joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe0436f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], edi
cmp ebp, edi
jne 0xe043718
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov edx, dword [esp + 0x42c]
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0xe0536b0
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ebx, dword [esp + 0x18]
shl eax, 2
lea ecx, [eax + eax*8]
mov eax, dword [ebx]
mov dword [esp + 0x1c], ecx
test byte [eax + ecx + 4], 0x20
je 0xe043759
push 2
push 0
push edx
call fcn.0e043970
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0xe0437f5
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0xe04382e
lea esi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0xe0437bc
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0xe0437aa
mov byte [esi], 0xd
inc edi
inc esi
mov byte [esi], al
inc esi
mov eax, esi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0xe043791
lea eax, [esp + 0x24]
push 0
sub esi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xe043824
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, esi
jge 0xe04377c
jmp 0xe04382e
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xe043824
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0xe04382e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0xe0438da
cmp dword [esp + 0x10], 0
je 0xe04388a
cmp dword [esp + 0x10], 5
jne 0xe04386d
call fcn.0e03da60
mov dword [eax], 9
call fcn.0e03da70
mov ecx, dword [esp + 0x10]
pop ebp
pop edi
mov dword [eax], ecx
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0e03d9e0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0xe0438b4
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0xe0438b4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
call fcn.0e03da60
mov dword [eax], 0x1c
call fcn.0e03da70
pop ebp
mov dword [eax], 0
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, edi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x10013074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10013083
pop dword [ebp - 0x34]
mov eax, 0x566c0f42
add eax, 0xb9952141
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x5438fd16
sub dword [ebp - 0x44], 0x5e6b7cb
mov dword [ebp - 0x40], 0x5d7419e5
add dword [ebp - 0x40], 0xd4bf3260
mov dword [ebp - 0x3c], 0x3079d146
sub dword [ebp - 0x3c], 0xe42d8d18
mov dword [ebp - 0x38], 0x3209a7cc
sub dword [ebp - 0x38], 0x3209a7cc
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xf5dabda
add dword [ebp - 0x44], 0x6514bd7c
mov dword [ebp - 0x40], 0xf3be1d0a
add dword [ebp - 0x40], 0x4dae446b
mov dword [ebp - 0x3c], 0x37673fd6
sub dword [ebp - 0x3c], 0xd3f7d36a
mov dword [ebp - 0x38], 0xa5f844df
sub dword [ebp - 0x38], 0xa5f844df
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x13e0a8f8
sub eax, 0x3df585c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x381d8
push 0
call eax
mov ecx, 0xffc0fafc
sub ecx, 0xffc0b512
xor ebx, ebx
add ebx, eax
mov esi, 0x10041c00
add esi, dword [ebp - 0x34]
mov edi, 0xb100be93
sub edi, 0xbc32db5f
add dword [ebp - 4], edi
mov edx, dword [esi]
mov dword [ebp - 0x18], 0xc8dc61b5
sub edx, edi
sub dword [ebp - 0x1c], ecx
mov dword [ebx], edx
xor dword [ebp - 0x18], 0xd06af686
add ebx, 0xa432141c
add ebx, 0x5bcdebe8
add esi, 0x6d398a49
sub esi, 0x6d398a45
loop 0x1001319c
add eax, 0xc60569a6
sub eax, 0xc6045f2b
xor ebx, ebx
add ebx, eax
add eax, 0xe10cd280
add eax, 0x1ef32d85
mov ecx, 0x60478b02
sub ecx, 0x50478b02
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0xd15058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d151a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd1507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd1506a
add dl, dl
jne 0xd15089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd150dc
xor eax, eax
add dl, dl
jne 0xd15096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd1517d
add dl, dl
jne 0xd150a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd150b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd150bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd150c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd150d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd15075
mov eax, 1
add dl, dl
jne 0xd150ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd150f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd150e1
sub eax, ebx
mov ebx, 1
jne 0xd15128
mov ecx, 1
add dl, dl
jne 0xd1510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd15119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd15105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd15075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd1513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd1514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd15136
cmp eax, 0x7d00
jae 0xd1516d
cmp eax, 0x500
jb 0xd15168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd15075
cmp eax, 0x7f
ja 0xd15170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd15075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd1519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd15075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401391
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x406170
call fcn.00401714
mov edi, 0x94
mov eax, edi
call fcn.00402760
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4089e4], ecx
mov eax, dword [esi + 4]
mov dword [0x4089f0], eax
mov edx, dword [esi + 8]
mov dword [0x4089f4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4089e8], esi
cmp ecx, 2
je 0x4013f1
or esi, 0x8000
mov dword [0x4089e8], esi
shl eax, 8
add eax, edx
mov dword [0x4089ec], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40142c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40142c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401444
cmp eax, 0x20b
je 0x401431
mov dword [ebp - 0x1c], esi
jmp 0x401458
cmp dword [ecx + 0x84], 0xe
jbe 0x40142c
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x401452
cmp dword [ecx + 0x74], 0xe
jbe 0x40142c
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00402705
pop ecx
test eax, eax
jne 0x40146c
push 0x1c
call fcn.0040136d
pop ecx
call fcn.004025fc
test eax, eax
jne 0x40147d
push 0x10
call fcn.0040136d
pop ecx
call fcn.00402396
mov dword [ebp - 4], esi
call fcn.00402198
test eax, eax
jge 0x401496
push 0x1b
call fcn.00401348
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4091f4], eax
call fcn.00402076
mov dword [0x4089d0], eax
call fcn.00401fd4
test eax, eax
jge 0x4014bc
push 8
call fcn.00401348
pop ecx
call fcn.00401da1
test eax, eax
jge 0x4014cd
push 9
call fcn.00401348
pop ecx
push 1
call fcn.004018c3
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4014e3
push eax
call fcn.00401348
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401d44
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x401504
movzx eax, word [ebp - 0x40]
jmp 0x401507
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401250
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401525
push edi
call fcn.004019f0
call fcn.00401a12
jmp 0x401557
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040174f
ret
Function at 0x40192d
Capabilities:
Terminate process

Disassembly:
push 8
push 0x406390
call fcn.00401714
push 8
call fcn.00402fc6
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x408a24], esi
jne 0x401961
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x408a20], esi
mov al, byte [ebp + 0x10]
mov byte [0x408a1c], al
cmp dword [ebp + 0xc], edi
jne 0x4019ab
cmp dword [0x4091e8], edi
je 0x40199b
mov eax, dword [0x4091e4]
sub eax, 4
mov dword [0x4091e4], eax
cmp eax, dword [0x4091e8]
jb 0x40199b
mov eax, dword [eax]
cmp eax, edi
je 0x40197c
call eax
jmp 0x40197c
push 0x408020
mov eax, 0x40801c
call fcn.004018ab
pop ecx
push 0x408028
mov eax, 0x408024
call fcn.004018ab
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4019dc
cmp dword [ebp + 0x10], edi
jne 0x4019ea
mov dword [0x408a24], esi
push dword [ebp + 8]
call fcn.00401869
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4019e9
push 8
call fcn.00402f11
pop ecx
ret
call fcn.0040174f
ret

Function at 0x401a30
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x408030]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x408040]
je 0x401a65
inc eax
cmp eax, 0x13
jb 0x401a56
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x408040]
jne 0x401b8b
mov eax, dword [0x4089d8]
cmp eax, 1
je 0x401b63
cmp eax, edx
jne 0x401a95
cmp dword [0x408038], 1
je 0x401b63
cmp ecx, 0xfc
je 0x401b8b
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401acb
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004028a0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00402ad0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x401aff
mov eax, edi
push eax
call fcn.00402ad0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4061b4
push edi
call fcn.004029a0
add esp, 0x10
push edi
call fcn.00402ad0
push dword [esi + 0x408044]
mov ebx, eax
call fcn.00402ad0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00402760
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004028a0
push edi
push ebx
call fcn.004028b0
push 0x4061b0
push ebx
call fcn.004028b0
push dword [esi + 0x408044]
push ebx
call fcn.004028b0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040279d
add esp, 0x2c
jmp 0x401b8b
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x408044]
push dword [esi]
call fcn.00402ad0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040133a
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x40279d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x408b4c], ebx
push esi
push edi
jne 0x40281d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x402858
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x408b4c], eax
je 0x402858
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x408b50], eax
call esi
cmp dword [0x4089e4], 2
mov dword [0x408b54], eax
jne 0x40281d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x408b5c], eax
je 0x40281d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x408b58], eax
mov eax, dword [0x408b58]
test eax, eax
je 0x402862
call eax
test eax, eax
je 0x402849
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x408b5c]
test eax, eax
je 0x402849
test byte [ebp - 8], 1
jne 0x402862
cmp dword [0x4089f0], 4
jb 0x40285c
or byte [ebp + 0x12], 0x20
jmp 0x402881
xor eax, eax
jmp 0x402891
or byte [ebp + 0x12], 4
jmp 0x402881
mov eax, dword [0x408b50]
test eax, eax
je 0x402881
call eax
mov ebx, eax
test ebx, ebx
je 0x402881
mov eax, dword [0x408b54]
test eax, eax
je 0x402881
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x408b4c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402c4a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x402c78
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x402c7f
cmp ebx, dword [eax + 4]
jae 0x402c7f
xor eax, eax
jmp 0x402e6f
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x402c90
xor eax, eax
inc eax
jmp 0x402e6e
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x402ca6
cmp ecx, edx
jae 0x402deb
cmp dword [eax + 4], 0
je 0x402caf
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x402c97
cmp dword [ebp + 8], 0
je 0x402cd1
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x402deb
cmp eax, esi
jae 0x402deb
mov eax, dword [0x408b60]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x402cf6
cmp dword [esi*4 + 0x408b68], edi
je 0x402def
inc esi
cmp esi, eax
jl 0x402ce4
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x402e6b
cmp dword [ebp - 8], 0x1000000
jne 0x402e6b
test byte [ebp - 0xc], 0xcc
je 0x402d74
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x402e6b
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402e6b
cmp word [eax + 0x18], 0x10b
jne 0x402e6b
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x402e6b
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x402d74
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x402d74
test byte [ecx + 0x27], 0x80
jne 0x402deb
push 1
push 0x408ba8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x402c88
mov ecx, dword [0x408b60]
test ecx, ecx
mov edx, ecx
jle 0x402da8
lea eax, [ecx*4 + 0x408b64]
cmp dword [eax], edi
je 0x402da8
dec edx
sub eax, 4
test edx, edx
jg 0x402d9c
test edx, edx
jne 0x402dd9
push 0xf
pop ebx
cmp ecx, ebx
jg 0x402db5
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x402dcd
lea eax, [edx*4 + 0x408b68]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x402dbb
cmp ecx, 0x10
jge 0x402dd9
inc ecx
mov dword [0x408b60], ecx
push 0
push 0x408ba8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x402c88
xor eax, eax
jmp 0x402e6e
test esi, esi
jle 0x402c88
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x408ba8
call ebx
test eax, eax
jne 0x402c88
cmp dword [esi*4 + 0x408b68], edi
je 0x402e45
mov eax, dword [0x408b60]
lea esi, [eax - 1]
test esi, esi
jl 0x402e33
cmp dword [esi*4 + 0x408b68], edi
je 0x402e2f
dec esi
jns 0x402e23
test esi, esi
jge 0x402e43
cmp eax, 0x10
jge 0x402e3e
inc eax
mov dword [0x408b60], eax
lea esi, [eax - 1]
jmp 0x402e45
je 0x402e5d
xor ecx, ecx
test esi, esi
jl 0x402e5d
lea eax, [ecx*4 + 0x408b68]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x402e4b
push 0
push 0x408ba8
call ebx
jmp 0x402c88
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405b19
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402760
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405bb4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4089e4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x405bb4
cmp eax, 1
je 0x405bd5
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405bb4
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x405b81
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x405bb0
xor eax, eax
inc eax
jmp 0x405bf4
cmp edi, eax
jae 0x405bb8
xor eax, eax
jmp 0x405bf4
cmp eax, esi
jae 0x405bbf
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4089e4]
jmp 0x405bd8
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10029bbf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10029bce
pop dword [ebp - 0x2c]
mov eax, 0x10029bce
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa3d77fe0
sub dword [ebp - 0x3c], 0x55853a95
mov dword [ebp - 0x38], 0x3c145812
add dword [ebp - 0x38], 0xf61ef433
mov dword [ebp - 0x34], 0x74f775a
sub dword [ebp - 0x34], 0xbb03332c
mov dword [ebp - 0x30], 0xf5d533bf
add dword [ebp - 0x30], 0xa2acc41
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xcf4eee75
add dword [ebp - 0x3c], 0xa5237ae1
mov dword [ebp - 0x38], 0xa9082779
add dword [ebp - 0x38], 0x986439fc
mov dword [ebp - 0x34], 0xc67a00ab
sub dword [ebp - 0x34], 0x630a943f
mov dword [ebp - 0x30], 0xf785d8bf
sub dword [ebp - 0x30], 0xf785d8bf
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4f3a5
push 0
call eax
mov ecx, 0x4ee9
mov ebx, eax
mov edi, 0x6230faca
add edi, 0xadd3ef36
add edi, dword [ebp - 0x2c]
mov edx, 0xed0a6e21
add edx, 0x590c8975
add dword [ebp - 4], ecx
mov esi, dword [edi]
xor dword [ebp - 0x10], ebx
add esi, edx
xor dword [ebp - 4], edx
mov dword [ebx], esi
xor dword [ebp - 0xc], ebx
add ebx, 0xc51d19ca
add ebx, 0x3ae2e63a
add edi, 0x9c05f37f
sub edi, 0x9c05f37b
loop 0x10029cdb
add eax, 0xce919720
sub eax, 0xce9068a9
mov ebx, eax
add eax, 0xe84bb061
sub eax, 0xe84bb05c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x1003f584
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004acd0]
jne 0x1003f58e
repz ret
jmp fcn.1003fc70
Function at 0x419200
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Parse pe header

Disassembly:
or al, 0x5e
imul esi, ebx, 0x8a34d4d0
add bh, 0xba
call 0x419320
movzx eax, ax
test bl, 0xab
test ah, ch
inc edx
mov cl, 0xfd
rcl al, cl
xchg bl, dh
or bh, cl
bswap ebp
xor esi, ecx
inc edi
mov edi, ebp
imul ecx, ebx
lea esi, [0x44d9b2d2]
lea ebx, [0xc2369a63]
test dl, 0x83
mov edx, 0x7b06aad8
mov dl, bh
imul ecx, ebp
mov ebx, 0xa21d8a9b
mov esi, eax
sar edx, 1
movzx ecx, ax
ror edx, 1
sar ecx, cl
cmp edx, eax
and ecx, 0x24515a46
ror edx, cl
sbb cl, dh
and ecx, edx
sub ecx, ecx
dec esi
imul esi, ecx, 0xf912a011
mov edx, 0xda84
xor edx, 0x93e
shl esi, cl
mov esi, 0xd2bfbd79
test eax, edi
mov esi, edi
movsx esi, cx
test esi, 0x3398c22e
not esi
lea ecx, [edx]
inc edx
imul edx, ebx, 0xbc75f785
sar edx, 1
dec edx
push ecx
imul edx, eax, 0x2b20465
not edx
adc esi, ebx
mov edx, 0x976cd2cd
xor dh, ch
dec edx
test ebp, 0xa5d676f2
pop ebx
test edx, 0xf567a55b
rcr dl, 0x46
rol ch, 0x6e
mov edx, esi
mov esi, edi
lea edi, [ebx]
bswap esi
or dl, dh
mov ecx, 0x6784beb1
dec ebx
lea ecx, [0x5ca3315d]
mov ecx, esi
and ebx, ecx
xchg dh, cl
shl cl, 0xef
sar ebx, cl
lea ebp, [edi]
mov ecx, 0x639d15fc
imul edi, ecx
lea ecx, [0xe64b0ace]
bswap esi
xor eax, ebp
bswap edx
and ecx, edi
movzx ebx, dx
lea ebx, [0xdb04082c]
mov ebp, eax
bswap ecx
xchg ch, bl
test edx, eax
bswap esi
imul edx, ebx, 0x42e68302
rol bh, 1
inc edx
mov al, al
lea edi, [0x6b358865]
inc ebp
inc ecx
sal ch, cl
bswap esi
test bl, bh
sal bl, 0xc5
adc edx, ebx
movsx ecx, di
pop eax
imul ebx, esi
call fcn.00471141
pop ebx
rcl ebp, cl
jmp fcn.0045b130
Function at 0x419320
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Encode data using xor
Encrypt data using des
Parse pe header

Disassembly:
or al, 0x5e
imul esi, ebx, 0x8a34d4d0
add bh, 0xba
call 0x419320
movzx eax, ax
test bl, 0xab
test ah, ch
inc edx
mov cl, 0xfd
rcl al, cl
xchg bl, dh
or bh, cl
bswap ebp
xor esi, ecx
inc edi
mov edi, ebp
imul ecx, ebx
lea esi, [0x44d9b2d2]
lea ebx, [0xc2369a63]
test dl, 0x83
mov edx, 0x7b06aad8
mov dl, bh
imul ecx, ebp
mov ebx, 0xa21d8a9b
mov esi, eax
sar edx, 1
movzx ecx, ax
ror edx, 1
sar ecx, cl
cmp edx, eax
and ecx, 0x24515a46
ror edx, cl
sbb cl, dh
and ecx, edx
sub ecx, ecx
dec esi
imul esi, ecx, 0xf912a011
mov edx, 0xda84
xor edx, 0x93e
shl esi, cl
mov esi, 0xd2bfbd79
test eax, edi
mov esi, edi
movsx esi, cx
test esi, 0x3398c22e
not esi
lea ecx, [edx]
inc edx
imul edx, ebx, 0xbc75f785
sar edx, 1
dec edx
push ecx
imul edx, eax, 0x2b20465
not edx
adc esi, ebx
mov edx, 0x976cd2cd
xor dh, ch
dec edx
test ebp, 0xa5d676f2
pop ebx
test edx, 0xf567a55b
rcr dl, 0x46
rol ch, 0x6e
mov edx, esi
mov esi, edi
lea edi, [ebx]
bswap esi
or dl, dh
mov ecx, 0x6784beb1
dec ebx
lea ecx, [0x5ca3315d]
mov ecx, esi
and ebx, ecx
xchg dh, cl
shl cl, 0xef
sar ebx, cl
lea ebp, [edi]
mov ecx, 0x639d15fc
imul edi, ecx
lea ecx, [0xe64b0ace]
bswap esi
xor eax, ebp
bswap edx
and ecx, edi
movzx ebx, dx
lea ebx, [0xdb04082c]
mov ebp, eax
bswap ecx
xchg ch, bl
test edx, eax
bswap esi
imul edx, ebx, 0x42e68302
rol bh, 1
inc edx
mov al, al
lea edi, [0x6b358865]
inc ebp
inc ecx
sal ch, cl
bswap esi
test bl, bh
sal bl, 0xc5
adc edx, ebx
movsx ecx, di
pop eax
imul ebx, esi
call fcn.00471141
pop ebx
rcl ebp, cl
jmp fcn.0045b130