d19db
add ecx, 0x23b32833
mov esi, eax
mov edx, 0x1002e200
add edx, dword [ebp - 0x20]
mov edi, 0xcb908da2
add dword [ebp - 0x18], 0xefb95adb
mov ebx, dword [edx]
xor dword [ebp - 0x14], esi
xor ebx, edi
add dword [ebp - 0x14], esi
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x55d81527
add esi, 0xb6ff6900
add esi, 0x49009704
add edx, 4
loop 0x10010769
add eax, 0xd994c08f
add eax, 0x266c3a7c
mov ebx, eax
add eax, 0x6fca7068
add eax, 0x90358f9d
mov ecx, 0x352c5ea3
sub ecx, 0x252c5ea3
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x406ee2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov edx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x3c]
mov ecx, ebx
push ebp
push esi
neg ecx
mov dword [esp + 0x10], 1
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
xor ebp, ebp
mov dword [esp + 0x10], edi
xor esi, esi
lea eax, [edi + ecx]
bts ebp, eax
cmp eax, 0x20
cmovae esi, ebp
xor ebp, esi
cmp eax, 0x40
mov eax, dword [esp + 0x40]
cmovae esi, ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], esi
call fcn.0040c350
mov ecx, eax
add ebp, 0xffffffff
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], ebp
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], ecx
push eax
mov edx, esi
lea eax, [ebx + 0x40]
adc edx, 0xffffffff
and ebp, dword [esp + 0x48]
mov dword [esp + 0x38], edx
and edx, dword [esp + 0x4c]
push eax
push ecx
mov dword [esp + 0x2c], edx
call fcn.00406409
mov ecx, dword [esp + 0x70]
add esp, 0x10
mov ebx, dword [esp + 0x5c]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x50]
mov dword [ecx], eax
mov dword [ebx], edi
cmp dword [ecx], edi
mov edi, dword [esp + 0x20]
push 0xa
pop edx
jle 0x406fc0
mov eax, dword [esp + 0x18]
xor edx, edx
div edi
mov ecx, dword [ebx]
mov dword [esp + 0x18], edx
lea edx, [eax + 0x30]
mov eax, dword [esp + 0x54]
mov byte [eax + ecx], dl
mov ecx, dword [esp + 0x60]
inc dword [ebx]
dec dword [ecx]
sub esi, 1
je 0x406fc4
mov eax, edi
xor edx, edx
push 0xa
pop edi
div edi
cmp dword [ecx], 0
mov edi, eax
jg 0x406f88
push 0xa
pop edx
test esi, esi
jne 0x406ff8
mov esi, dword [esp + 0x24]
xor eax, eax
push ecx
inc eax
neg esi
push 0
push eax
mov eax, edi
xor edx, edx
mov ecx, esi
call fcn.0040c570
push edx
push eax
mov eax, dword [esp + 0x2c]
xor edx, edx
mov ecx, esi
call fcn.0040c570
add eax, ebp
adc edx, dword [esp + 0x30]
push edx
push eax
jmp 0x407084
mov edi, dword [esp + 0x1c]
jle 0x407069
cmp edi, dword [esp + 0x10]
jb 0x407069
ja 0x40700e
mov eax, dword [esp + 0x14]
cmp ebp, eax
jbe 0x407069
push 0
push edx
push edi
push ebp
call fcn.0040c180
push 0
push 0xa
mov ebp, eax
mov edi, edx
pop eax
push eax
push dword [esp + 0x18]
push dword [esp + 0x20]
call fcn.0040c180
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
neg ecx
mov dword [esp + 0x10], edx
mov eax, ebp
mov edx, edi
call fcn.0040c350
mov edx, dword [ebx]
add al, 0x30
mov ecx, dword [esp + 0x54]
and ebp, dword [esp + 0x2c]
and edi, dword [esp + 0x30]
push 0xa
mov byte [ecx + edx], al
mov ecx, dword [esp + 0x64]
inc dword [ebx]
dec esi
pop edx
dec dword [ecx]
test esi, esi
jg 0x406ffe
test esi, esi
je 0x407071
xor al, al
jmp 0x407096
push ecx
push dword [esp + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x40]
push dword [esp + 0x48]
push edi
push ebp
push dword [ebx]
push dword [esp + 0x78]
push dword [esp + 0x78]
call fcn.00408df5
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x408b78
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x408bad
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x408bd7
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x408bd7
test edi, edi
je 0x408ba4
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408ba4
test edi, edi
je 0x408bdf
mov eax, edi
jmp 0x408ba6
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x408ba6
int3
Function at 0x40b55c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestBinarySearch.exe_gMozillaPoisonSize], eax
call fcn.00408b78
pop ecx
mov ecx, dword [sym.TestBinarySearch.exe_gMozillaPoisonSize]
mov dword [sym.TestBinarySearch.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40b594
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestBinarySearch.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, reloc.user32.dll_DdeFreeDataHandle
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4179b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4179c3
pop dword [ebp - 0x40]
mov eax, 0x4179c3
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3efb1
push 0
mov eax, 0x360d28c5
add eax, 0xca352953
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xf8b520f5
add ecx, 0x74b2bef
mov ebx, eax
mov edi, 0x8539c9a9
sub edi, 0x84f675a9
add edi, dword [ebp - 0x40]
mov edx, 0x687969f1
add edx, 0x71c9f061
mov esi, dword [edi]
sub dword [ebp - 0x1c], 0x9837e5d5
sub esi, edx
xor dword [ebp - 0x3c], 0xd10ff134
mov dword [ebx], esi
mov dword [ebp - 0x1c], 0x38262a8b
add ebx, 4
add edi, 0x21b48301
add edi, 0xde4b7d03
loop 0x417a1d
add eax, 0x12663
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1f4e787c
sub ecx, 0x1f0e787c
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x447ebd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x447eeb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x447f09
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00447e27
jmp 0x447f09
mov eax, dword [esi + 0x14]
test eax, eax
je 0x447f09
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00447e27
test edi, edi
mov eax, edi
jne 0x447ef3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x5727ec]
test ecx, ecx
je 0x447fbc
jmp 0x447ebc
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x78b337c3
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x69852009
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x45643313
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3cfb37a5
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40f960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, 5
jl 0x40fa66
cmp eax, 0x11
jg 0x40fa66
mov eax, dword [ebp + 0x10]
test byte [eax + 0x11c], 2
je 0x40f9da
mov ecx, dword [ebp + 0xc]
mov esi, dword [edx]
cmp ecx, 1
jne 0x40f9a2
mov edx, dword [ebp + 0x14]
mov cl, byte [esi]
pop edi
pop esi
mov byte [edx], cl
xor eax, eax
pop ebx
pop ebp
ret
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x40fb24
mov edi, dword [ebp + 0x14]
lea edx, [esi + ecx - 1]
sub edi, esi
mov ebx, eax
mov al, byte [esi]
mov cl, byte [edx]
xor cl, al
xor al, cl
mov byte [edi + esi], al
mov al, byte [edx]
xor al, cl
inc esi
mov byte [edi + edx], al
dec edx
dec ebx
jne 0x40f9bc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, ecx
dec eax
je 0x40fa56
dec eax
je 0x40fa3a
sub eax, 2
je 0x40fa04
mov esi, dword [edx]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edx]
test dl, 3
jne 0x40fa0f
mov eax, dword [edx]
jmp 0x40fa18
push edx
call fcn.0040fb80
add esp, 4
mov ecx, dword [ebp + 0x14]
test cl, 3
jne 0x40fa29
pop edi
mov dword [ecx], eax
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push eax
push ecx
call fcn.0040fc40
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [edx]
push eax
call fcn.0040fb30
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0040fbd0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edx]
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov al, byte [edx]
pop ebx
mov byte [ecx], al
xor eax, eax
pop ebp
ret
cmp eax, 0x19
jl 0x40fa70
cmp eax, 0x1f
jle 0x40fa82
cmp eax, 0x28
jl 0x40fb24
cmp eax, 0x30
jg 0x40fb24
mov eax, dword [eax*4 + 0x44d6b8]
mov ecx, dword [ebp + 0x10]
cmp eax, 0xffffffff
movsx edi, byte [ecx + 0x110]
jne 0x40faa2
pop edi
pop esi
mov eax, 0x4000005f
pop ebx
pop ebp
ret
mov ecx, dword [edx]
lea edx, [edi + edi*2]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
lea eax, [eax + edx*2]
mov eax, dword [eax*4 + 0x44d7f4]
test eax, eax
je 0x40fad3
push ebx
push 0
push ecx
call eax
add esp, 0xc
cmp eax, 1
je 0x40faed
pop edi
pop esi
mov eax, 0x4000005f
pop ebx
pop ebp
ret
cmp esi, 4
jne 0x40fade
mov ecx, dword [ecx]
mov dword [ebx], ecx
jmp 0x40faed
cmp esi, 8
jne 0x40faed
mov edx, dword [ecx]
mov dword [ebx], edx
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov ecx, dword [ebp + 0x10]
test byte [ecx + 0x11c], 2
je 0x40fb24
test edi, edi
jne 0x40fb24
mov eax, esi
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x40fb24
lea esi, [esi + ebx - 1]
mov cl, byte [edi + ebx]
mov dl, cl
xor dl, byte [esi]
xor cl, dl
mov byte [edi + ebx], cl
mov cl, byte [esi]
xor cl, dl
inc edi
mov byte [esi], cl
dec esi
cmp edi, eax
jl 0x40fb0c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x410a50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00410810
mov eax, dword [0x4630c8]
mov esi, dword [ebp + 8]
test eax, eax
je 0x410a78
test esi, esi
je 0x410a6d
mov eax, dword [esi]
jmp 0x410a6f
xor eax, eax
push eax
call fcn.0043d050
add esp, 4
test esi, esi
je 0x410a80
mov esi, dword [esi]
jmp 0x410a82
xor esi, esi
push esi
call fcn.0042f9b1
pop esi
nop
nop
nop
nop
nop
nop
nop
Function at 0x412e00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi + 0xc]
add eax, edx
cmp byte [eax], 0xcc
jne 0x412e28
mov edx, dword [esi + 8]
cmp ecx, edx
jae 0x412e28
mov bl, byte [eax + 1]
inc eax
inc ecx
cmp bl, 0xcc
je 0x412e1a
mov edx, dword [esi + 8]
pop esi
cmp ecx, edx
pop ebx
jb 0x412e35
xor eax, eax
pop ebp
ret
mov dl, byte [eax]
xor ecx, ecx
cmp dl, 0xe9
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x4193a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
shl eax, 1
movsx edx, byte [eax + 0x44dc08]
cmp ecx, edx
jle 0x4193c7
movsx eax, byte [eax + 0x44dc09]
mov dword [esi + 0xc], eax
cmp ecx, 2
jne 0x4193d9
cmp dword [esi + 0x1c], 1
jne 0x4193d9
mov dword [esi + 0x10], 3
mov eax, dword [esi + 0xc]
test eax, eax
je 0x419534
movsx ecx, byte [eax*2 + 0x44dc08]
cmp ecx, dword [esi + 0x10]
jne 0x419534
cmp eax, 0x1c
jne 0x41941c
mov ecx, dword [esi + 0x18]
mov eax, ecx
and eax, 0x80000003
jns 0x41940b
dec eax
or eax, 0xfffffffc
inc eax
je 0x419416
mov edx, 4
sub edx, eax
mov eax, edx
lea ebx, [ecx + eax + 4]
jmp 0x419421
mov ebx, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
mov edi, ecx
mov dword [ebp - 4], ebx
lea edx, [eax + ebx]
shl edi, 9
cmp edx, edi
jle 0x419474
mov edx, dword [esi]
sub edx, eax
lea eax, [ecx + 1]
mov dword [esi + 4], eax
lea ecx, [ebp + 8]
shl eax, 9
push ecx
push eax
mov dword [ebp + 8], edx
call fcn.00410610
add esp, 8
test eax, eax
jne 0x419539
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 8]
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [esi + 4]
mov edi, ecx
lea edx, [eax + ebx]
shl edi, 9
cmp edx, edi
jg 0x419436
mov eax, dword [esi + 0xc]
cmp eax, 0x1c
je 0x4194df
mov ecx, dword [esi]
and eax, 0xff
pop edi
mov edx, dword [ecx]
and edx, 0xffff0000
xor edx, eax
mov dword [ecx], edx
mov eax, dword [esi + 0x20]
and eax, 0xff
and edx, 0xff00ffff
shl eax, 0x10
or eax, edx
mov dword [ecx], eax
mov edx, dword [esi + 0x1c]
shl edx, 0x18
and eax, 0xffffff
or edx, eax
mov dword [ecx], edx
mov eax, dword [esi + 0x14]
mov dword [ecx + 4], eax
mov edx, dword [esi + 0x18]
mov dword [ecx + 8], edx
mov ecx, dword [esi]
mov eax, dword [esi + 8]
add ecx, 0xc
add eax, 0xc
mov dword [esi], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov cl, byte [esi + 0xc]
mov byte [eax], cl
mov dx, word [esi + 0x18]
mov word [eax + 2], dx
mov byte [eax + 1], 0
mov edi, dword [esi + 0x14]
lea edx, [eax + 4]
mov eax, dword [esi + 0x18]
xor ecx, ecx
test eax, eax
jle 0x419516
mov eax, edx
sub edi, edx
mov bl, byte [edi + eax]
inc ecx
mov byte [eax], bl
mov ebx, dword [esi + 0x18]
inc eax
cmp ecx, ebx
jl 0x419505
mov ebx, dword [ebp - 4]
lea eax, [edx + ebx - 4]
mov dword [esi + 0xc], 0
mov dword [esi], eax
mov eax, dword [esi + 8]
add eax, ebx
pop edi
mov dword [esi + 8], eax
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc000003e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43db95
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
test eax, eax
jle 0x43dbe2
push ebx
push edi
lea edi, [esi + 8]
mov ebx, eax
mov eax, dword [esi + 4]
push 3
shr eax, 0xb
and eax, 7
push eax
push edi
call fcn.0043dceb
mov eax, dword [esi + 4]
add esp, 0xc
mov ecx, eax
and cx, 0xf800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
dec ebx
mov dword [esi + 4], ecx
jne 0x43dba9
pop edi
pop ebx
pop esi
ret
jge 0x43dc0f
mov ecx, dword [esi + 4]
push 0
mov eax, ecx
add esi, 8
and ax, 0xf800
dec eax
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi - 4], eax
shr eax, 0xb
and eax, 7
push eax
push esi
call fcn.0043dceb
add esp, 0xc
pop esi
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40596d
pop dword [ebp - 0x48]
mov eax, 0x7a68a654
add eax, 0x85d7b319
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x2ec8c6f1
add dword [ebp - 0x58], 0x1f897e5a
mov dword [ebp - 0x54], 0xc163c888
sub dword [ebp - 0x54], 0x8f307c43
mov dword [ebp - 0x50], 0xa313f8cf
sub dword [ebp - 0x50], 0x56c7b4a1
mov dword [ebp - 0x4c], 0x5f9d5b37
add dword [ebp - 0x4c], 0xa062a4c9
lea eax, [ebp - 0x58]
push eax
mov eax, 0xc67054f6
add eax, 0x39d01b6a
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa388fb7f
add dword [ebp - 0x58], 0xd0e96dd7
mov dword [ebp - 0x54], 0x9124fb2e
add dword [ebp - 0x54], 0xb0476647
mov dword [ebp - 0x50], 0x39f9fc40
add dword [ebp - 0x50], 0x2975702c
mov dword [ebp - 0x4c], 0xa65dc849
sub dword [ebp - 0x4c], 0xa65dc849
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7b6c64
add eax, 0xffc5049c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a7a7
push 0
call eax
mov ecx, 0xa4ef1511
add ecx, 0x5b1141fb
xor edi, edi
add edi, eax
mov edx, 0xaa73da35
add edx, 0x55cd25cb
add edx, dword [ebp - 0x48]
mov esi, 0xee49a34b
sub esi, 0xc02a7589
add dword [ebp - 0x34], edi
mov ebx, dword [edx]
sub dword [ebp - 0x40], edi
xor ebx, esi
sub dword [ebp - 0x28], 0x7f0e5bb
mov dword [edi], ebx
sub dword [ebp - 0x34], 0xf14dd4d7
add edi, 0x4b581330
add edi, 0xb4a7ecd4
add edx, 4
loop 0x405a91
add eax, 0x14f03
xor ebx, ebx
add ebx, eax
add eax, 0x434a0688
add eax, 0xbcb5f97d
mov ecx, 0xd3368206
sub ecx, 0xd2f68206
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040595e
jmp 0x406676

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx