joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100080c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd5
mov dword [ebp - 8], 0
jmp 0x100080e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1d
jge 0x10008121
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4e6c4019]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000811c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100080d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10008140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x46
mov dword [ebp - 8], 0
jmp 0x10008162
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jge 0x100081a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x7103400e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000819c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10008159
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100081c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbd
mov dword [ebp - 8], 0
jmp 0x100081e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jge 0x10008221
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0xdffee7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000821c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100081d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c0be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10049780]
jne 0x1000c0c8
repz ret
jmp fcn.1000c52c
Function at 0x1000d9f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000daf8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1000daf8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1000daf8
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 2
je 0x1000da39
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1000da2d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 4
jne 0x1000da2d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000da68
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 2
jne 0x1000da2d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x1000dac3
cmp eax, 0x8664
jne 0x1000da2d
push 0x108
push ebx
push edi
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 0x108
jne 0x1000da2d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 0xf8
jne 0x1000da2d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001700
Capabilities:
Open clipboard

Disassembly:
add dword [0x1003b8a8], esp
call fcn.1000171a

Function at 0x1000170b
Capabilities:
Open clipboard

Disassembly:
mov eax, esi
push eax
pop dword [0x1003b898]
jmp fcn.10001120

Function at 0x100030b7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003be28]
jne 0x100030c1
repz ret
jmp fcn.10004bab

Function at 0x10005e9f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100031bc
and dword [ebp - 4], 0
cmp dword [0x1003d378], 0
mov ebx, eax
jne 0x10005f50
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006001
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10006001
push eax
call fcn.1000314a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003d378], eax
call esi
push eax
call fcn.1000314a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003d37c], eax
call esi
push eax
call fcn.1000314a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003d380], eax
call esi
push eax
call fcn.1000314a
pop ecx
mov dword [0x1003d388], eax
test eax, eax
je 0x10005f50
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000314a
pop ecx
mov dword [0x1003d384], eax
mov eax, dword [0x1003d384]
cmp eax, ebx
je 0x10005fa8
cmp dword [0x1003d388], ebx
je 0x10005fa8
push eax
call fcn.100031c5
push dword [0x1003d388]
mov esi, eax
call fcn.100031c5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10005fa8
test edi, edi
je 0x10005fa8
call esi
test eax, eax
je 0x10005f9f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10005f9f
test byte [ebp - 0xc], 1
jne 0x10005fa8
or dword [ebp + 0x10], 0x200000
jmp 0x10005fe1
mov eax, dword [0x1003d37c]
cmp eax, ebx
je 0x10005fe1
push eax
call fcn.100031c5
pop ecx
test eax, eax
je 0x10005fe1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10005fe1
mov eax, dword [0x1003d380]
cmp eax, ebx
je 0x10005fe1
push eax
call fcn.100031c5
pop ecx
test eax, eax
je 0x10005fe1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003d378]
call fcn.100031c5
pop ecx
test eax, eax
je 0x10006001
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10006003
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008300
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1003b8b8], 0
mov byte [0x1003b8bc], 0
mov dword [0x1003b8b4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10008356
mov eax, 0x1fdd
xor ecx, ecx
mov dword [0x1003b8b4], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x10008388
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1003b8ac], 0x1fdd
mov eax, dword [0x1003b8b4]
add eax, 1
mov dword [0x1003b8b4], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10008356
jmp 0x1000833d
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
add ecx, 0xfffff6b9
mov dword [0x1003b8c0], 0
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x1003b8b8]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1003b8c0], esi
mov dword [0x1003b8b0], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x2c]
idiv esi
mov dword [0x1003b8b8], edx
mov dword [0x1003b8ac], ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [ebx + ecx]
mov byte [0x1003b8bc], cl
mov dword [0x1003b8b0], 0xe30
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x28]
mov byte [ebx + edx], cl
mov ecx, dword [0x1003b8b0]
add ecx, 0xfffffd81
mov dword [0x1003b8ac], ecx
mov cl, byte [0x1003b8bc]
mov edx, dword [0x1003b8b8]
mov byte [ebx + edx], cl
mov edx, dword [0x1003b8b4]
add edx, 1
mov dword [0x1003b8b4], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jge 0x10008461
mov eax, dword [0x1003b8ac]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x10008388
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008d30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1003b8ac], 0x512
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10008d9f
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x10008d9f
jmp 0x10008db5
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x10008e39
jmp 0x10008e2a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x10008d66
mov eax, dword [ebp - 0x18]
mov dword [0x1003b8b0], 0x11c4
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x10008e2a
mov dword [0x1003b8b0], 0x2624
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10008e2a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10008e2a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10008e2a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10008e2a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10008d7f
xor eax, eax
mov dword [0x1003b8b0], 0x1864
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x10009170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1003b8b4], 0
mov dword [0x1003b8b8], 0
mov dword [0x1003b8c4], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x100092cd
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x100091cb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x1003b8ac], 0x1e8a
mov edi, eax
add edi, 1
add edx, 1
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1003b8b4], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1003b8b8], edx
mov dword [0x1003b8ac], 0x40c5
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x1003b8bc], cl
mov dword [0x1003b8b0], 0x471
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1003b8bc]
mov edx, dword [0x1003b8b8]
mov byte [ebx + edx], cl
mov edx, dword [0x1003b8b4]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1003b8b8]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1003b8c4], ecx
mov dword [0x1003b8ac], 0x1cd9
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
mov ch, byte [edx + esi]
mov dword [0x1003b8b0], 0xbad
mov dword [0x1003b8ac], 0x1439
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x34], edi
je 0x100092cb
mov eax, dword [0x1003b8b8]
mov ecx, dword [0x1003b8b4]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x100091cb
jmp 0x100092cd
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100092e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x1003b8ac], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10008640
lea ecx, [0x10008cd0]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x48], 0x124c00
mov edx, dword [0x1003b898]
mov dword [esp + 0x70], edx
mov edx, dword [0x1003b89c]
mov dword [esp + 0x80], edx
mov edx, dword [0x1003b8a0]
mov dword [esp + 0x68], edx
mov edx, dword [0x1003b8a4]
mov dword [esp + 0x84], edx
mov edx, dword [0x1003b8a8]
mov dword [esp + 0x54], edx
mov dword [0x1003b8ac], 0x212d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x100093d0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x1000939e
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x100093d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [0x1003b8b0], 0x1fcc
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x64], eax
call fcn.10008d30
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
je 0x100093e1
jmp 0x10009418
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x10009372
jmp 0x1000938a
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10007c90
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1003b8ac], 0x1ed4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408e54
nop
nop
mov ecx, 0x718f0b63
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x3da72304
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1000d9f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000daf8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1000daf8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1000daf8
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 2
je 0x1000da39
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1000da2d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 4
jne 0x1000da2d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000da68
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 2
jne 0x1000da2d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x1000dac3
cmp eax, 0x8664
jne 0x1000da2d
push 0x108
push ebx
push edi
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 0x108
jne 0x1000da2d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.1000c730
add esp, 0x10
cmp eax, 0xf8
jne 0x1000da2d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4031d4
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
call fcn.004031a0
push str.LocalFastMM_PID________
push 0
push 4
call sub.KERNEL32.DLL_OpenFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x4031f4
xor eax, eax
pop esi
pop ebx
ret
push 0
push 0
push 0
push 4
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, dword [eax]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop esi
pop ebx
ret

Function at 0x403280
Capabilities:
Read file via mapping

Disassembly:
push ebx
call fcn.00402870
test eax, eax
jne 0x4032dd
cmp dword [0x412408], 0
jne 0x4032dd
call fcn.004031d4
test eax, eax
jne 0x4032d9
push str.LocalFastMM_PID________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
push 0
push 0
push 0
mov ebx, eax
push 2
push ebx
mov dword [0x412408], ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [eax], fcn.00403896
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x403a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor byte [ebx - 0x74a8f78b], cl
inc esi
or al, 0x85
sal byte [ebp + 0x22], 0x87
xchg byte [ebp + 2], bl
adc al, byte [eax]
test eax, eax
add dword [eax], ebx
bound esi, qword [edx + eax - 0x3fbcffbf]
setge byte [ecx + eax]
add byte [eax - 0x5d], cl
mov ah, 2
inc ecx
add cl, ch
mov byte [ecx], al
xor ebp, edi
cmp dword [0x4002b4], 1
jne 0x403ad7
mov eax, dword [esi + 0x10]
mov dword [0x4102d4], eax
jmp 0x403afb
mov ecx, dword [esi + 0x10]
mov eax, dword [0xf3a6027c]
cmp ecx, eax
je 0x403afb
mov ecx, dword [0x4102b8]
mov eax, dword [0x451602c0]
inc ecx
inc eax
mov dword [0x1902b8], ecx
mov dword [0x174102c0], eax
mov eax, dword [0x4181ac]
mov ecx, dword [0x40d0e8]
cmp eax, ecx
or eax, 0x201178d
mov edx, dword fs:[0x9d0bc8]
mov edi, eax
shl edi, 5
add edi, edx
inc eax
sub byte [edx + eax - 0x2517ffbf], ch
add byte cs:[eax], al
call fcn.00406a00
mov dword [0x410ba0], eax
mov dword [0x411251], edx
out 0x10, al
push eax
or byte [eax], al
add byte [esi + 0x410bc015], al
add byte [esi - 0x7a], al
xor byte [eax], cl
add byte [eax], al
mov dword [esi + 0x140a54], edx
mov ebx, esi
mov ecx, dword [esi + 0x834]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 0x838]
mov eax, dword [esi + 0x830]
mov edx, dword [esi + 0x84c]
sub ecx, eax
mov eax, dword [esi + 0x83c]
sbb eax, edx
test eax, eax
jg 0x403b21
jl 0x403b7a
test ecx, ecx
jae 0x403b7e
xor ecx, ecx
xor esp, esi
mov dword [edi + 0x7e], ecx
mov dword [edi + 0x14], eax
mov ecx, dword [esi + 0x850]
mov esi, dword [esi]
xor byte [eax], cl
add byte [ecx + 0x810968b], cl
add byte [eax], al
sub esi, esi
mov eax, dword [esi + 0x854]
sbb eax, edx
test dword [edi + edi*2 + 0xa], esi
jl 0x403baa
test ecx, ecx
imul ebx, dword [edx - 0x3fcc36d7], 0x89184f89
inc edi
sbb al, 0x8b
invalid
sub ecx, ecx
xor eax, eax
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], eax
mov ecx, dword [esi + 0x2008f8]
mov eax, dword [esi + 0x809]
mov edx, dword [esi + 0x844]
sub ecx, eax
mov eax, dword [eax + 0x36084c]
sbb eax, edx
test eax, eax
jg 0x403bf0
movsd dword es:[edi], dword [esi]
add al, 0x85
leave
jae 0x403bde
xor ecx, ecx
xor edi, dword [ecx + ecx*4]
dec edi
or byte [ecx + 0xd8b0c47], cl
adc al, 0xd0
inc eax
add byte [ebp - 0x74c88037], al
sbb dword [ebx - 0x74ffbefe], ebp
nop
cdq
idiv ecx
test ebp, esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], eax
mov ecx, dword [0x40d014]
test ecx, ecx
jg 0x403c25
mov ebx, dword [ecx]
stosd dword es:[edi], eax
add al, byte [ecx]
mov edx, dword [eax - 0x7a060867]
cmc
aam 0x7a
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push edi
and dword [eax + eax*2], 0x68
inc eax
call 0xff923c4e
pop edi
sub byte [eax + eax*2], 0xa1
enter 0x33c0, 0
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
or dword [ebp + 0x17f8a1e4], 0x41
add byte [ebx + 0x553a044e], cl
in al, dx
mov eax, dword [0x4117f8]
mov ecx, dword [esi + 4]
cmp dl, byte [ebp - 0x14]
ret 0xf045
Function at 0x40a677
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, ebx
or al, 0x89
pop ebp
call 0x7bcbaa6c
adc byte [ebx - 0x13b20be9], cl
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x10], edx
mov dword [edi], esi
mov eax, dword [edi + eax]
les ebp, [edx + 0x52564755]
push eax
call 0x9140abc9
mov ecx, dword [ebp - 4]
mov edi, edx
in al, dx
sub eax, ecx
add edi, 0x1b
add esi, eax
jne 0x40a6f2
inc edi
dec eax
mov dword [ebp + 0xc], eax
jne 0x40a6b0
inc ebp
or al, 0x75
push esp
int3
outsb dx, byte [esi]
loope 0x40a6cf

Function at 0x40a819
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx ecx, word [edx + 0x26]
mov esi, dword [edx + 0x28]
jmp 0x40a749
xor edi, edi
nop
jmp 0x40a75b
nop
jmp 0x40a767
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x40a777
cmp al, 0x61
nop
jmp 0x40a786
jl 0x40a79a
jmp 0x40a798
sub al, 0x20
jmp 0x40a7a8
ror edi, 0xd
add edi, eax
nop
dec ecx
jmp 0x40a7bb
jne 0x40a75b
jmp 0x40a7d0
jmp 0x40a7da
push edx
jmp 0x40a7e5
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
jmp 0x40a7fd
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
jmp 0x40a812
je 0x40a9c6
nop
jmp 0x40a824
add eax, edx
jmp 0x40a837
mov ecx, dword [eax + 0x18]
nop
push eax
mov ebx, dword [eax + 0x20]
jmp 0x40a849
add ebx, edx
nop
jmp 0x40a85b
nop
jmp 0x40a868
test ecx, ecx
nop
je 0x40a9af
nop
xor edi, edi
nop
jmp 0x40a885
dec ecx
nop
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
xor eax, eax
ror edi, 0xd
jmp 0x40a89d
lodsb al, byte [esi]
add edi, eax
nop
cmp al, ah
jmp 0x40a8b4
jne 0x40a88d
nop
jmp 0x40a8c9
add edi, dword [ebp - 8]
nop
jmp 0x40a8db
cmp edi, dword [ebp + 0x24]
jne 0x40a85b
jmp 0x40a8f0
jmp 0x40a902
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
jmp 0x40a916
add ebx, edx
nop
jmp 0x40a929
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
nop
jmp 0x40a946
mov eax, dword [ebx + ecx*4]
jmp 0x40a957
add eax, edx
nop
mov dword [esp + 0x24], eax
pop ebx
jmp 0x40a96d
pop ebx
nop
popal
pop ecx
nop
jmp 0x40a986
pop edx
jmp 0x40a996
push ecx
nop
jmp eax
nop
jmp 0x40a9c4
pop eax
nop
nop
jmp 0x40a9d8
pop edi
jmp 0x40a9e9
pop edx
mov edx, dword [edx]
jmp 0x40a9fb
jmp 0x40a734
Function at 0x8e13f0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e13f6
pop ebp
sub ebp, 6
sub ebp, 0x4e13f0
jmp 0x8e1454
jmp 0x8e145d
mov eax, 0x4e13f0
add eax, ebp
add eax, 0x93
mov ecx, 0x61f
mov edx, 0x4a270d86
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e1474
jmp 0x8e1487
in al, dx
invalid