joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edi
test edi, edi
jne 0x43feee
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x43ff04
cmp byte [edi], al
je 0x43fef7
inc ecx
cmp byte [ecx], al
jne 0x43fef2
sub ecx, edi
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x14]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x440005
jmp 0x43ff23
mov edi, dword [ebp + 0xc]
cmp esi, 2
jge 0x43ff2b
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43ff8b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, esi
shl edx, 4
mov edi, dword [edx + eax]
mov dl, byte [ecx]
test dl, dl
je 0x43ff6d
jmp 0x43ff50
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x4e3098]
cmp dl, byte [eax + 0x4e3098]
jne 0x43ff6d
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x43ff50
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x4e3098]
movzx ecx, byte [ecx + 0x4e3098]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x43fff5
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add esi, esi
mov esi, dword [eax + esi*8 + 0xc]
cmp dword [esi + 0x14], 0
je 0x43ffd8
xor eax, eax
mov edx, ebx
mov ecx, edi
test ebx, ebx
jle 0x43ffce
jmp 0x43ffb0
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4e3098]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x43ffb0
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
xor edx, edx
div dword [esi + 8]
jmp 0x43ffda
xor edx, edx
push ebx
push edi
lea eax, [esi + 8]
call fcn.0040c9c0
add esp, 8
test eax, eax
je 0x44000c
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x440005
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 0x10]
jl 0x43ff20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x43fff5
Function at 0x440110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov ecx, eax
test eax, eax
jne 0x44012d
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x440145
cmp byte [eax], 0
je 0x440138
inc ecx
cmp byte [ecx], 0
jne 0x440132
sub ecx, eax
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 0x14]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x440227
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x10], ecx
push edi
nop
mov ecx, eax
cmp eax, 2
jge 0x44016a
xor ecx, 1
mov edx, dword [ebp + 0xc]
shl ecx, 4
add ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 0xc]
test edx, edx
je 0x4401ba
mov esi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x4401a2
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4e3098]
cmp cl, byte [eax + 0x4e3098]
jne 0x44019f
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x440182
mov eax, dword [ebp - 4]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x4e3098]
movzx edx, byte [edx + 0x4e3098]
sub edx, ecx
jne 0x440216
cmp dword [edi + 0x24], 0
lea esi, [edi + 0x18]
je 0x4401f4
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x4401ee
mov edi, edi
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4e3098]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4401d0
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi]
jmp 0x4401f6
xor edx, edx
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, esi
call fcn.0040c9c0
add esp, 8
test eax, eax
je 0x44022d
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
test eax, eax
jne 0x440226
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x14]
jl 0x440160
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
jmp 0x440213
Function at 0x4402a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
add eax, eax
mov ebx, dword [edx + eax*8 + 0xc]
add ebx, 0x18
push edi
mov dword [ebp - 8], ebx
mov eax, esi
test esi, esi
je 0x4402d5
cmp byte [esi], 0
je 0x4402ce
inc eax
cmp byte [eax], 0
jne 0x4402c8
sub eax, esi
and eax, 0x3fffffff
cmp dword [ebx], 0
mov dword [ebp - 4], eax
je 0x440319
mov edx, eax
xor eax, eax
mov ecx, esi
cmp edx, eax
jle 0x44030e
jmp 0x4402f0
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4e3098]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4402f0
mov ebx, dword [ebp - 8]
xor edx, edx
div dword [ebx]
mov eax, dword [ebp - 4]
mov edi, edx
jmp 0x44031b
xor edi, edi
push eax
push esi
mov edx, edi
mov eax, ebx
call fcn.0040c9c0
add esp, 8
test eax, eax
je 0x44039d
mov esi, dword [eax + 8]
mov edx, edi
mov ecx, ebx
call fcn.0040ca60
test esi, esi
je 0x44039d
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 8]
cmp eax, esi
jne 0x440360
mov eax, dword [esi + 0x14]
mov edi, dword [ebp + 8]
mov dword [ecx + 8], eax
call fcn.00440240
or dword [edi + 0x18], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x44038a
mov ecx, dword [eax + 0x14]
cmp ecx, esi
je 0x440384
mov eax, ecx
test eax, eax
jne 0x440364
mov edi, dword [ebp + 8]
call fcn.00440240
or dword [edi + 0x18], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x14], ecx
mov edi, dword [ebp + 8]
call fcn.00440240
or dword [edi + 0x18], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
or dword [eax + 0x18], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4408f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
shl eax, 4
add eax, dword [ecx + 0x10]
mov ecx, edi
test edi, edi
je 0x44091e
cmp byte [edi], 0
je 0x440916
nop
inc ecx
cmp byte [ecx], 0
jne 0x440910
sub ecx, edi
and ecx, 0x3fffffff
mov ebx, dword [eax + 0xc]
add ebx, 8
cmp dword [ebx], 0
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
je 0x440969
xor eax, eax
mov esi, ecx
mov edx, edi
cmp ecx, eax
jle 0x44095e
lea esp, [esp]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x4e3098]
lea ebx, [eax*8]
xor ecx, ebx
dec esi
xor eax, ecx
inc edx
test esi, esi
jg 0x440940
mov ebx, dword [ebp - 8]
xor edx, edx
div dword [ebx]
mov ecx, dword [ebp - 4]
mov esi, edx
jmp 0x44096b
xor esi, esi
push ecx
push edi
mov edx, esi
mov eax, ebx
call fcn.0040c9c0
add esp, 8
test eax, eax
je 0x44098b
mov edi, dword [eax + 8]
mov edx, esi
mov ecx, ebx
call fcn.0040ca60
jmp 0x44098d
xor edi, edi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00440640
add esp, 8
or dword [esi + 0x18], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x40], edx
mov edx, dword [ecx + 0x10]
add eax, eax
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x28], eax
mov eax, 1
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
jmp 0x442cb3
mov esi, dword [ebp - 0x30]
push eax
push str.sqlite_stat_d
lea ecx, [ebp - 0x1c]
push ecx
push 0x18
call fcn.0040a9a0
mov ecx, dword [esi]
xor ebx, ebx
add esp, 0x10
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x1c]
cmp byte [ebp - 0x1c], bl
je 0x442ce5
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0x442ce0
lea edx, [ebp - 0x1c]
sub eax, edx
and eax, 0x3fffffff
mov edi, eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x38], eax
cmp eax, ebx
jle 0x442e01
jmp 0x442d0a
mov ecx, dword [ebp - 0x34]
mov edx, ebx
cmp ebx, 2
jge 0x442d14
xor edx, 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x442d6b
mov ecx, dword [ecx + 0x10]
mov esi, edx
add esi, esi
mov esi, dword [ecx + esi*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x442d50
lea ecx, [ecx]
movzx ebx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4e3098]
cmp cl, byte [ebx + 0x4e3098]
jne 0x442d4d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x442d30
mov ebx, dword [ebp - 0x20]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x4e3098]
movzx eax, byte [eax + 0x4e3098]
sub eax, ecx
jne 0x442dcd
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8 + 0xc]
cmp dword [esi + 0x14], 0
je 0x442dad
xor eax, eax
mov edx, edi
lea ecx, [ebp - 0x1c]
test edi, edi
jle 0x442da6
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4e3098]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x442d85
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x44]
xor edx, edx
div dword [esi + 8]
jmp 0x442daf
xor edx, edx
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [esi + 8]
call fcn.0040c9c0
add esp, 8
test eax, eax
je 0x442e22
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x442de0
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, dword [ebp - 0x38]
jl 0x442d07
cmp dword [ebp - 0x24], 0
je 0x442e01
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
push eax
push ecx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edx
call fcn.0043fdd0
add esp, 0x18
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 4
jle 0x442cb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0
jmp 0x442dcd
Function at 0x462280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
add eax, eax
mov ebx, dword [edx + eax*8 + 0xc]
add ebx, 0x28
push edi
mov dword [ebp - 8], ebx
mov eax, esi
test esi, esi
je 0x4622b5
cmp byte [esi], 0
je 0x4622ae
inc eax
cmp byte [eax], 0
jne 0x4622a8
sub eax, esi
and eax, 0x3fffffff
cmp dword [ebx], 0
mov dword [ebp - 4], eax
je 0x4622fa
mov edx, eax
xor eax, eax
mov ecx, esi
cmp edx, eax
jle 0x4622ee
jmp 0x4622d0
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4e3098]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4622d0
mov ebx, dword [ebp - 8]
xor edx, edx
div dword [ebx]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edx
jmp 0x462301
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
push eax
push esi
mov eax, ebx
call fcn.0040c9c0
add esp, 8
test eax, eax
je 0x4623c7
mov edi, dword [eax + 8]
mov edx, dword [ebp - 8]
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.0040ca60
test edi, edi
je 0x4623c7
mov edx, dword [edi + 0x18]
cmp dword [edi + 0x14], edx
jne 0x462380
mov ecx, dword [edi + 4]
mov eax, ecx
test ecx, ecx
je 0x462353
cmp byte [ecx], 0
je 0x46234c
inc eax
cmp byte [eax], 0
jne 0x462346
sub eax, ecx
and eax, 0x3fffffff
push ecx
add edx, 8
push edx
mov esi, eax
call fcn.0040cab0
mov ecx, dword [eax + 0x40]
add eax, 0x40
add esp, 8
cmp ecx, edi
je 0x462379
lea esp, [esp]
lea eax, [ecx + 0x20]
mov ecx, dword [eax]
cmp ecx, edi
jne 0x462370
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [eax], edx
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 8]
push eax
mov ebx, esi
call fcn.00461390
mov eax, dword [edi]
add esp, 4
mov ecx, esi
call fcn.00409080
mov eax, dword [edi + 4]
mov ecx, esi
call fcn.00409080
mov ecx, dword [edi + 0xc]
push ecx
push esi
call fcn.004372f0
mov edi, dword [edi + 0x10]
add esp, 8
call fcn.004449c0
mov eax, dword [ebp - 4]
mov ecx, esi
call fcn.00409080
or dword [esi + 0x18], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cf2b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f72bc]
jne 0x4cf2c0
repz ret
jmp fcn.004d2a6c

Function at 0x4da275
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004d4866
and dword [ebp - 0x14], 0
cmp dword [0x4fb3dc], 0
mov dword [ebp - 0x18], eax
jne 0x4da328
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4da3d0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4da3d0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4fb3dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4fb3e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4fb3e4], eax
call edi
push eax
call esi
mov dword [0x4fb3ec], eax
test eax, eax
je 0x4da328
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4fb3e8], eax
mov eax, dword [0x4fb3e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4da381
cmp dword [0x4fb3ec], ecx
je 0x4da381
push eax
call esi
push dword [0x4fb3ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4da381
test ebx, ebx
je 0x4da381
call edi
test eax, eax
je 0x4da378
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4da378
test byte [ebp - 8], 1
jne 0x4da381
or dword [ebp + 0x10], 0x200000
jmp 0x4da3b4
mov eax, dword [0x4fb3e0]
cmp eax, dword [ebp - 0x18]
je 0x4da3b4
push eax
call esi
test eax, eax
je 0x4da3b4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4da3b4
mov eax, dword [0x4fb3e4]
cmp eax, dword [ebp - 0x18]
je 0x4da3b4
push eax
call esi
test eax, eax
je 0x4da3b4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4fb3dc]
call esi
test eax, eax
je 0x4da3d0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4da3d2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x71022fb2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x379a386b
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4a56b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
xor eax, eax
push ebp
push 0x4a57fc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4a57d7
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4ae1b4]
mov eax, dword [eax]
call fcn.004a10cc
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0041239c
push dword [ebp - 8]
push 0x4a5818
lea edx, [ebp - 0x14]
mov eax, dword [0x4ae1b4]
mov eax, dword [eax]
call fcn.004a10cc
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004123d8
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00407648
mov eax, dword [ebp - 4]
call fcn.0041207c
test al, al
je 0x4a5761
push 1
push 0x4a581c
push 0x4a581c
mov eax, dword [ebp - 4]
call fcn.00407134
push eax
push 0x4a5820
mov eax, ebx
call fcn.00479ce0
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x4a57cd
lea edx, [ebp - 0x18]
mov eax, dword [0x4ae1b4]
mov eax, dword [eax]
call fcn.004a10cc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.0041239c
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a5798
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4a5798
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406a50
test eax, eax
je 0x4a57a1
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x4a57cd
push 1
push 0x4a581c
push 0x4a581c
mov eax, dword [ebp - 4]
call fcn.00407134
push eax
push 0x4a5820
mov eax, ebx
call fcn.00479ce0
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a57e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5803
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004070a0
ret

Function at 0x433003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40120d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, 0x38347327
xor esi, esi
push eax
call fcn.00401ff3
xor byte [esi + section..data], al
inc esi
pop ecx
cmp esi, 0x5163
jb 0x401215
pop esi
ret

Function at 0x401a0f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
cmp dword [esp + 0x28], 0
push ebx
push ebp
push edi
jne 0x401a23
xor eax, eax
jmp 0x401b4a
push esi
mov esi, dword [esp + 0x34]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x401b47
mov ecx, dword [esi + 0x3c]
mov dword [esp + 0x20], esi
add ecx, esi
je 0x401b47
cmp ecx, esi
jb 0x401b47
lea eax, [esi + 0x1000]
cmp ecx, eax
jae 0x401b47
cmp dword [ecx], 0x4550
jne 0x401b47
movzx eax, word [ecx + 0x18]
mov edi, 0x10b
mov edx, dword [ecx + 0x50]
cmp ax, di
jne 0x401a7d
mov ebx, dword [ecx + 0x78]
jmp 0x401a83
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x401b47
cmp ax, di
jne 0x401a95
mov eax, dword [ecx + 0x7c]
jmp 0x401a9b
mov eax, dword [ecx + 0x8c]
lea edi, [ebx + esi]
mov dword [esp + 0x10], eax
cmp edi, esi
jb 0x401b47
lea eax, [edx + esi]
cmp edi, eax
jae 0x401b47
mov ebp, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add ebp, esi
mov edx, dword [edi + 0x24]
add ecx, esi
add edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
cmp ebp, esi
jb 0x401b47
cmp ebp, eax
jae 0x401b47
cmp ecx, esi
jb 0x401b47
cmp ecx, eax
jae 0x401b47
cmp edx, esi
jb 0x401b47
cmp edx, eax
jae 0x401b47
xor ebp, ebp
cmp dword [edi + 0x18], ebp
jbe 0x401b42
mov eax, dword [ecx + ebp*4]
mov ecx, dword [esp + 0x14]
add eax, esi
mov dword [esp + 0x28], eax
movzx eax, word [edx + ebp*2]
mov ecx, dword [ecx + eax*4]
mov dword [esp + 0x24], ecx
cmp ecx, ebx
jb 0x401b1e
mov eax, dword [esp + 0x10]
add eax, ebx
cmp ecx, eax
jae 0x401b1e
lea eax, [ecx + esi]
mov dword [esp + 0x2c], eax
jmp 0x401b23
and dword [esp + 0x2c], 0
push dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
call dword [esp + 0x40]
test eax, eax
je 0x401b42
mov ecx, dword [esp + 0x18]
inc ebp
mov edx, dword [esp + 0x1c]
cmp ebp, dword [edi + 0x18]
jb 0x401aef
xor eax, eax
inc eax
jmp 0x401b49
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x402620
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
xor eax, eax
nop word [eax + eax]
mov byte [ebp + eax - 0x108], al
inc eax
cmp eax, 0x100
jl 0x402640
xor esi, esi
mov eax, esi
mov bl, byte [ebp + esi - 0x108]
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx ecx, bl
movzx eax, byte [edx + eax]
add edi, eax
add edi, ecx
and edi, 0x800000ff
jns 0x40267c
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], al
inc esi
mov byte [ebp + edi - 0x108], bl
cmp esi, 0x100
jl 0x402651
xor esi, esi
xor edi, edi
cmp dword [ebp - 8], esi
jle 0x402717
mov ebx, dword [ebp + 0x10]
sub dword [ebp - 4], ebx
nop dword [eax]
inc esi
and esi, 0x800000ff
jns 0x4026c1
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx edx, cl
add edi, edx
and edi, 0x800000ff
jns 0x4026dd
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], al
mov byte [ebp + edi - 0x108], cl
movzx eax, byte [ebp + esi - 0x108]
mov ecx, dword [ebp - 4]
add eax, edx
movzx eax, al
movzx eax, byte [ebp + eax - 0x108]
xor al, byte [ecx + ebx]
mov byte [ebx], al
inc ebx
sub dword [ebp - 8], 1
jne 0x4026b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4033c0
Capabilities:
Get common file path
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x1000
call fcn.00407cc3
add esp, 4
mov dword [ebp - 8], eax
push 0
call dword [0x4203a8]
push 0x41dc04
mov ebx, eax
push 0x69
push ebx
call dword [0x4203bc]
mov esi, eax
push esi
push ebx
call dword [0x4203c0]
push esi
push ebx
mov edi, eax
call dword [0x420390]
mov ebx, eax
push edi
mov dword [ebp - 0xc], ebx
call dword [0x4203ac]
push 0
mov esi, eax
mov dword [ebp - 0x14], 0x6f536d69
mov dword [ebp - 0x10], 0x646153
call dword [0x4203b0]
push eax
call dword [0x4203a4]
push ebx
call fcn.00407cc3
push ebx
push esi
push eax
mov dword [ebp - 4], eax
call fcn.00404e30
lea esi, [ebx + 1]
push esi
call fcn.00407cc3
push esi
mov edi, eax
push 0
push edi
call fcn.00404780
lea ecx, [ebp - 0x14]
add esp, 0x20
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403460
sub ecx, edx
lea eax, [ebp - 0x14]
push edi
push ecx
mov ecx, dword [ebp - 4]
mov edx, ebx
push eax
call fcn.00402620
mov ebx, dword [ebp - 8]
add esp, 0xc
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
push str._s_stopDebug.jpg
push ebx
call fcn.00401670
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push dword [ebp - 0xc]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004080d0
add esp, 4
push 0x10
push str.Stop_debugging____
push str.Trust_me__when_have_I_ever_tricked_you_
push 0
call dword [0x4203b8]
push 0xffffffffffffffff
call fcn.00407f89
int3