joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa2d9c1
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
nop
stc
cmp edx, esp
nop
nop
cmp esp, 0x381d2491
cmc
nop
nop
nop
test dl, 0xe8
clc
cmp esp, 0xa227f4b
nop
jmp 0xf37d43
push ebp
mov ebp, esp
test bh, 0x98
cmp ebp, edx
cmp ah, 0x40
sub esp, 8
mov dword [ebp - 4], 0
jmp 0xfd50fa
jmp loc.00444bb3
nop
cmp dx, di
nop
cmc
jmp 0xf39d6d
nop
cmp ch, cl
nop
nop
pushal
rdtsc
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, edi
mov eax, 2
mov edi, 0x5c0e6444
btr cx, 0xce
mov eax, 5
bt ebx, esi
shld ebx, ecx, 0xf1
mov eax, 4
bt di, di
mov eax, 2
movsx ecx, cx
mov eax, 5
bt ecx, 0x1c
mov eax, 6
popal
ror ax, 0xb5
push edx
mov edx, 1
shrd ax, bx, 5
ror dh, 0x7c
cwde
mov edx, 2
xor ebx, edi
cbw
cmp edx, 0x4eca6314
mov edx, 4
clc
shld dx, si, 0xad
mov edx, 2
mov edx, 5
neg ah
xor edx, esi
mov edx, 4
not bx
mov edx, 2
cmc
bts bx, ax
cmp di, 0x5224
mov edx, 5
cwd
movsx edx, bp
movsx dx, ch
mov edx, 5
pop edx
btc ebx, ecx
sub ebx, ebx
xadd ah, bl
push edx
add ax, bp
rol bh, 0x51
rdtsc
bt bx, di
cmp esp, 0x44af1a43
xor eax, eax
cmovg ebx, edi
xchg bx, bx
mov al, dh
movzx ebx, dx
movzx bx, ah
mov dword [ebp - 4], eax
cdq
setne dh
pop edx
jmp 0x1047421
jmp 0x93a189
push 0x80000301
movsx bx, bh
push 0
movsx bx, al
movzx ebx, di
mov bh, 0x83
push dword [ebp - 4]
movzx bx, bl
bswap bx
cmovs ebx, edi
push 1
bswap bx
movsx ebx, di
mov ebx, 0x485d20
jmp 0x1048011
call fcn.00484dd4
add esp, 0x10
jmp 0xe8bb06
Function at 0xa31a13
Capabilities:
Packed with generic packer

Disassembly:
call fcn.00484dd4
add esp, 0x10
mov dword [ebp - 0xc], eax
not bh
setb bl
movsx ebx, bx
push 0x80000301
jmp 0xcca8a0
push ebp
bts bp, si
jmp 0xd30d2e
mov eax, dword [ebp - 0x14]
jmp 0xc07894
mov dword [ebp - 8], 0
jmp 0xbd7234
je 0xf52661
push ebx
jmp 0xf52655
nop
nop
nop
nop
test bl, bh
nop
stc
clc
nop
test edx, ebx
stc
nop
nop
clc
nop
test bx, si
nop
jmp 0xdd7cc1
jmp 0x444d2f
push 0
not bl
push dword [ebp - 8]
push 1
movzx ebx, cx
mov ebx, 0x4868c0
call fcn.00484dd4
add esp, 0x10
mov dword [ebp - 0x10], eax
setb cl
bswap cx
push dword [ebp - 0x10]
not ch
movzx cx, dh
seto cl
push dword [ebp - 0xc]
xchg cx, cx
mov cx, bx
jmp 0xed6384
mov ebp, esp
test dh, dh
cmp cx, sp
clc
sub esp, 0x14
jmp 0xe210ac
call fcn.00484dce
add esp, 4
jmp 0xabf227
nop
cmp ebp, ebp
nop
pushal
rcl ch, 0xdc
mov eax, 1
rol edi, 0x5f
sbb edx, ecx
add ch, 0xc9
mov eax, 2
not edi
mov eax, 4
add cx, dx
test di, 0x625
mov eax, 2
mov eax, 5
cmp bh, 0x7a
rcr al, cl
mov bp, 0x7e02
mov eax, 4
mov ch, 0x37
mov eax, 2
mov eax, 5
shl esi, 0xa5
dec ebp
mov eax, 6
or si, di
movzx bx, dl
adc esi, ebx
popal
shrd eax, ecx, 0xaf
sar al, 0x9d
push edx
ror dl, cl
mov edx, 1
mov edx, 2
sal ah, 0xb3
shr ax, cl
mov edx, 4
mov al, dh
sar dl, cl
mov ax, 0x1480
mov edx, 2
bsr ax, dx
xadd dl, ah
cbw
mov edx, 5
sal ax, 0x6f
sar dx, 0xf9
mov edx, 4
bswap edx
ror al, cl
bt ax, bx
mov edx, 2
inc dx
mov edx, 5
bt dx, 0x30
mov edx, 5
btc edx, ebp
pop edx
sar ah, cl
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
clc
push ebx
inc bl
xor bx, ax
cmp esi, esi
push ecx
sar al, cl
shl al, 0x9e
rcr cl, 0xe7
push edx
shrd bx, bx, 0x95
ror dh, 0x1b
mov eax, reloc.oleaut32.dll_SysStringLen
movzx ebx, ax
cwd
cpuid
sal bl, cl
shr ecx, 0x10
btc ebx, ecx
mov dword [ebp - 4], ecx
inc dl
pop edx
inc cx
pop ecx
pop ebx
nop
nop
push ebx
shl bx, cl
push ecx
xor cl, 0x1b
movsx ebx, cx
shr bh, 0x64
push edx
movsx ecx, ax
mov eax, reloc.WS2_32.dll_getpeername
not bx
cmc
cpuid
xor bx, 0x78d0
shr edx, 0x18
shr ecx, 0x18
shr bh, 0xad
add edx, ecx
mov dword [ebp - 8], edx
mov dx, bp
bswap ecx
pop edx
not bx
setg cl
pop ecx
pop ebx
not bx
cmovs bx, ax
push 0x80000301
push 0
xchg ebx, ebx
bswap bx
push dword [ebp - 4]
not bl
mov bx, bp
push 1
mov ebx, 0x4868c0
jmp 0x99a7c1
mov dword [ebp - 4], 0
jmp 0xb66705
mov ecx, 2
call fcn.004034fd
add esp, 8
adc bh, 0x6b
sal ebx, 0x8d
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
cmc
cmp sp, bx
test ebx, ebx
jmp 0xb87b71
call fcn.00484dce
add esp, 4
shld ebx, eax, 0xfc
mov ebx, dword [ebp - 0x10]
test bp, 0x6b31
stc
test ebx, ebx
je 0xabf227
push ebx
jmp 0xdc5786

Function at 0xc21bb3
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
nop
jmp 0xca4746
jmp 0xb960fb
push ebp
and ebp, edi
sub ebp, 0x6dd77e7a
rcr ebp, 0xca
mov ebp, esp
jmp 0xe31cb6
mov dword [ebp - 0xc], 0
jmp 0xdb831d
mov dword [ebp - 0x10], 0
jmp 0xbe730d
sub esp, 0x24
jmp 0xe6701d
mov dword [ebp - 4], 0
jmp 0xec0e0a
mov dword [ebp - 8], 0
jmp 0xc98a50
Function at 0xcd9e0f
Capabilities:
Packed with generic packer

Disassembly:
pushal
xadd si, bp
mov eax, 1
jmp 0x107a8ae
jmp loc.00445111
nop
jmp 0xda7e81
push ebp
mov ebp, esp
cmp sp, 0x7682
sub esp, 4
jmp 0x103966c
nop
nop
clc
nop
nop
test cx, 0x35a1
clc
nop
test cl, 0xb9
cmp edx, esp
cmp esi, 0x35082245
nop
cmp di, ax
test dl, 0xad
nop
clc
cmp ebx, ebp
cmp ebx, 0x18795fda
nop
jmp 0x949746
nop
nop
nop
test bp, 0x2367
cmp sp, cx
jmp 0xcab94d
mov eax, 4
dec ebp
bswap di
add dh, dh
mov eax, 2
and di, bx
mov eax, 5
cmc
btc edx, 0x6a
stc
mov eax, 6
bsr bx, bp
btr si, 0xb8
popal
push edx
setle al
mov edx, 1
mov edx, 2
or edx, 0x4b781bb3
mov edx, 4
test ebp, 0x28ab61a4
mov edx, 2
xor dx, si
mov edx, 5
mov edx, 4
shr dx, cl
ror al, cl
mov edx, 2
not edx
cwde
xor edx, edi
mov edx, 5
bts edx, edx
shld edx, esp, 0xb4
mov edx, 5
pop edx
or ax, si
sar al, 0xbd
mov eax, dword fs:[0x30]
cmp cl, 0x8a
mov eax, dword [eax + 0x64]
stc
add eax, 0x100
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0xa20c0f
mov dword [ebp - 4], 0
jmp 0xed72c6
mov eax, 2
adc ah, 0xd3
sar ch, 0xc
mov eax, 4
mov eax, 2
mov eax, 5
jmp 0x10362f6

Function at 0xd41f20
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0xde7d7d
nop
jmp 0xdf47fa
jmp 0xe3b1e4
nop
nop
jmp 0xabc6cf
nop
jmp 0x8d2b06
push edx
mov edx, 1
mov edx, 2
movzx ax, dl
mov edx, 4
not edx
mov edx, 2
bswap eax
mov edx, 5
not dh
mov edx, 4
mov edx, 2
movsx edx, cx
movzx dx, ch
mov edx, 5
xchg dl, ch
cbw
bswap edx
mov edx, 5
xchg ah, ch
pop edx
mov eax, dword fs:[0x30]
setb ch
not ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
jmp 0xebf354
push ebp
add bp, bx
mov ebp, esp
cmp ecx, 0x17c0226f
cmc
sub esp, 4
jmp 0xd72293
mov dword [ebp - 4], 0
jmp 0x91e642
jmp loc.00445039
nop
jmp 0xe85a63
nop
jmp 0x1064fa6
nop
jmp 0x103ed9d
nop
jmp 0xec1940
mov dword [ebp - 4], eax
mov al, 0x82
mov ah, ch
mov eax, dword [ebp - 4]
jmp 0xd9d991
pushal
mov eax, 1
mov eax, 2
xchg bl, al
mov eax, 4
bswap ax
mov eax, 2
mov eax, 5
cmovge si, ax
mov eax, 4
lahf
cdq
mov eax, 2
mov eax, 5
mov eax, 6
popal
lahf
jmp 0xcdf809
nop
nop
jmp 0xa85b54
nop
jmp 0x80ee2b

Function at 0xe36fcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0xa824b2
dec eax
test edi, esi
not eax
lea eax, [eax - 0xda749f7]
cmp di, 0x789
cmp esp, ebx
xor ebx, eax
test esi, 0x147042c4
cmp bx, 0x1ef
add edi, eax
jmp edi
not ebp
bswap ebp
xor ebp, 0x649d7ae5
clc
rdtsc
rol eax, 0x83
ror ebp, 1
rcr si, 0xb
xchg si, ax
xor ebp, 0x184a08a0
lea ebp, [ebp + ecx]
test sp, bp
mov esi, esp
stc
sub esp, 0xc0
test eax, 0x6c5964f8
and bh, 0x27
mov ebx, ebp
mov edx, 0
sub al, 0x38
and di, 0x28bc
sub ebx, edx
or ah, 0x9e
lea edi, [0xc4fe99]
sbb ah, 0xef
bsf ax, sp
btr ax, 0x5e
lea ebp, [ebp - 4]
ror ah, 0xc
bsr ax, sp
mov eax, dword [ebp]
jmp 0xfc8f58
push ebp
push eax
mov ebp, 0x5d9b78ae
mov al, cl
movsx ebp, si
push edx
bswap edx
rdtsc
cwde
push ebx
cwde
jmp 0xf0976c
push ecx
movzx edx, ax
lahf
push edi
cdq
pushfd
cwd
rol bh, 0xc5
ror bh, 0xad
push esi
mov ecx, 0
push ecx
sets ah
mov ebp, dword [esp + 0x28]
ror ebp, 2
bts esi, ecx
xchg bx, ax
bswap ebp
cdq
stc
ror edi, 0xad
ror ebp, 3
jmp 0xc4fe50
xor eax, ebx
jmp 0x91539e
Function at 0xeaa87e
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
jmp 0xb61646
nop
nop
test ecx, 0x161e48d2
nop
nop
cmc
cmp di, 0x587b
nop
test dh, bl
clc
nop
test di, 0x3ca9
nop
test esi, 0x5ef05409
jmp 0xf3a3b4
xor ecx, 0x23277ceb
inc dx
movsx dx, dl
xor ecx, 0x5a60a04b
cmc
xchg edx, edx
xor ecx, 0x261cf56d
btr dx, 0x65
xor ecx, 0xe5fb601
xor dx, di
xor ecx, 0x2d083c3f
shrd dx, bp, 0xa0
mov edx, esi
and dl, 0xf5
xor ecx, 0x499be607
bsr dx, bp
xor ecx, 0x3d1e028a
rol edx, cl
neg dh
xor ecx, 0x2f83feea
shr dl, 0x83
xor ecx, 0x577aa7b7
shr dh, cl
xor ecx, 0x3119467
btc edx, ecx
xor ecx, 0x5dc2607
xor ecx, 0x4f7c6f2f
xor ecx, 0x5f2e23b4
btr edx, 0x80
cwd
xor ecx, 0x5a2d3620
shl edx, 0x6f
xor dx, 0x7c7d
xor ecx, 0x68e93342
sar dl, 0xad
sal dx, cl
mov dh, al
xor ecx, 0x4c645ddf
ror dh, 0x30
xor ecx, 0x25b86a3c
jmp 0xb27e90
xor ecx, 0x62d07170
or dl, 0xb9
adc edx, 0x1a144185
btc edx, esp
xor ecx, 0x1788ecb0
dec edx
rcl dx, 0x5e
xor ecx, 0x5b7c9a3f
sar dl, 0xda
xor ecx, 0x570e28de
xor ecx, 0x45fc0029
nop
bsr edx, ebx
nop
sbb dl, 0xb1
bts edx, esp
nop
mov dx, bp
nop
sal dx, 0x9d
xadd dx, dx
nop
btr edx, 0x21
add dh, dl
test esp, edx
nop
cmovl edx, ecx
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
test sp, si
lea esi, [esi + 1]
cmp sp, 0x2073
cmp esi, dword [ebp + 0xc]
jmp 0xb62768
nop
jmp 0x44bbdb
jne 0xd63c7c
pop esi
xchg dh, dl
movsx edx, dx
pop ecx
pop edx
jmp 0xf9eaa2
nop
jmp 0xdf4a3c
nop
jmp 0xd007ff
nop
jmp 0xc6e6d2
nop
jmp 0xcbe5d5
pushal
bts edx, ecx
inc ebp
test bx, 0x33ad
mov eax, 1
mov eax, 2
bts edi, ecx
btc ebp, 0xaf
mov eax, 4
mov eax, 2
xchg si, dx
mov eax, 5
mov eax, 4
rol ah, 0x99
add bh, 0xba
sbb eax, 0x246d490f
mov eax, 2
and esi, 0x36e835b9
and esi, esi
mov eax, 5
mov eax, 6
sub esi, edi
xor al, 0xd
or ebx, esp
popal
movsx eax, si
sub ah, 0x36
rcr al, cl
push edx
rcr eax, cl
movsx eax, di
bsf ax, bx
mov edx, 1
mov edx, 2
mov edx, 4
sub eax, 0x1c312114
sar ah, 0xf
mov edx, 2
bt dx, 0xf7
shl eax, 0x2c
mov edx, 5
xor eax, ecx
mov edx, 4
adc edx, 0x4c9c7829
mov edx, 2
rol ax, cl
bswap ax
mov edx, 5
movsx dx, dh
and eax, edx
mov edx, 5
cdq
pop edx
bt eax, esp
push edx
push ecx
bt eax, eax
push esi
adc eax, 0x3a23997
shl ah, cl
xor esi, esi
mov eax, dword [ebp + 8]
xor dx, si
lea ecx, ds:[esi*4]
sbb dl, dl
mov ecx, dword [eax + ecx]
xor ecx, 0x3f8f8711
rol dl, 0xa5
movzx dx, ah
xor ecx, 0x640b644b
btc dx, 0x62
xor ecx, 0x466136d3
or dx, dx
xor ecx, 0x483de5da
xor edx, esp
cmp cx, 0x2bce
xor ecx, 0x3a0b3a2c
btr edx, 0x9b
test bp, di
xor ecx, 0x573b37ec
sar dh, cl
xor ecx, 0x72ea4e61
btc edx, 0xa9
setge dh
jmp 0xb249d0
nop
nop
nop
jmp 0x949e55
nop
jmp 0xcac705
nop
jmp 0xf064c2
push ebp
movzx ebp, di
mov ebp, esp
jmp 0xa5cb29
nop
nop
jmp 0xe24592
nop
cmp edx, edi
stc
nop
stc
nop
cmp edx, edi
cmc
nop
test ebx, 0x7a4205d9
clc
nop
test bx, bp
jmp 0xd63ba4
nop
jmp 0xe62a4e
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x403e25
Capabilities:
Encode data using xor

Disassembly:
add al, 0x52
imul ebp, dword [ecx - 0x33], 0xffffff8f
mov edi, 0x253b9694
fadd st(6), st(0)
popfd
xor dword [edi + 0x2c], edi
fistp word [0xffcd512d]
enter 0x7cd2, 0xffffffffffffffad
cmc
cli
lodsd eax, dword [esi]
mov bl, 0x13
adc edx, dword [eax]
sbb byte [edi], bl
adc edx, dword [eax]
sbb byte [edi], bl
popfd
js 0x403e06
stc
mov ah, byte [ebx]
inc edx
test ebx, esp
pushfd
hlt

Function at 0x405331
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004055e0
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ebe8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, 0x42afe8
push edi
push esi
call fcn.00405a0c
test ebx, ebx
je 0x4053a0
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4053a6
push edi
call fcn.00405546
cmp byte [edi], 0
jne 0x4053b4
cmp byte [0x42afe8], 0x5c
jne 0x4053bf
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040552a
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
call fcn.00405a0c
test byte [ebp - 0x148], 0x10
je 0x405440
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405479
push dword [ebp + 0xc]
push edi
call fcn.00405331
jmp 0x405479
push edi
call fcn.004056c4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405471
test byte [ebp + 0xc], 4
je 0x405469
push edi
push 0xfffffffffffffff1
call fcn.00404daa
push 0
push edi
call fcn.0040575a
jmp 0x405479
inc dword [0x42ebe8]
jmp 0x405479
push edi
push 0xfffffffffffffff2
call fcn.00404daa
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x42ebe8]
jmp 0x4054f9
push edi
call fcn.00405d07
test eax, eax
je 0x4054f9
push edi
call fcn.004054ff
push edi
call fcn.004056c4
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call fcn.00404daa
push esi
push edi
call fcn.0040575a
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call fcn.00404daa
pop edi
pop esi
leave
ret 8
Function at 0x404837
Capabilities:
Get disk information

Disassembly:
mov eax, 0x429b10
call fcn.00428650
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401f1f
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x40490d
mov eax, SysReAllocString
cmp ebx, eax
ja 0x404873
mov eax, ebx
add eax, eax
push eax
call fcn.00405733
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x404906
cmp ebx, dword [ebp - 0x18]
ja 0x404906
lea ecx, [ebp - 0x2c]
call fcn.00402679
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4048ee
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4048e3
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401d25
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x4048b1
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402153
push esi
call fcn.00402153
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x40490f
push esi
call fcn.00402153
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405742
pop dword [ebp - 0x4c]
mov eax, 0x593f5391
sub eax, 0x58fefc4f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x38886
push 0
mov eax, 0xb7d1694b
sub eax, 0xb78ea91f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xde3fac41
add ecx, 0x21c098c5
mov edx, eax
mov ebx, 0x43b800
add ebx, dword [ebp - 0x4c]
mov esi, 0x178f9852
sub esi, 0x1418824a
xor dword [ebp - 0x44], 0x42f6e616
mov edi, dword [ebx]
sub dword [ebp - 0x3c], edi
add edi, esi
xor dword [ebp - 0x44], 0x67ff907c
mov dword [edx], edi
xor dword [ebp - 0x28], 0x79144279
add edx, 0xcb0d671f
sub edx, 0xcb0d671b
add ebx, 4
loop 0x40579b
add eax, 0xc6dbd450
add eax, 0x3925329b
mov ebx, eax
add eax, 5
mov ecx, 0x16ee4776
add ecx, 0xe951b88a
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x942745
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
cmp dword [esp + 0x128], 0
je 0x94290a
push ebp
push esi
mov esi, dword [esp + 0x12c]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x942908
push ebx
mov edx, esi
push edi
mov eax, dword [edx]
mov ebx, dword [esp + 0x130]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
add eax, ebx
lea edi, [ecx + ebx]
mov dword [esp + 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x9427b0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.0093af12
add esp, 0xc
test ebx, ebx
je 0x9428b0
mov eax, dword [esp + 0x18]
and dword [esp + 0x14], 0
mov eax, dword [eax]
test eax, eax
je 0x942899
mov esi, dword [esp + 0x10]
xor edi, edi
mov ebp, dword [esp + 0x130]
test eax, eax
jns 0x9427f5
movzx ebx, ax
jmp 0x9427fa
lea ebx, [ebp + 2]
add ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x20]
mov dword [edi + ecx], eax
test eax, eax
jne 0x942871
cmp dword [0x9495f0], 1
jne 0x942871
push 0x104
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0093af12
lea eax, [esp + 0x34]
push eax
call fcn.009429ee
lea eax, [esp + 0x38]
push 0x939fa4
push eax
call fcn.0093af40
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.0093af40
add esp, 0x20
lea eax, [esp + 0x24]
push 0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0093af67
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x949590]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
mov edi, ecx
mov dword [esp + 0x14], ecx
shl edi, 2
mov eax, dword [edi + eax]
test eax, eax
jne 0x9427ee
mov esi, dword [esp + 0x134]
mov ebp, dword [esp + 0x1c]
inc ebp
imul edx, ebp, 0x14
mov dword [esp + 0x1c], ebp
add edx, esi
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x942777
jmp 0x942906
lea eax, [esp + 0x28]
push eax
call fcn.009429ee
lea eax, [esp + 0x2c]
mov dword [esp], 0x939f88
push eax
call fcn.0093af40
lea eax, [esp + 0x30]
push edi
push eax
call fcn.0093af40
add esp, 0x10
cmp dword [0x9495f0], 1
jne 0x942906
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0093af67
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x949590]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebx
pop esi
pop ebp
xor eax, eax
add esp, 0x11c
ret
Function at 0x942940
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.009429bc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x949460], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x949460]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x949464], eax
push 0
push 0
push 0
push 4
push dword [0x949464]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x9495f8]
leave
ret
Function at 0x942a44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x942a57
xor eax, eax
jmp 0x942bdb
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x942a95
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x942aae
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x942aae
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x942abb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x942af4
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x942ab4
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x942b94
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x942b24
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x942b83
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x942b3c
jmp 0x942b1d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x942b74
jmp 0x942b81
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x942b1d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x942af4
and dword [ebp - 0x14], 0
jmp 0x942ba1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x942bd9
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x942b9a
xor eax, eax
leave
ret