joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10162aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x10162ad6
push esi
mov esi, dword [ebp + 8]
movzx edx, word [esi]
movzx ecx, byte [ebx + eax]
inc eax
xor ecx, edx
shr dx, 8
movzx ecx, cl
xor dx, word [ecx*4 + 0x102a2400]
mov word [esi], dx
cmp eax, edi
jl 0x10162ab5
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101645b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push 0xffff
movzx eax, byte [esi + 2]
push eax
call fcn.101644e0
push eax
movzx eax, byte [esi + 3]
push eax
call fcn.101644e0
mov ecx, dword [ebp + 8]
mov edx, eax
add esp, 0x10
mov eax, dword [ecx + 0x1c]
mov ecx, 6
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp eax, ecx
jle 0x101646c7
push ebx
push edi
movzx ebx, byte [esi + ecx]
lea ecx, [edx + edx]
shl ebx, 9
mov edx, ecx
xor edx, 0x8005
mov eax, ebx
xor eax, ecx
add ebx, ebx
test eax, 0x10000
mov eax, ebx
cmove edx, ecx
add ebx, ebx
add edx, edx
xor eax, edx
mov ecx, edx
xor ecx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove ecx, edx
add ebx, ebx
add ecx, ecx
xor eax, ecx
mov edx, ecx
xor edx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove edx, ecx
add ebx, ebx
add edx, edx
xor eax, edx
mov ecx, edx
xor ecx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove ecx, edx
add ebx, ebx
add ecx, ecx
xor eax, ecx
mov edi, ecx
xor edi, 0x8005
test eax, 0x10000
mov eax, ebx
cmove edi, ecx
add ebx, ebx
add edi, edi
xor eax, edi
mov edx, edi
xor edx, 0x8005
test eax, 0x10000
mov eax, ebx
cmove edx, edi
add edx, edx
xor eax, edx
mov ecx, edx
xor ecx, 0x8005
test eax, 0x10000
cmove ecx, edx
lea eax, [ecx + ecx]
xor ecx, ebx
mov edx, eax
xor edx, 0x8005
test ecx, 0x8000
mov ecx, dword [ebp + 0xc]
cmove edx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 8]
jl 0x101645f1
pop edi
pop ebx
mov eax, edx
mov byte [esi + 5], dl
sar eax, 8
mov byte [esi + 4], al
pop esi
pop ebp
ret
Function at 0x101ab520
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
jl 0x101ab5d5
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [esp + 0x10]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x102c31b0]
xor edx, dword [ecx*4 + 0x102c2db0]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x102c35b0]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x102c1db0]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x102c21b0]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x102c19b0]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x102c25b0]
xor edx, dword [eax*4 + 0x102c29b0]
mov eax, edx
sub ebx, 1
jne 0x101ab544
pop ebx
jmp 0x101ab5d9
mov eax, dword [esp + 0xc]
test edi, edi
je 0x101ab5fc
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x102c19b0]
sub edi, 1
jne 0x101ab5e0
pop edi
pop esi
ret
Function at 0x101ccfe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
xorps xmm5, xmm5
cdq
sub eax, edx
movss dword [esp + 0x10], xmm5
sar eax, 1
xor edx, edx
push edi
mov edi, dword [esp + 0x10]
test eax, eax
jle 0x101cd0b4
mov ecx, dword [esp + 8]
movss xmm7, dword [0x101f36d0]
movss xmm6, dword [0x102ca4b0]
push esi
mov esi, dword [esp + 0x10]
nop word [eax + eax]
movss xmm0, dword [edi + edx*8]
movss xmm4, dword [ecx]
movss xmm3, dword [ecx + 4]
subss xmm0, xmm4
movss xmm1, dword [ecx + 8]
mulss xmm0, dword [0x102ca4cc]
addss xmm4, xmm0
addss xmm0, dword [edi + edx*8]
movss dword [ecx], xmm0
movss xmm2, dword [edi + edx*8 + 4]
inc edx
movaps xmm0, xmm2
subss xmm0, xmm3
addss xmm3, xmm4
mulss xmm0, xmm6
addss xmm3, xmm0
addss xmm0, xmm2
xorps xmm2, xmm7
mulss xmm3, dword [0x101f3684]
movss dword [ecx + 4], xmm0
movaps xmm0, xmm2
subss xmm0, xmm1
addss xmm1, xmm4
mulss xmm0, xmm6
addss xmm1, xmm0
addss xmm2, xmm0
mulss xmm1, xmm1
movss dword [ecx + 8], xmm2
movss dword [esi], xmm3
add esi, 4
addss xmm5, xmm1
cmp edx, eax
jl 0x101cd020
pop esi
movss dword [esp + 0x14], xmm5
fld dword [esp + 0x14]
pop edi
ret
Function at 0x101e9790
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x14
test al, 1
je 0x101e97b3
push 0x31
push str.C:_vcpkg_2024.03.25_buildtreesopus_src_v1.4_cac4cc030e.clean_silkNLSF_VQ.c
push str.assertion_failed:___LPC_order__1____0
call fcn.101ace10
mov eax, dword [esp + 0x38]
add esp, 0xc
push ebx
xor ebx, ebx
mov dword [esp + 8], ebx
cmp dword [esp + 0x2c], ebx
jle 0x101e98a2
mov edx, dword [esp + 0x28]
lea ecx, [eax + eax]
push ebp
push esi
lea esi, [eax - 2]
mov dword [esp + 0x18], ecx
neg eax
mov dword [esp + 0x14], esi
add eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
sub eax, edx
push edi
mov dword [esp + 0x10], eax
nop dword [eax + eax]
mov ecx, esi
xor edi, edi
xor ebp, ebp
test ecx, ecx
js 0x101e9871
lea ebx, [ecx + 1]
lea ebx, [edx + ebx*2]
movzx eax, word [eax + ebx]
lea ebx, [ebx - 4]
mov edx, dword [esp + 0x30]
sar ebp, 1
movzx edx, byte [edx + ecx + 1]
shl dx, 7
sub ax, dx
movsx esi, ax
movsx eax, word [ebx + 4]
imul esi, eax
mov eax, esi
sar esi, 1
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
shl dx, 7
movzx eax, word [eax + ecx*2]
sub ax, dx
movsx ebp, ax
movsx eax, word [ebx + 2]
imul ebp, eax
mov eax, ebp
sub eax, esi
cdq
xor eax, edx
sub eax, edx
add edi, eax
sub ecx, 2
mov eax, dword [esp + 0x10]
jns 0x101e9800
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
add edx, dword [esp + 0x1c]
add eax, dword [esp + 0x20]
mov dword [esp + 0x34], edx
mov dword [ecx + ebx*4], edi
inc ebx
mov ecx, dword [esp + 0x3c]
add dword [esp + 0x30], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
cmp ebx, dword [esp + 0x38]
jl 0x101e97f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x101e9f60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101e9f8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101e9f8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10027fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10027faf
pop dword [ebp - 0x3c]
mov eax, 0x243b4286
sub eax, 0x1438c2d7
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x1150587c
add dword [ebp - 0x4c], 0x3d01eccf
mov dword [ebp - 0x48], 0x94083b6b
sub dword [ebp - 0x48], 0x61d4ef26
mov dword [ebp - 0x44], 0x9d0fc33a
add dword [ebp - 0x44], 0xaf3c80f4
mov dword [ebp - 0x40], 0x6d85ae87
sub dword [ebp - 0x40], 0x6d85ae87
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xe8136ea
sub eax, 0xfe7d36ae
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x4f8734dd
add dword [ebp - 0x4c], 0x24eb3479
mov dword [ebp - 0x48], 0xa66fcc5f
add dword [ebp - 0x48], 0x9afc9516
mov dword [ebp - 0x44], 0xab93efbb
sub dword [ebp - 0x44], 0x4824834f
mov dword [ebp - 0x40], 0x7640fc78
add dword [ebp - 0x40], 0x89bf0388
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x7a8a7dbd
sub eax, 0x6a867d8d
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x4409e
push 0
call eax
mov ecx, 0x368b2684
add ecx, 0xc97515a5
xor esi, esi
add esi, eax
mov edx, 0xa3f42351
add edx, 0x6c114aaf
add edx, dword [ebp - 0x3c]
mov edi, 0x878e079c
mov dword [ebp - 0x28], 0x4d667039
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0xdf220abc
add ebx, edi
sub dword [ebp - 0x14], 0xb84fdbe4
mov dword [esi], ebx
xor dword [ebp - 0x30], 0xac05e5a6
add esi, 0xed3113de
add esi, 0x12ceec26
add edx, 0xcb7c4cf6
add edx, 0x3483b30e
loop 0x100280cd
add eax, 0x9639d024
add eax, 0x69c71353
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa7448861
sub ecx, 0x97448861
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10027fa0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
Function at 0x10036f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ecf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004f338]
cmp eax, 0xffffffff
jne 0x10036fb6
xor ebx, ebx
jmp 0x10036fbf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10036fff
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003703e
test esi, esi
jne 0x10037042
push 0x10035760
push 0x10050e58
call fcn.10027fa0
mov eax, dword [0x1004f338]
add esp, 8
cmp eax, 0xffffffff
je 0x10036fff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003702c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003702c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10037084
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003706d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10037042
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036fd0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100370a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100370a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10027fa0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10037090
jmp 0x10036fd0

Function at 0x100370d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10037130
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100370fa
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10037118
cmp eax, 0xffffffff
je 0x10037118
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x2d2668fb
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x45bb7304
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401c66
pop dword [ebp - 0x44]
mov eax, 0x1da536e1
sub eax, 0x1d651a7b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc954b740
add dword [ebp - 0x54], 0x84fd8e0b
mov dword [ebp - 0x50], 0x4f5d55de
add dword [ebp - 0x50], 0xe2d5f667
mov dword [ebp - 0x4c], 0x780e8ae9
sub dword [ebp - 0x4c], 0x2bc246bb
mov dword [ebp - 0x48], 0xc4fafbb5
add dword [ebp - 0x48], 0x3b05044b
lea eax, [ebp - 0x54]
push eax
mov eax, 0x3f937e87
sub eax, 0x3f534e33
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x61f6cd76
sub dword [ebp - 0x54], 0xed846420
mov dword [ebp - 0x50], 0x391af3d1
sub dword [ebp - 0x50], 0xf7ae925c
mov dword [ebp - 0x4c], 0x75cb3847
add dword [ebp - 0x4c], 0xeda43425
mov dword [ebp - 0x48], 0x3326f1d7
sub dword [ebp - 0x48], 0x3326f1d7
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x946ff5e4
sub eax, 0x942fc5b8
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38f2e
push 0
call eax
mov ecx, 0xd45c952a
add ecx, 0x2ba3bcb5
xor edi, edi
add edi, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x44]
mov edx, 0xa1ec3a42
sub edx, 0x2b81b11
xor dword [ebp - 0x2c], 0x977dc2ef
mov esi, dword [ebx]
xor dword [ebp - 0x30], ecx
xor esi, edx
xor dword [ebp - 0x28], 0x383ce50
mov dword [edi], esi
sub dword [ebp - 4], esi
add edi, 0x46770169
add edi, 0xb988fe9b
add ebx, 0xf8a27075
add ebx, 0x75d8f8f
loop 0x401d84
add eax, 0xfe591b96
sub eax, 0xfe57e147
xor ebx, ebx
add ebx, eax
add eax, 0x727bd06f
sub eax, 0x727bd06a
mov ecx, 0xef755344
sub ecx, 0xef355344
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
call [ebx + 0x3c]
jne 0xfd7eb3
mov eax, dword [ebp + 0x18]
test eax, eax
mov eax, edx
jne 0x407eb5
mov byte [esi - 1], 0
pop edi
cmp dword [ebx - 0x7c3ca21b], ecx
sti
std
xor ecx, dword [ebp - 0xb0]
dec ebx
bound ecx, qword [ecx + 0x108a0c5d]
mov byte [esi - 0xa], dl
inc eax
mov byte [esi], 0xcb
inc esi
push 0xa7e018f
dec eax
mov ah, byte [esi + 0x40460e88]
inc eax
dec edi
jne 0x407e51
mov byte [esi], 0x65
inc esi
test dword [ebp + edi*2 - 0x612408f9], ebx
push es
sub eax, 0x6c603eb
push cs
outsb dx, byte [esi]
dec edi
mov ecx, 0x76aaac
cdq
idiv ecx
inc esi
jge 0x407e81
mov edi, edx
push esi
add eax, 0xb0883004
inc esi
mov eax, ebx
mov ecx, 0xd800000a
cdq
not ecx
test eax, eax
mov ecx, edx
jle 0x407ee8
mov eax, 0x66666608
imul edi
shr dword [esi - 0x3e3d74fe], 0xe8
pop ds
mov esi, 0x30c280d9
mov byte [edi + eax], cl
add cl, 0x30
jnp 0x407ebc
jmp 0x407e12
mov byte [esi], 0
pop edi
jae 0x407e46
invalid
pop ebp
ret
nop
nop
nop
nop
nop
nop
sub edx, dword [eax - 0x391374ab]
in al, dx
adc al, 0x83
jge 0x407f09
pop es
jl 0x407f69
mov dword [ebp + 0x10], 0x9f
fld qword [ebp + 8]
fcomp qword [0xf140c230]
mov ch, 0x4d
loop 0x407f42
ret 0xf140
inc ebp
pop ebp
and byte [esi + 0x33], dl
not byte [edi - 0x21]
aas
mov dword [ebp - 4], esp
mov eax, ebp
rol esp, 0x81
invalid
rol dword [eax], 0xdd
pop ebp
or ch, bl
inc ebp
in al, dx
fcomp qword [0x40c230]
push ebp
xchg esi, eax
xor dl, al
inc eax
add byte [ebp - 0x6a], dl
or al, 0xb2
loopne 0x407f4d
les eax, [ebx + edi*2 + 0x72]
sub dword [ebx + 0x50], esi
cmp esi, ebx
jbe 0x407fba
mov eax, 0xf6b7dfca
add byte [ebx + edi*2 + 0x48], 0xdd
inc ebp
cmp eax, 0xc3100ddc
inc eax
in eax, dx

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp - 0x27]
mov eax, dword [eax + 0x14]
scasd eax, dword es:[edi]
sal byte [ebx + esi - 0x75], 0x4d
or al, 0x51
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a3ea
push esi
jae 0x40a424
cwde
rol byte [eax], 0x5b
salc
lahf
sal byte [ebx + 0x4f], 0x8d
mov ah, 0xfd
or byte [eax], al
inc edx
salc
add eax, 0x90fc80
pop esi
pop ebp
ret 8
int1
nop
nop
nop
nop
mov dl, byte [eax - 0x6f6f6f70]
nop
push ebp
mov ebp, esp
cmc
cmp eax, 0x380866
adc al, 0xe3
and ebp, dword [eax + 0x28]
pop es
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_InitializeCriticalSection
mov eax, dword [ebp]
push 0x405720
xchg byte [eax - 0x5c], dh
inc eax
add byte [ecx + 0x28], cl
les eax, [ecx]
push eax
call 0x3fee00
xor eax, eax
pop ebp
pop ss
nop
nop
not byte [eax - 0x6f6f6f70]
nop
jecxz 0x40a3fe
nop
lea ebp, [eax + 0x28]
pop es
invalid
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10007c2e
pop dword [ebp - 0x48]
mov eax, 0x10007c2e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd60bb23c
sub dword [ebp - 0x58], 0x87b96cf1
mov dword [ebp - 0x54], 0x2470e909
add dword [ebp - 0x54], 0xdc2633c
mov dword [ebp - 0x50], 0xfc45a5e7
add dword [ebp - 0x50], 0x50069e47
mov dword [ebp - 0x4c], 0xd1eee33f
sub dword [ebp - 0x4c], 0xd1eee33f
lea eax, [ebp - 0x58]
push eax
mov eax, 0xd98fabc4
sub eax, 0xc98f2b70
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6b42ea60
add dword [ebp - 0x58], 0x92f7ef6
mov dword [ebp - 0x54], 0x78818f34
add dword [ebp - 0x54], 0xc8ead241
mov dword [ebp - 0x50], 0x668c2cce
add dword [ebp - 0x50], 0xfce33f9e
mov dword [ebp - 0x4c], 0x97075d26
sub dword [ebp - 0x4c], 0x97075d26
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xb7d5c2a4
sub eax, 0xa7d54254
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x357aa
push 0
call eax
mov ecx, 0x433f
xor edi, edi
add edi, eax
mov esi, 0x467f88ba
sub esi, 0x367e8eba
add esi, dword [ebp - 0x48]
mov ebx, 0x54a40baf
add ebx, 0x112854d6
xor dword [ebp - 0x18], 0x68c25f45
mov edx, dword [esi]
add edx, ebx
xor dword [ebp - 0x38], edx
mov dword [edi], edx
add edi, 0xf15b62
add edi, 0xff0ea4a2
add esi, 0x673d0288
sub esi, 0x673d0284
loop 0x10007d47
add eax, 0x6f1cb053
sub eax, 0x6f1bb084
xor ebx, ebx
add ebx, eax
add eax, 0x1e84bbdf
add eax, 0xe17b4426
mov ecx, 0x899d166f
sub ecx, 0x799d166f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40a397
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x419004]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov esi, dword [ebp + 8]
push 0x406f00
push 0x406f1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a3d1
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409496
push esi
lea ecx, [esp + 0x24]
call fcn.00408b70
lea ecx, [esp + 0x20]
call fcn.00408e9c
mov esi, eax
test esi, esi
jns 0x40a44f
lea ecx, [esp + 8]
call fcn.0040a30c
test al, al
je 0x40a499
cmp esi, 0x80040b00
jne 0x40a499
and dword [esp + 0x4c], 0
lea ecx, [esp + 0x20]
xor eax, eax
mov dword [esp + 0x50], 7
mov word [esp + 0x3c], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00408f41
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.004095f1
test esi, esi
js 0x40a499
mov esi, 0x80040b02
jmp 0x40a499
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40a45e
mov esi, dword [esp + 8]
push 0x406d74
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40a491
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40a48a
jle 0x40a499
movzx esi, si
or esi, 0x80070000
jmp 0x40a499
mov esi, 0x80004005
jmp 0x40a499
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
cmp dword [esp + 0x20], 0
je 0x40a4aa
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x24]
call fcn.004095f1
lea ecx, [esp + 8]
call fcn.004095f1
mov ecx, dword [esp + 0x54]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ab91
mov esp, ebp
pop ebp
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219