joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468784
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x484dd4
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4687a3
mov esi, 1
mov edx, 0x484edc
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x46881d
dec ebx
je 0x468841
dec ebx
je 0x468865
dec ebx
je 0x468888
jmp 0x4688a1
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4688a1
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4688a1
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4688a1
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x46880a
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4687bf
mov esi, 0x20
mov eax, 0x484e04
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4688c6
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x468900
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x484e8b]
test bl, bl
jbe 0x468931
lea eax, [esi + 0x3e0]
call fcn.004688e0
lea eax, [esi + 0x3fc]
call fcn.004688e0
dec bl
jne 0x468917
mov cl, 0x30
mov edi, 0x484e5c
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x468953
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x468962
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x46893b
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x468970
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.00468718
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x46898c
mov bl, 0x1c
mov esi, 0x484e24
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.00468718
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.00468718
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4689a8
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.00468900
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4689d0
mov bl, 1
mov eax, 0x484d54
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x468a09
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x468a16
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4689f5
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x468a40
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.00468784
jmp 0x468a68
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.00468784
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x468a70
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x468a28
mov bl, 0x40
mov esi, 0x484d94
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x468ad6
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x468ae5
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x468abe
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.00468740
inc ebx
inc esi
cmp bl, 0x41
jne 0x468af3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46aa48
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x46aaf4
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x46aaef
mov eax, ebp
mov edx, 8
call fcn.00403f20
push 1
mov eax, ebp
call fcn.00403e1c
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.00468970
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46b0dc
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
lea ebx, [ebp - 0x60]
xor eax, eax
push ebp
push 0x46b30f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.0046a9e8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0046a9e8
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0046a9e8
mov eax, ebx
xor ecx, ecx
mov edx, 0x40
call fcn.00402b08
mov edx, ebx
mov ecx, 8
mov eax, 0x46b328
call fcn.004027e8
mov dword [ebx + 8], 3
mov eax, dword [ebp - 0x18]
call fcn.00403c4c
mov edi, eax
mov word [ebx + 0x1c], di
mov word [ebx + 0x1e], di
mov dword [ebx + 0x20], 0x40
mov eax, dword [ebp - 0x20]
call fcn.00403c4c
mov edi, eax
mov word [ebx + 0x24], di
mov word [ebx + 0x26], di
movzx eax, word [ebx + 0x1c]
add eax, dword [ebx + 0x20]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0x1c]
call fcn.00403c4c
mov edi, eax
mov word [ebx + 0x2c], di
mov word [ebx + 0x2e], di
movzx eax, word [ebx + 0x24]
add eax, dword [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov ax, 0x18
mov word [ebx + 0xc], ax
mov word [ebx + 0xe], ax
movzx eax, word [ebx + 0x2c]
add eax, dword [ebx + 0x30]
mov dword [ebx + 0x10], eax
mov word [ebx + 0x14], 0x18
mov ax, word [ebx + 0xc]
mov word [ebx + 0x16], ax
movzx eax, word [ebx + 0xc]
add eax, dword [ebx + 0x10]
mov dword [ebx + 0x18], eax
mov word [ebx + 0x34], 0
mov word [ebx + 0x36], 0
xor eax, eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0x8205
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0046ab48
mov edx, dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov ecx, 0xff
call fcn.00403c28
lea edx, [ebp - 0x1a0]
lea eax, [ebp - 0x7f]
mov cl, 0x1e
call fcn.004029e4
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0046acd8
mov edx, dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov ecx, 0xff
call fcn.00403c28
lea edx, [ebp - 0x1a0]
lea eax, [ebp - 0x9e]
mov cl, 0x1e
call fcn.004029e4
lea eax, [ebp - 0x14]
mov edx, 0x40
call fcn.00403f20
lea eax, [ebp - 0x14]
call fcn.00403e1c
mov edx, eax
mov eax, ebx
mov ecx, 0x40
call fcn.004027e8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1a4]
lea edx, [ebp - 0x7f]
call fcn.00403bf0
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a8]
lea edx, [ebp - 0x9e]
call fcn.00403bf0
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x14]
mov edx, 6
call fcn.00403d0c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
call fcn.00469818
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b316
lea eax, [ebp - 0x1a8]
mov edx, 2
call fcn.004039f4
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004039f4
ret
Function at 0x46b6c8
Capabilities:
Hash data using sha1

Disassembly:
test eax, eax
jne 0x46b6d2
mov eax, 1
ret
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x60], edx
xor edx, edx
mov dword [eax + 0x64], edx
xor eax, eax
ret

Function at 0x46b804
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff0c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x49]
xor ecx, ecx
mov edx, 0x41
call fcn.00402b08
lea eax, [ebp - 0x8a]
xor ecx, ecx
mov edx, 0x41
call fcn.00402b08
cmp ebx, 0x40
jle 0x46b88d
lea eax, [ebp - 0xf4]
call fcn.0046b6c8
mov edx, esi
lea eax, [ebp - 0xf4]
mov ecx, ebx
call fcn.0046b77c
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
call fcn.0046b710
lea edx, [ebp - 0x49]
mov eax, dword [ebp + 8]
mov ecx, 0x14
call fcn.004027e8
lea edx, [ebp - 0x8a]
mov eax, dword [ebp + 8]
mov ecx, 0x14
call fcn.004027e8
jmp 0x46b8a8
lea edx, [ebp - 0x49]
mov eax, esi
mov ecx, ebx
call fcn.004027e8
lea edx, [ebp - 0x8a]
mov eax, esi
mov ecx, ebx
call fcn.004027e8
mov ecx, 0x40
lea eax, [ebp - 0x49]
lea edx, [ebp - 0x8a]
xor byte [eax], 0x36
xor byte [edx], 0x5c
inc edx
inc eax
dec ecx
jne 0x46b8b6
lea eax, [ebp - 0xf4]
call fcn.0046b6c8
lea edx, [ebp - 0x49]
lea eax, [ebp - 0xf4]
mov ecx, 0x40
call fcn.0046b77c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xf4]
mov ecx, dword [ebp - 8]
call fcn.0046b77c
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
call fcn.0046b710
lea eax, [ebp - 0xf4]
call fcn.0046b6c8
lea edx, [ebp - 0x8a]
lea eax, [ebp - 0xf4]
mov ecx, 0x40
call fcn.0046b77c
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
mov ecx, 0x14
call fcn.0046b77c
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
call fcn.0046b710
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405e91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
test esp, ebx
clc
invalid
dec dword [eax - 0x3a]
test ebp, ebx
clc
invalid
call [esi + eax*8 - 0x7b]
fdivp st(0)
invalid
call dword [ecx - 0x3a]
test edi, ebx
clc
invalid
jmp [ebp - 0x3a]
test eax, esp
clc
invalid
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
invalid
dec ecx
dec ecx
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004049ca
scasb al, byte es:[edi]
sti
pushal
jmp 0x405e45
Function at 0x40654e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x406a70
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x406545
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.004049da
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.004049da
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.0040493b
add esp, 0xc
lea eax, [ebp - 0x504]
mov dword [ebp - 0x3a0], eax
jmp 0x406942
cmp dword [ebp - 0x6fc], 1
jne 0x4065f6
movsb byte es:[edi], byte [esi]
add byte [eax], al
invalid
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.004049da
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.0040493b
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x406942
cmp dword [ebp - 0x6fc], 2
jne 0x4066b3
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
invalid
test dword [eax - 8], ebp
invalid
Function at 0x40107e
Capabilities:
Delete file
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x4356c8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4356cc]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
call fcn.00401077
mov eax, dword [0x4356d0]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4356d4]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
jmp 0x4010d3
xor ecx, ecx
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x444914], 0xc
mov dword [ebp - 4], eax
jne 0x4010fd
push ecx
lea eax, [ebp - 0x30]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x444914]
cmp eax, 0xfa9
jne 0x401119
mov dword [0x444910], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40113a
push str.komovavukuniburubawumukoni
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x444868], 0
lea eax, [ebx + edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [0x44490c], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
cmp dword [0x444914], 0xb03
jne 0x4011bb
push str.ruyenemilimusibubigukexem
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
add ebx, 0x61c88647
sub edi, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
jne 0x4010d1
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x4073e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43483c]
jne 0x4073ea
repz ret
jmp fcn.0040b7ef

Function at 0x40b1dd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d77
and dword [ebp - 4], 0
cmp dword [0x439904], 0
mov ebx, eax
jne 0x40b28e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b33f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b33f
push eax
call fcn.00405d05
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x439904], eax
call esi
push eax
call fcn.00405d05
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x439908], eax
call esi
push eax
call fcn.00405d05
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43990c], eax
call esi
push eax
call fcn.00405d05
pop ecx
mov dword [0x439914], eax
test eax, eax
je 0x40b28e
push 0x430f18
push edi
call esi
push eax
call fcn.00405d05
pop ecx
mov dword [0x439910], eax
mov eax, dword [0x439910]
cmp eax, ebx
je 0x40b2e6
cmp dword [0x439914], ebx
je 0x40b2e6
push eax
call fcn.00405d80
push dword [0x439914]
mov esi, eax
call fcn.00405d80
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2e6
test edi, edi
je 0x40b2e6
call esi
test eax, eax
je 0x40b2dd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2dd
test byte [ebp - 0xc], 1
jne 0x40b2e6
or dword [ebp + 0x10], 0x200000
jmp 0x40b31f
mov eax, dword [0x439908]
cmp eax, ebx
je 0x40b31f
push eax
call fcn.00405d80
pop ecx
test eax, eax
je 0x40b31f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b31f
mov eax, dword [0x43990c]
cmp eax, ebx
je 0x40b31f
push eax
call fcn.00405d80
pop ecx
test eax, eax
je 0x40b31f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439904]
call fcn.00405d80
pop ecx
test eax, eax
je 0x40b33f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b341
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407601
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x407610
pop dword [ebp - 0x20]
mov eax, 0x28fe51b1
sub eax, 0x28bddba1
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3b1d8
push 0
mov eax, 0x78c2c1c3
add eax, 0x877e1f15
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x10793cfb
add ecx, 0xef871254
xor edx, edx
add edx, eax
mov ebx, 0x328cada0
sub ebx, 0x324b71dc
add ebx, dword [ebp - 0x20]
mov esi, 0x1b107a0d
sub esi, 0x7f67a218
mov edi, dword [ebx]
xor edi, esi
sub dword [ebp - 0x14], ecx
mov dword [edx], edi
sub dword [ebp - 0x18], 0x292d6527
add edx, 0x47321f7f
sub edx, 0x47321f7b
add ebx, 0x89216d30
add ebx, 0x76de92d4
loop 0x407671
add eax, 0x77507a3d
add eax, 0x88b0b5d2
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x79b660
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23c000]
lea eax, [edi + 0x284844]
push dword [eax]
mov dword [eax], 0x28f8c000
push eax
push edi
jmp 0x79b68a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x79b691
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x79b680
mov eax, 1
add ebx, ebx
jne 0x79b6a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x79b6b4
jne 0x79b6d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x79b6d3
dec eax
add ebx, ebx
jne 0x79b6c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x79b698
add ebx, ebx
jne 0x79b6cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x79b725
xor ecx, ecx
sub eax, 3
jb 0x79b6eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x79b75a
sar eax, 1
mov ebp, eax
jmp 0x79b6f6
add ebx, ebx
jne 0x79b6f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x79b6c4
inc ecx
add ebx, ebx
jne 0x79b704
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x79b6c4
add ebx, ebx
jne 0x79b711
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x79b706
jne 0x79b722
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x79b706
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x79b744
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x79b736
jmp 0x79b686
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x79b744
add edi, ecx
jmp 0x79b686
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xdb54
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x79b766
cmp byte [edi], 0x71
jne 0x79b766
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x79b76b
lea edi, [esi + 0x398000]
mov eax, dword [edi]
or eax, eax
je 0x79b7e3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a067c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3a0814]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x79b798
mov ecx, edi
jns 0x79b7c7
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3a081c]
or eax, eax
je 0x79b7dd
mov dword [ebx], eax
add ebx, 4
jmp 0x79b7b5
call dword [esi + 0x3a0818]
mov ebp, dword [esi + 0x3a0820]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x79b817
sub esp, 0xffffff80
jmp 0x54cd52