joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4772a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x477361
mov eax, dword [esp + 0x488]
test eax, eax
je 0x477361
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x477361
cmp dword [esp], 0x378
jne 0x477361
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x477361
lea edx, [esp + 4]
push edx
call fcn.00476d30
add esp, 4
test eax, eax
je 0x477361
cmp dword [esp + 0x234], 1
jne 0x477353
cmp dword [esp + 0x258], 2
jne 0x477353
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x477361
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x477361
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x477370
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x4773cf
push esi
call fcn.00476d30
add esp, 4
test eax, eax
je 0x4773cf
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4773cf
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4773cf
push 0x52b508
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x477460
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x477494
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00477370
test eax, eax
jne 0x4774ad
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.004773e0
cmp eax, 1
je 0x47763a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4774e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x477562
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4775e2
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.004772a0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x4775f9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x477502
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x4775b0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00476f50
test eax, eax
je 0x4775e2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x47757e
cmp dword [esp + 0x18], 1
jb 0x4775e2
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00476e30
cmp eax, 1
je 0x47762b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x477609
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x4775e2
push ebp
mov ecx, ebx
call fcn.00477650
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47763a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x477650
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x477682
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.004773e0
test eax, eax
jne 0x47769f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4776c6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x477714
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.004770f0
test eax, eax
jne 0x4776fd
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x4776e3
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.00476ec0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x477737
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4
Function at 0x483bd0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x534a74]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x483be3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x483c24
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x534b1c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x483c56
mov bl, byte [esp + ecx + 0x4c]
jmp 0x483c5a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x483c4b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x483c78
mov bl, byte [esp + ecx + 0x4c]
jmp 0x483c7c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x483c6d
xor ecx, ecx
mov eax, 0x534a84
xor ebx, ebx
mov bl, byte [ecx + 0x534b2c]
cmp byte [esp + ebx + 0x14], 0
je 0x483ca7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x534b44]
cmp byte [esp + ebx + 0x14], 0
je 0x483cbe
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x483c8e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x483c17
lea edx, [esp + 0x84]
push edx
call fcn.00483d00
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4a34cf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a3507
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a14e6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a14be
jmp 0x4a3513
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a4bbd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a4bff
call fcn.004aa9a6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a4bff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a4bf6
xor eax, eax
jmp 0x4a4c07
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a4c0d
pop edi
pop esi
pop ebx
ret 4

Function at 0x4aaed6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4aaf04
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4aaf22
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004aae3c
jmp 0x4aaf22
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4aaf22
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004aae3c
test edi, edi
mov eax, edi
jne 0x4aaf0c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x7442c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x310000]
push edi
or ebp, 0xffffffff
jmp 0x7442e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7442e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7442d8
mov eax, 1
add ebx, ebx
jne 0x7442fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x74430c
jne 0x74432b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x74432b
dec eax
add ebx, ebx
jne 0x744318
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7442f0
add ebx, ebx
jne 0x744327
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x74437d
xor ecx, ecx
sub eax, 3
jb 0x744343
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7443b2
sar eax, 1
mov ebp, eax
jmp 0x74434e
add ebx, ebx
jne 0x74434e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x74431c
inc ecx
add ebx, ebx
jne 0x74435c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x74431c
add ebx, ebx
jne 0x744369
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x74435e
jne 0x74437a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x74435e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x74439c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x74438e
jmp 0x7442de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x74439c
add edi, ecx
jmp 0x7442de
pop esi
mov edi, esi
mov ecx, 0x2635
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7443ba
cmp byte [edi], 0x16
jne 0x7443ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7443bf
lea edi, [esi + 0x341000]
mov eax, dword [edi]
or eax, eax
je 0x744437
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34487c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3449d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7443ec
mov ecx, edi
jns 0x74441b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3449d4]
or eax, eax
je 0x744431
mov dword [ebx], eax
add ebx, 4
jmp 0x744409
call dword [esi + 0x3449dc]
mov ebp, dword [esi + 0x3449d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x74446b
sub esp, 0xffffff80
jmp 0x4457e3
Function at 0x1343070
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xca000]
push edi
jmp 0x134308a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1343091
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1343080
mov eax, 1
add ebx, ebx
jne 0x13430a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x13430b4
jne 0x13430d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13430d3
dec eax
add ebx, ebx
jne 0x13430c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1343098
add ebx, ebx
jne 0x13430cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1343125
xor ecx, ecx
sub eax, 3
jb 0x13430eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x134315a
sar eax, 1
mov ebp, eax
jmp 0x13430f6
add ebx, ebx
jne 0x13430f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13430c4
inc ecx
add ebx, ebx
jne 0x1343104
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13430c4
add ebx, ebx
jne 0x1343111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1343106
jne 0x1343122
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1343106
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1343144
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1343136
jmp 0x1343086
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1343144
add edi, ecx
jmp 0x1343086
pop esi
mov edi, esi
mov ecx, 0x3c8d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1343162
cmp byte [edi], 0x1e
jne 0x1343162
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1343167
lea edi, [esi + 0xf40000]
mov eax, dword [edi]
or eax, eax
je 0x13431df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf4594c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf45a8c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1343194
mov ecx, edi
jns 0x13431c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf45a90]
or eax, eax
je 0x13431d9
mov dword [ebx], eax
add ebx, 4
jmp 0x13431b1
call dword [esi + 0xf45aa0]
mov ebp, dword [esi + 0xf45a94]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1343213
sub esp, 0xffffff80
jmp 0x4831eb
Function at 0x9677a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x510000]
push edi
jmp 0x9677ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9677c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9677b0
mov eax, 1
add ebx, ebx
jne 0x9677d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9677e4
jne 0x967803
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x967803
dec eax
add ebx, ebx
jne 0x9677f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9677c8
add ebx, ebx
jne 0x9677ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x967855
xor ecx, ecx
sub eax, 3
jb 0x96781b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x96788a
sar eax, 1
mov ebp, eax
jmp 0x967826
add ebx, ebx
jne 0x967826
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9677f4
inc ecx
add ebx, ebx
jne 0x967834
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9677f4
add ebx, ebx
jne 0x967841
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x967836
jne 0x967852
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x967836
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x967874
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x967866
jmp 0x9677b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x967874
add edi, ecx
jmp 0x9677b6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x967892
cmp byte [edi], 0x11
jne 0x967892
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x967897
lea edi, [esi + 0x560000]
mov eax, dword [edi]
or eax, eax
je 0x96790f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9f5d04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9f5e80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9678c4
mov ecx, edi
jns 0x9678f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9f5e84]
or eax, eax
je 0x967909
mov dword [ebx], eax
add ebx, 4
jmp 0x9678e1
call dword [esi + 0x9f5e94]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x967940
cmp al, 0xef
ja 0x967933
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x967915
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x967922
mov ebp, dword [esi + 0x9f5e88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x967974
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x4012fc
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
push esi
push ebx
call fcn.0040a76c
mov dword [ebp - 0xc], 0
add esp, 0xfffffff8
push 0x401230
push 0x412028
call fcn.00402788
add esp, 0x10
lea edi, [ebp - 0x30]
mov esi, 0x40128c
cld
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], 6
add esp, 0xfffffff8
push 0x4012a4
push 0x412028
call fcn.00402788
add esp, 0x10
mov dword [ebp - 0x38], 0
lea esi, [esi]
cmp dword [ebp - 0x38], 5
jle 0x401364
jmp 0x4013a0
add esp, 0xfffffff8
push 0x4012b8
add esp, 0xfffffff8
mov eax, dword [ebp - 0x38]
mov edx, eax
lea eax, [edx*4]
lea edx, [ebp - 0x30]
mov eax, dword [eax + edx]
push eax
push 0x412028
call fcn.004024cc
add esp, 0x10
mov eax, eax
push eax
call fcn.00402788
add esp, 0x10
inc dword [ebp - 0x38]
jmp 0x40135c
add esp, 0xfffffff8
push 0x4012d0
push 0x412028
call fcn.00402788
add esp, 0x10
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x3c], 5
jle 0x4013c8
jmp 0x401460
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov esi, esi
cmp dword [ebp - 8], 0
jle 0x401400
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [edx*4]
lea edx, [ebp - 0x30]
mov ebx, dword [ebp - 8]
dec ebx
lea ecx, [ebx*4]
lea ebx, [ebp - 0x30]
mov eax, dword [eax + edx]
cmp eax, dword [ecx + ebx]
jl 0x401404
jmp 0x401400
jmp 0x401458
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [edx*4]
lea edx, [ebp - 0x30]
mov eax, dword [eax + edx]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [edx*4]
lea edx, [ebp - 0x30]
mov ecx, dword [ebp - 8]
dec ecx
lea ebx, [ecx*4]
lea ecx, [ebp - 0x30]
mov ebx, dword [ebx + ecx]
mov dword [eax + edx], ebx
mov edx, dword [ebp - 8]
dec edx
lea eax, [edx*4]
lea edx, [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov dword [eax + edx], ecx
dec dword [ebp - 8]
jmp 0x4013d0
inc dword [ebp - 0x3c]
jmp 0x4013bc
mov dword [ebp - 0x40], 0
nop
cmp dword [ebp - 0x40], 5
jle 0x401470
jmp 0x4014ac
add esp, 0xfffffff8
push 0x4012b8
add esp, 0xfffffff8
mov eax, dword [ebp - 0x40]
mov edx, eax
lea eax, [edx*4]
lea edx, [ebp - 0x30]
mov eax, dword [eax + edx]
push eax
push 0x412028
call fcn.004024cc
add esp, 0x10
mov eax, eax
push eax
call fcn.00402788
add esp, 0x10
inc dword [ebp - 0x40]
jmp 0x401468
add esp, 0xfffffff8
push 0x402bec
push 0x412028
call fcn.00410210
add esp, 0x10
add esp, 0xfffffff4
push 0x4012f5
call sub.msvcrt.dll_system
add esp, 0x10
xor eax, eax
jmp 0x4014dc
lea esp, [ebp - 0x58]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x405f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add esp, 0xfffffffc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x38]
call sub.msvcrt.dll__read
leave
ret

Function at 0x40a85c
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40a884
mov dword [0x413164], eax
add esp, 0xfffffff8
push 0x40a820
push eax
call fcn.0040ec84
jmp 0x40a889
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40a89c
mov dword [0x41235c], 0x40a97c
jmp 0x40a8a6
mov dword [0x41235c], 0x40a930
leave
ret
Function at 0x403bef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, ecx
xor edx, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [eax]
mov dword [ebp - 4], edx
xor esi, esi
test eax, eax
jle 0x403c28
mov ebx, dword [ebp + 0xc]
add ebx, edx
mov edx, dword [ebp - 8]
mov ecx, dword [edi]
mov al, byte [ebx]
lea ebx, [ebx + 4]
xor byte [ecx + esi], al
inc esi
mov eax, dword [edx]
cmp esi, eax
jl 0x403c14
mov edx, dword [ebp - 4]
inc edx
add edi, 4
mov dword [ebp - 4], edx
cmp edx, 4
jl 0x403c06
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4040f7
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov bl, 1
dec esi
test esi, esi
jle 0x404120
mov dl, bl
add dl, dl
mov al, dl
xor al, 0x1b
test bl, bl
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
mov bl, cl
sub esi, 1
jne 0x404106
mov eax, dword [ebp + 8]
xor ecx, ecx
pop esi
mov byte [eax], bl
mov word [eax + 2], cx
mov byte [eax + 1], cl
pop ebx
pop ebp
ret 8

Function at 0x406dec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x406e15
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x406e05
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x406e19
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
sub edx, ecx
push edi
push 4
sub esi, ecx
pop edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
sub edi, 1
jne 0x406e2e
pop edi
pop esi
pop ebp
ret 0xc