joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546610
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x546624
mov dword [esp + 0x18], fcn.00544df0
jmp fcn.004942f0
mov dword [esp + 0x18], fcn.00544090
jmp fcn.00494020
Function at 0x5489c0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00500470
add esp, 4
test eax, eax
jne 0x5489d4
pop esi
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [esp + 4], eax
jmp fcn.004e8f00

Function at 0x5503c0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x78
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx eax, byte [ecx]
mov dword [esi + 0x74], eax
mov eax, dword [ecx]
xor dword [esi], eax
mov eax, dword [ecx + 4]
xor dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
xor dword [esi + 0x1c], eax
pop esi
ret

Function at 0x55b400
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov ebx, dword [edi + 0x28]
cmp dword [ebx], 5
je 0x55b420
push ebx
push edi
call fcn.0055bfc0
add esp, 8
test eax, eax
jle 0x55b4a2
cmp dword [ebx + 0x28], 0
push esi
je 0x55b45b
push 0xf
push edi
call fcn.00456ee0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [ebx + 0x28]
call fcn.00457dd0
push 0xf
push dword [ebx + 0x28]
mov esi, eax
call fcn.00457d90
push eax
push edi
call fcn.00457d70
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebx
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.00456ee0
add esp, 8
test esi, esi
jg 0x55b49f
push esi
call fcn.004bd360
add esp, 4
test eax, eax
je 0x55b49f
push 0xa
push edi
call fcn.00457d70
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x561e90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.0057a200
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
push ebp
movups xmm0, xmmword [eax]
mov ebp, dword [esp + 0x4c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x48]
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
movups xmmword [esp + 0x1c], xmm0
test ebp, ebp
je 0x561f48
push 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push dword [ecx]
call fcn.00453c20
add esp, 0x14
neg eax
sbb eax, eax
inc dword [esp + 0x1c]
inc eax
or edi, eax
mov eax, 0x10
mov dword [esp + 0x10], edi
mov edi, ebp
sub edi, ebx
cmp edi, 0x10
cmova edi, eax
xor edx, edx
test edi, edi
je 0x561f39
lea eax, [esi + ebx]
mov esi, dword [esp + 0x50]
sub esi, dword [esp + 0x14]
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [esp + edx + 0x2c]
inc edx
mov byte [eax - 1], cl
cmp edx, edi
jb 0x561f23
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add ebx, 0x10
mov ecx, dword [esp + 0x18]
cmp ebx, ebp
jb 0x561ed1
mov ecx, dword [esp + 0x3c]
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.00579e58
add esp, 0x30
ret

Function at 0x5624f0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x562502
xor eax, eax
pop edi
ret
push esi
push dword [edi]
call fcn.00463b30
mov esi, eax
add esp, 4
test esi, esi
jns 0x562518
pop esi
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x562522
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x5625bc
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x56255b
test esi, esi
jle 0x56259a
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x562545
jmp 0x56259a
mov eax, esi
mov byte [ecx + edi + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x56257b
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
jle 0x56259a
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x562586
push esi
push ebp
push ebp
push dword [edi]
call fcn.00464440
add esp, 0x10
pop ebx
test eax, eax
jg 0x5625bc
push esi
push ebp
call fcn.00401320
add esp, 8
xor eax, eax
pop ebp
pop esi
pop edi
ret
pop ebp
pop esi
mov eax, 1
pop edi
ret
Function at 0x56e210
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
mov ebx, dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [ebx + 0x38], 0
je 0x56e23d
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x56e264
push ebx
call fcn.00477320
add esp, 4
push eax
push ebx
call fcn.0052d9f0
add esp, 4
push eax
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_sendto]
push 0xf
push edi
mov esi, eax
call fcn.00456ee0
add esp, 8
test esi, esi
jg 0x56e2cc
je 0x56e27c
cmp esi, 0xffffffff
jne 0x56e2cc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
jg 0x56e298
je 0x56e2af
cmp eax, 4
je 0x56e2af
cmp eax, 0xb
je 0x56e2af
cmp eax, 0x67
jmp 0x56e2a9
sub eax, 0x86
je 0x56e2af
sub eax, 6
je 0x56e2af
sub eax, 0x26a7
je 0x56e2af
xor eax, eax
jmp 0x56e2b4
mov eax, 1
test eax, eax
je 0x56e2cc
push 0xa
push edi
call fcn.00457d70
add esp, 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebx + 0x3c], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x56ed60
Capabilities:
Set socket configuration

Disassembly:
mov eax, 8
call fcn.0057a200
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [eax + 0x28]
cmp dword [esi + 0x4c], 0
ja 0x56ed82
cmp dword [esi + 0x48], 0
jbe 0x56eecf
lea ecx, [esp + 8]
mov dword [esp + 8], 4
push ecx
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push dword [eax + 0x24]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x56eddf
call fcn.00464f60
push str.dgram_adjust_rcv_timeout
push 0x135
push str.crypto_bio_bss_dgram.c
call fcn.00464fb0
add esp, 0xc
push str.calling_getsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00464fe0
add esp, 0xc
jmp 0x56edf8
mov eax, dword [esp + 4]
push 0
cdq
push 0xf4240
push edx
push eax
call fcn.0057ab90
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
push ebx
push edi
call fcn.00557d40
mov edi, dword [esi + 0x4c]
xor ebx, ebx
mov ecx, dword [esi + 0x48]
cmp edx, edi
jb 0x56ee16
ja 0x56ee11
cmp eax, ecx
jbe 0x56ee16
mov ebx, 1
sub ecx, eax
sbb edi, edx
test ebx, ebx
jne 0x56ee3a
test edi, edi
ja 0x56ee41
jb 0x56ee3a
cmp ecx, 0x3e8
ja 0x56ee41
test edi, edi
ja 0x56ee41
jb 0x56ee3a
cmp ecx, 0x3e8
jae 0x56ee41
mov ecx, 0x3e8
xor edi, edi
cmp dword [esi + 0x54], 0
ja 0x56ee4d
cmp dword [esi + 0x50], 0
jbe 0x56ee67
mov edx, dword [esi + 0x54]
mov eax, dword [esi + 0x50]
cmp edx, edi
ja 0x56ee67
jb 0x56eecd
cmp eax, ecx
ja 0x56ee67
cmp edx, edi
jb 0x56eecd
ja 0x56ee67
cmp eax, ecx
jb 0x56eecd
push 0
push 0xf4240
push edi
push ecx
call fcn.0057ac70
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
push 0x1006
push 0xffff
push dword [eax + 0x24]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x56eecd
call fcn.00464f60
push str.dgram_adjust_rcv_timeout
push 0x153
push str.crypto_bio_bss_dgram.c
call fcn.00464fb0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00464fe0
add esp, 0xc
pop edi
pop ebx
pop esi
add esp, 8
ret

Function at 0x56ef50
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x28]
cmp dword [eax + 0x4c], 0
ja 0x56ef64
cmp dword [eax + 0x48], 0
jbe 0x56efca
push 0
push 0xf4240
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.0057ac70
push 4
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x1006
push 0xffff
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x56efca
call fcn.00464f60
push str.dgram_reset_rcv_timeout
push 0x182
push str.crypto_bio_bss_dgram.c
call fcn.00464fb0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00464fe0
add esp, 0xc
pop esi
ret
Function at 0x577d40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34
call fcn.0057a200
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x30]
test eax, eax
jne 0x577d7f
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00579e58
add esp, 0x34
ret
movups xmm0, xmmword [edi + 0x10]
push ebx
mov ebx, dword [esp + 0x50]
lea ecx, [esp + 0x2c]
push esi
lea esi, [edi + 0x10]
mov dword [esp + 0x10], ebx
dec eax
movups xmmword [esp + 0x30], xmm0
and byte [esp + 0x3c], 0x7f
push 1
mov dword [edi + 0x30], eax
push ecx
psrldq xmm0, 8
movd eax, xmm0
push 0
push 0
and al, 0x7f
mov byte [esp + 0x48], al
mov eax, dword [edi + 0x20]
push 0
push eax
mov dword [esp + 0x30], eax
call fcn.00453210
add esp, 0x18
test eax, eax
je 0x577e62
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push dword [esp + 0x18]
push eax
push ebp
push dword [esp + 0x28]
call fcn.00453c20
add esp, 0x14
test eax, eax
je 0x577e62
push ebx
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call fcn.00578310
add esp, 0x10
test eax, eax
je 0x577e62
lea eax, [esi + 0xf]
xor edx, edx
lea ecx, [esp + 0x1c]
cmp ecx, eax
ja 0x577e33
lea eax, [esp + 0x2b]
cmp eax, esi
jb 0x577e33
mov eax, ecx
sub esi, eax
nop dword [eax]
lea ecx, [esp + 0x1c]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor byte [ecx], al
cmp edx, 0x10
jl 0x577e20
jmp 0x577e44
movups xmm1, xmmword [esp + 0x1c]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esp + 0x1c], xmm1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
or ecx, dword [esp + 0x24]
or eax, dword [esp + 0x28]
or ecx, eax
je 0x577e77
push ebx
push ebp
call fcn.00401320
add esp, 8
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00579e58
add esp, 0x34
ret
mov ecx, dword [esp + 0x40]
mov eax, ebx
pop esi
pop ebx
mov dword [edi + 0x2c], 0
pop edi
pop ebp
xor ecx, esp
call fcn.00579e58
add esp, 0x34
ret
Function at 0x578ab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0057a200
mov edx, dword [esp + 0x2c]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x1c]
or ecx, 0xffffffff
cmp edx, 1
push esi
setne al
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x3c]
add eax, edi
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x578ae9
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
push ebp
cmp edx, 1
je 0x578bbe
mov ebp, dword [esp + 0x30]
dec ebp
add ebp, esi
cmp dword [esp + 0x44], 0
mov cl, byte [ebp]
movzx edx, cl
mov byte [esp + 0x13], cl
mov dword [esp + 0x14], edx
je 0x578b23
sub esi, edx
mov eax, 1
sub esi, edi
pop ebp
dec esi
pop edi
mov dword [ebx], esi
pop esi
pop ebx
add esp, 0x14
ret
lea ecx, [edx + eax]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x578b95
mov esi, edx
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [ebp + 1]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esp + 0x13]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x578b55
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x40]
not ebx
movzx eax, bl
mov ebx, dword [esp + 0x28]
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [edx + 1]
mov edx, dword [esp + 0x3c]
neg ecx
and eax, ecx
sub esi, eax
mov dword [ebx], esi
push dword [esp + 0x48]
push ecx
push edi
push edx
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
push ebx
call fcn.00578760
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x505f2d27
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
mov ecx, 0x61206b90
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x409bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov ecx, dword [0x46ff00]
or eax, 0xffffffff
test ecx, ecx
jne 0x409c32
push ebx
xor edi, edi
mov esi, 0x46f300
mov edx, edi
mov ebx, 8
test dl, 1
je 0x409c10
shr edx, 1
xor edx, 0xedb88320
jmp 0x409c12
shr edx, 1
dec ebx
jne 0x409c01
mov dword [esi], edx
add esi, 4
inc edi
cmp esi, 0x46f700
jl 0x409bfa
mov esi, dword [esp + 0x14]
mov dword [0x46ff00], 1
pop ebx
xor edx, edx
test ebp, ebp
jle 0x409c58
xor ecx, ecx
mov cl, byte [edx + esi]
mov edi, eax
and edi, 0xff
shr eax, 8
xor ecx, edi
mov ecx, dword [ecx*4 + 0x46f300]
xor eax, ecx
inc edx
cmp edx, ebp
jl 0x409c38
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x409c60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
or ebx, 0xffffffff
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
mov ecx, ebx
repne scasb al, byte es:[edi]
mov eax, dword [0x46ff04]
not ecx
dec ecx
test eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ebx
jne 0x409cdc
push ebp
xor ebp, ebp
mov edi, 0x46f700
mov eax, ebp
cdq
mov dword [esp + 0x10], 8
mov ecx, eax
and ecx, 1
xor esi, esi
or ecx, esi
je 0x409cb0
xor eax, 0x53d46d27
xor edx, 0x85e1c3d7
mov ecx, 1
call fcn.0040ba70
dec dword [esp + 0x10]
jne 0x409c9a
mov dword [edi], eax
mov dword [edi + 4], edx
add edi, 8
inc ebp
cmp edi, 0x46ff00
jl 0x409c8f
mov dword [0x46ff04], 1
pop ebp
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x409d2a
mov ecx, dword [esp + 0x20]
xor eax, eax
mov al, byte [esi + ecx]
mov edx, ebx
and edx, 0xff
mov ecx, 8
mov edi, eax
xor edi, edx
mov edx, dword [esp + 0x18]
mov eax, ebx
call fcn.0040ba70
mov ebx, dword [edi*8 + 0x46f700]
xor ebx, eax
mov eax, dword [edi*8 + 0x46f704]
xor eax, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x409ce6
mov edx, dword [esp + 0x18]
pop edi
mov eax, ebx
pop esi
not eax
not edx
pop ebx
add esp, 0x10
ret

Function at 0x409d40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x400
jb 0x409d7b
mov edx, esi
shr edx, 0xa
mov ecx, edx
neg ecx
shl ecx, 0xa
push edi
add esi, ecx
mov ecx, 0x46ef00
mov edi, dword [ecx]
xor dword [eax], edi
add ecx, 4
add eax, 4
cmp ecx, 0x46f300
jb 0x409d65
dec edx
jne 0x409d60
pop edi
test esi, esi
jle 0x409d8f
mov ecx, 0x46ef00
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x409d86
pop esi
ret
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2e92461c
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5026646a
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512bca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x438
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], 0x312e35
call fcn.00469d46
mov esi, eax
mov dword [ebp - 0x18], 0x322e35
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00469d46
test eax, eax
mov dword [ebp - 0x1c], 0x302e36
mov ecx, 1
sete al
neg esi
sbb esi, esi
and esi, 8
test al, al
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
cmovne esi, ecx
call fcn.00469d46
test eax, eax
mov word [ebp - 0x1f], 0x312e
mov ecx, 2
mov byte [ebp - 0x1d], 0
sete al
mov byte [ebp - 0x20], 0x36
test al, al
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
cmovne esi, ecx
call fcn.00469d46
test eax, eax
mov word [ebp - 0x23], 0x322e
mov ecx, 3
mov byte [ebp - 0x21], 0
sete al
mov byte [ebp - 0x24], 0x36
test al, al
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
cmovne esi, ecx
call fcn.00469d46
test eax, eax
mov dword [ebp - 0x28], 0x332e36
mov ecx, 4
sete al
test al, al
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
cmovne esi, ecx
call fcn.00469d46
test eax, eax
mov word [ebp - 0x30], 0x3031
mov ecx, 5
mov word [ebp - 0x2d], 0x30
sete al
mov byte [ebp - 0x2e], 0x2e
test al, al
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
cmovne esi, ecx
call fcn.00469d46
add esp, 0x38
test eax, eax
sete al
test al, al
je 0x4014f8
mov esi, 6
xor cl, cl
jmp 0x401507
test esi, esi
je 0x401505
cmp esi, 1
je 0x401505
xor cl, cl
jmp 0x401507
mov cl, 1
call fcn.0051f330
cmp eax, 4
jne 0x40151b
mov ecx, 6
cmp esi, ecx
cmovne esi, ecx
lea esi, [esi*4 + 0x27]
push 0x400
add esi, eax
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.00443110
add esp, 0xc
mov word [ebp - 0x38], 0x3138
lea eax, [ebp - 0x38]
mov dword [ebp - 0x35], 0x642531
mov byte [ebp - 0x36], 0x33
push esi
push eax
lea eax, [ebp - 0x444]
push 0x400
push eax
call fcn.0041f2e0
add esp, 0x10
lea eax, [ebp - 0x444]
mov ecx, edi
push eax
call fcn.0041fa80
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4015bf
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4015bb
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xd], 0x656d756c
push eax
mov esi, edx
mov dword [esp + 0x15], 0x6f666e49
mov edi, ecx
mov dword [esp + 0xc], 0x56746547
mov dword [esp + 0x1b], 0x6f697461
mov word [esp + 0x20], 0x57
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x1f], 0x6e
mov word [esp + 0x19], 0x6d72
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401f7a
push 0x105
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0x105
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x18
ret
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x402080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 0xd], 0x70
push eax
mov word [esp + 0xc], 0x7373
mov dword [esp + 5], 0x72507465
mov word [esp + 9], 0x636f
mov byte [esp + 4], 0x47
mov word [esp + 0xe], 0x6548
mov byte [esp + 0xb], 0x65
mov byte [esp + 0x10], 0x61
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4020d0
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret