joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x415a5e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x415a52
cmp dword [edi + 0x7c], ebx
je 0x415a6d
call fcn.00415e30
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.004157b0
add esp, 0xc
test eax, eax
je 0x415a94
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.00418ee0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x415ad5
push 0x4000
call fcn.00418ee0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x415ae2
push esi
call fcn.00418e03
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x415b2a
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00414910
test eax, eax
jne 0x415b2a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x415b54
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x415b5d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x70]
mov dword [esi + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmp ebp, ebx
je 0x415b97
mov cl, byte [ebp]
cmp cl, bl
je 0x415b97
call fcn.00414600
add ebp, 1
jne 0x415b86
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x415f90
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x416038
cmp dword [ebx + 4], 0xffffffff
jne 0x416038
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415fc0
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp ax, 0x5c
je 0x415ff9
cmp ax, 0x2f
je 0x415ff9
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x415fe6
mov eax, dword [0x437788]
mov dword [edi], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea esi, [esp + 0x1c]
call fcn.00414d60
add esp, 8
test eax, eax
jne 0x41601d
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ecx
ret 8
call fcn.00415130
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop esi
pop ecx
ret 8
pop edi
mov eax, 0x1000000
pop esi
pop ecx
ret 8
Function at 0x4173a0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
push ebp
push esi
mov esi, dword [ecx + 4]
mov ecx, eax
shr ecx, 4
xor ecx, esi
and ecx, 0xf0f0f0f
xor esi, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
and ecx, 0xffff
xor esi, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
add ecx, ecx
add ecx, ecx
xor esi, ecx
mov ecx, esi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, esi
rol ecx, 1
mov esi, ecx
xor ecx, eax
and ecx, 0xaaaaaaaa
xor esi, ecx
xor ecx, eax
rol ecx, 1
push edi
mov edi, ecx
mov dword [esp + 0x10], 8
jmp 0x417420
mov eax, esi
ror eax, 4
xor eax, dword [edx]
add edx, 4
mov ecx, eax
shr ecx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x43c490]
or ecx, dword [ebx*4 + 0x43c690]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or ecx, dword [ebx*4 + 0x43c890]
and eax, 0x3f
or ecx, dword [eax*4 + 0x43ca90]
mov eax, dword [edx]
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x43c590]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x43c790]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x43c990]
and eax, 0x3f
or ebx, dword [eax*4 + 0x43cb90]
add edx, 4
or ebx, ecx
xor edi, ebx
mov eax, edi
ror eax, 4
xor eax, dword [edx]
add edx, 4
mov ecx, eax
shr ecx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x43c490]
or ecx, dword [ebx*4 + 0x43c690]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or ecx, dword [ebx*4 + 0x43c890]
and eax, 0x3f
or ecx, dword [eax*4 + 0x43ca90]
mov eax, dword [edx]
xor eax, edi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x43c590]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x43c790]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x43c990]
and eax, 0x3f
or ebx, dword [eax*4 + 0x43cb90]
add edx, 4
or ebx, ecx
xor esi, ebx
sub dword [esp + 0x10], 1
jne 0x417420
ror esi, 1
mov eax, esi
xor eax, edi
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, edi
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
lea edx, [ecx*4]
mov ecx, esi
shr ecx, 0x10
xor eax, edx
mov edx, dword [esp + 0x18]
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
pop esi
xor ecx, eax
pop ebp
mov dword [edx + 4], ecx
pop ebx
pop ecx
ret
Function at 0x418310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4294d1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43b14c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
xor esi, esi
mov dword [esp + 0x18], esi
mov edi, 1
mov dword [esp + 0x24], edi
mov eax, dword [0x44130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x44130c
call edx
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebp, eax
cmp ebp, esi
je 0x418402
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], esi
call sub.IPHLPAPI.DLL_GetIpNetTable
cmp eax, 0x7a
jne 0x418402
mov edx, dword [esp + 0x14]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push edi
lea eax, [esp + 0x18]
push eax
push esi
call sub.IPHLPAPI.DLL_GetIpNetTable
test eax, eax
jne 0x4183fb
test esi, esi
je 0x418402
mov edx, dword [esi]
test edx, edx
jbe 0x4183fb
lea ecx, [esi + 0x14]
cmp ebp, dword [ecx]
je 0x4183c7
add eax, edi
add ecx, 0x18
cmp eax, edx
jb 0x4183b8
jmp 0x4183fb
lea ecx, [eax + eax*2]
movzx edx, byte [esi + ecx*8 + 0x11]
lea eax, [esi + ecx*8]
movzx ecx, byte [eax + 0x10]
push edx
movzx edx, byte [eax + 0xf]
push ecx
movzx ecx, byte [eax + 0xe]
push edx
movzx edx, byte [eax + 0xd]
movzx eax, byte [eax + 0xc]
push ecx
push edx
push eax
push 0x437b08
mov edi, ebx
call fcn.004044d0
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418427
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x418760
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
push edi
lea eax, [esp + 0x10]
push eax
call ebp
call fcn.0041a347
add eax, dword [esp + 0x10]
push eax
call fcn.0041a335
add esp, 4
call fcn.0041a347
cdq
mov ecx, 5
idiv ecx
xor esi, esi
mov edi, edx
add edi, dword [esp + 0x1c]
test edi, edi
jle 0x4187f3
mov edi, edi
lea edx, [esp + 0x10]
push edx
call ebp
call fcn.0041a347
add eax, dword [esp + 0x10]
push eax
call fcn.0041a335
add esp, 4
call fcn.0041a347
cdq
mov ecx, 0x3e
idiv ecx
cmp edx, 0xa
jge 0x4187d0
add edx, 0x30
jmp 0x4187dd
cmp edx, 0x24
jge 0x4187da
add edx, 0x37
jmp 0x4187dd
add edx, 0x3d
mov word [ebx + esi*2], dx
inc esi
cmp esi, edi
jl 0x4187a0
xor edx, edx
mov word [ebx + edi*2], dx
pop edi
pop esi
pop ebp
add esp, 0xc
ret
xor eax, eax
mov word [ebx + edi*2], ax
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x418df4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b14c]
jne 0x418dfe
repz ret
jmp fcn.0041c624
Function at 0x424be1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041c033
and dword [ebp - 4], 0
cmp dword [0x441dfc], 0
mov ebx, eax
jne 0x424c92
push 0x42bd18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424d43
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42bd0c
push edi
call esi
test eax, eax
je 0x424d43
push eax
call fcn.0041bfc1
mov dword [esp], 0x42bcfc
push edi
mov dword [0x441dfc], eax
call esi
push eax
call fcn.0041bfc1
mov dword [esp], 0x42bce8
push edi
mov dword [0x441e00], eax
call esi
push eax
call fcn.0041bfc1
mov dword [esp], 0x42bccc
push edi
mov dword [0x441e04], eax
call esi
push eax
call fcn.0041bfc1
pop ecx
mov dword [0x441e0c], eax
test eax, eax
je 0x424c92
push 0x42bcb4
push edi
call esi
push eax
call fcn.0041bfc1
pop ecx
mov dword [0x441e08], eax
mov eax, dword [0x441e08]
cmp eax, ebx
je 0x424cea
cmp dword [0x441e0c], ebx
je 0x424cea
push eax
call fcn.0041c03c
push dword [0x441e0c]
mov esi, eax
call fcn.0041c03c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424cea
test edi, edi
je 0x424cea
call esi
test eax, eax
je 0x424ce1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424ce1
test byte [ebp - 0xc], 1
jne 0x424cea
or dword [ebp + 0x10], 0x200000
jmp 0x424d23
mov eax, dword [0x441e00]
cmp eax, ebx
je 0x424d23
push eax
call fcn.0041c03c
pop ecx
test eax, eax
je 0x424d23
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424d23
mov eax, dword [0x441e04]
cmp eax, ebx
je 0x424d23
push eax
call fcn.0041c03c
pop ecx
test eax, eax
je 0x424d23
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x441dfc]
call fcn.0041c03c
pop ecx
test eax, eax
je 0x424d43
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424d45
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4

Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x53e0385a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
nop
mov ecx, 0xeb26c28
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5daf6220
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x486b121e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x42c3a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.0042d515
test eax, eax
je 0x42c3dd
jmp 0x42c57e
push dword [ebp - 8]
push 0x40
call dword [0x4090b8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c3f6
jmp 0x42c57e
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x409e70
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0042d4d9
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x42c555
and dword [ebp - 0x44], 0
jmp 0x42c46d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x42c553
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x42c52d
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409e78
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [0x4090c4]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x42c52d
push dword [ebp - 0x154]
call dword [0x409110]
lea eax, [ebp - 0x150]
push eax
call dword [0x409118]
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409a34
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
call fcn.0042a7ed
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x42c54e
mov eax, dword [ebp - 0x44]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.0042c3a2
jmp 0x42c466
jmp 0x42c560
cmp dword [ebp - 0x40], 0x103
je 0x42c560
jmp 0x42c56d
cmp dword [ebp - 0x40], 0x103
jne 0x42c432
push dword [ebp - 0xc]
call dword [0x4090a0]
push dword [ebp - 4]
call fcn.0042d50f
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x419400
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x419428
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x419437
mov eax, 1
ret 4

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x23b42c5d
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x51813cc5
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x417786
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x417795
pop dword [ebp - 8]
mov eax, 0x2d8a5b3c
sub eax, 0x2d48e3a7
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x84e3e524
sub dword [ebp - 0x18], 0x36919fd9
mov dword [ebp - 0x14], 0x1b93f0e
add dword [ebp - 0x14], 0x307a0d37
mov dword [ebp - 0x10], 0x4689dc19
sub dword [ebp - 0x10], 0xfa3d97eb
mov dword [ebp - 0xc], 0x3cf94aa3
add dword [ebp - 0xc], 0xc306b55d
lea eax, [ebp - 0x18]
push eax
mov eax, 0x43a27ca4
add eax, 0xbc9fb3d0
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb21628bc
add dword [ebp - 0x18], 0xc25c409a
mov dword [ebp - 0x14], 0xc3c82341
add dword [ebp - 0x14], 0x7da43e34
mov dword [ebp - 0x10], 0x20594ed6
add dword [ebp - 0x10], 0x43161d96
mov dword [ebp - 0xc], 0x3b4f4741
add dword [ebp - 0xc], 0xc4b0b8bf
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x407da
push 0
call eax
mov ecx, 0x519b
mov edi, eax
mov edx, 0xc11fb816
sub edx, 0xc0dc7416
add edx, dword [ebp - 8]
mov esi, 0xc42ec346
sub esi, 0x60ba8c8e
mov dword [ebp - 4], 0x7368f706
mov ebx, dword [edx]
sub dword [ebp - 4], edi
add ebx, esi
mov dword [ebp - 4], 0x142bb4fe
mov dword [edi], ebx
xor dword [ebp - 4], 0xa16f6ee6
add edi, 0xc550b8ed
sub edi, 0xc550b8e9
add edx, 0x5cf94314
add edx, 0xa306bcf0
loop 0x4178ac
add eax, 0x56b7e5f9
sub eax, 0x56b6acba
xor ebx, ebx
add ebx, eax
add eax, 0xe10f2b7
sub eax, 0xe10f2b2
mov ecx, 0x5f720b22
add ecx, 0xa0cdf4de
add ecx, dword [ebp - 8]
call ebx
leave
ret