joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7680
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
and eax, 0xfffffff
cmp eax, 3
ja case.default.0x4c7696
jmp dword [eax*4 + 0x4c7734]
push ebx
mov ebx, dword [edx + 8]
xor edx, edx
movzx eax, bl
xor eax, 0x811c9dc5
push esi
mov esi, dword [ecx + 0xc]
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
div dword [esi + 0x10]
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4c76fb
nop
cmp dword [eax + 4], ebx
je 0x4c76fd
mov eax, dword [eax]
test eax, eax
jne 0x4c76f0
xor eax, eax
test eax, eax
pop esi
setne al
pop ebx
pop ebp
ret 4
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 0x2c]
cmp eax, dword [edx + 8]
sete al
pop ebp
ret 4
mov eax, dword [ecx + 8]
cmp eax, dword [edx + 8]
sete al
pop ebp
ret 4
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x4c9900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4c9927
mov ecx, 5
int 0x29
push 2
call fcn.004a9ed0
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4c9a32
test esi, esi
jne 0x4c9a32
push 2
call fcn.004a9ed0
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d55dc
mov esp, ebp
pop ebp
ret
Function at 0x4cd690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test bl, bl
jns 0x4cd785
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x20]
cmp edi, eax
je 0x4cd6be
lea eax, [ecx + 0x40]
cmp edi, eax
jne 0x4cd785
push esi
push edi
call fcn.004d11f0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add esp, 4
add eax, 0x20
cmp edi, eax
jne 0x4cd6e0
mov esi, 0x562cfc
mov eax, 0x562d00
jmp 0x4cd6ea
mov esi, 0x562cfd
mov eax, 0x562d04
cmp byte [esi], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], esi
je 0x4cd73d
push edi
mov byte [eax + 1], bl
call fcn.004d28c0
push edi
push 2
mov byte [ebp - 8], al
mov eax, dword [ebp + 8]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
push edi
push dword [ebp - 8]
mov esi, eax
call fcn.004d2970
mov eax, dword [ebp - 4]
add esp, 0x1c
mov byte [eax], 0
test esi, esi
jne 0x4cd773
push edi
or ebx, 0xffffffff
call fcn.004d1230
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call sub.msvcrt.dll___pctype_func
movzx ecx, bl
cmp word [eax + ecx*2], 0
jge 0x4cd766
mov eax, dword [ebp + 8]
push edi
mov byte [esi], 1
mov byte [eax], bl
call fcn.004d1230
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ebx
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
mov ebx, eax
push edi
call fcn.004d1230
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ebx
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d1410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5130
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp ebx, edx
je 0x4d15ea
mov edi, 0x5c
jmp 0x4d1460
mov eax, dword [ebx]
mov esi, dword [eax*4 + 0x562d10]
lea ecx, [eax*4 + 0x562d10]
mov dword [ebp - 0x414], ecx
test esi, esi
je 0x4d1488
cmp esi, 0xffffffff
jne 0x4d1617
jmp 0x4d15df
mov esi, dword [eax*4 + 0x503ed0]
cmp byte [0x562d08], 0
mov dword [ebp - 4], 0
je 0x4d14bd
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [ebp - 0x414]
mov esi, eax
mov edx, dword [ebp + 0xc]
jmp 0x4d15cf
test esi, esi
je 0x4d15cd
cmp word [esi], 0
je 0x4d15cd
push 0x200
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4d15c4
cmp eax, 0x200
jae 0x4d15c4
mov word [ebp + eax*2 - 0x410], di
inc eax
cmp eax, 0x200
jae 0x4d15c4
movzx ecx, word [esi]
test cx, cx
je 0x4d1534
mov edx, ecx
mov word [ebp + eax*2 - 0x410], dx
inc eax
cmp eax, 0x200
jae 0x4d15c4
movzx ecx, word [esi + 2]
add esi, 2
mov edx, ecx
test cx, cx
jne 0x4d1512
add eax, eax
cmp eax, 0x400
jae 0x4d161b
mov edi, dword [0x51cbc0]
xor ecx, ecx
mov word [ebp + eax - 0x410], cx
mov ecx, edi
xor edi, dword [0x562d0c]
and ecx, 0x1f
ror edi, cl
test edi, edi
je 0x4d15a0
lea eax, [ebp - 0x418]
push eax
push 0
call edi
push 8
push 0
lea eax, [ebp - 0x410]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call eax
mov esi, eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x418]
call edi
mov ecx, dword [ebp - 0x414]
mov edi, 0x5c
mov edx, dword [ebp + 0xc]
jmp 0x4d15cf
push 8
push 0
lea eax, [ebp - 0x410]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call eax
mov ecx, dword [ebp - 0x414]
mov esi, eax
mov edx, dword [ebp + 0xc]
mov edi, 0x5c
jmp 0x4d15cf
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x414]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x4d1608
or eax, 0xffffffff
xchg dword [ecx], eax
add ebx, 4
cmp ebx, edx
jne 0x4d1460
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d55dc
mov esp, ebp
pop ebp
ret
mov eax, esi
xchg dword [ecx], eax
test eax, eax
je 0x4d1617
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x4d15ec
call fcn.004a8fd0
int3
Function at 0x4d1541
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5130
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp ebx, edx
je 0x4d15ea
mov edi, 0x5c
jmp 0x4d1460
mov eax, dword [ebx]
mov esi, dword [eax*4 + 0x562d10]
lea ecx, [eax*4 + 0x562d10]
mov dword [ebp - 0x414], ecx
test esi, esi
je 0x4d1488
cmp esi, 0xffffffff
jne 0x4d1617
jmp 0x4d15df
mov esi, dword [eax*4 + 0x503ed0]
cmp byte [0x562d08], 0
mov dword [ebp - 4], 0
je 0x4d14bd
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [ebp - 0x414]
mov esi, eax
mov edx, dword [ebp + 0xc]
jmp 0x4d15cf
test esi, esi
je 0x4d15cd
cmp word [esi], 0
je 0x4d15cd
push 0x200
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4d15c4
cmp eax, 0x200
jae 0x4d15c4
mov word [ebp + eax*2 - 0x410], di
inc eax
cmp eax, 0x200
jae 0x4d15c4
movzx ecx, word [esi]
test cx, cx
je 0x4d1534
mov edx, ecx
mov word [ebp + eax*2 - 0x410], dx
inc eax
cmp eax, 0x200
jae 0x4d15c4
movzx ecx, word [esi + 2]
add esi, 2
mov edx, ecx
test cx, cx
jne 0x4d1512
add eax, eax
cmp eax, 0x400
jae 0x4d161b
mov edi, dword [0x51cbc0]
xor ecx, ecx
mov word [ebp + eax - 0x410], cx
mov ecx, edi
xor edi, dword [0x562d0c]
and ecx, 0x1f
ror edi, cl
test edi, edi
je 0x4d15a0
lea eax, [ebp - 0x418]
push eax
push 0
call edi
push 8
push 0
lea eax, [ebp - 0x410]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call eax
mov esi, eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x418]
call edi
mov ecx, dword [ebp - 0x414]
mov edi, 0x5c
mov edx, dword [ebp + 0xc]
jmp 0x4d15cf
push 8
push 0
lea eax, [ebp - 0x410]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call eax
mov ecx, dword [ebp - 0x414]
mov esi, eax
mov edx, dword [ebp + 0xc]
mov edi, 0x5c
jmp 0x4d15cf
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x414]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x4d1608
or eax, 0xffffffff
xchg dword [ecx], eax
add ebx, 4
cmp ebx, edx
jne 0x4d1460
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d55dc
mov esp, ebp
pop ebp
ret
mov eax, esi
xchg dword [ecx], eax
test eax, eax
je 0x4d1617
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x4d15ec
call fcn.004a8fd0
int3

Function at 0x4d1f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00403160
mov esi, dword [ebp + 8]
test al, al
je 0x4d1f9e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.004d1fb0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4d20e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d213c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d213c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d213c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4d213c
cmp dword [ecx + 0x74], 0xe
jbe 0x4d213c
cmp dword [ecx + 0xe8], 0
je 0x4d213c
push dword [ebp + 8]
call fcn.004d1fb0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x562ddc
call fcn.004d1db0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x4d2171
push dword [ebp + 8]
call fcn.004d1f80
mov esp, ebp
pop ebp
ret

Function at 0x4d21b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d220c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d220c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d220c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4d220c
cmp dword [ecx + 0x74], 0xe
jbe 0x4d220c
cmp dword [ecx + 0xe8], 0
je 0x4d220c
push dword [ebp + 8]
call fcn.004d1fb0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x562ddc
call fcn.004d1db0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x4d2241
push dword [ebp + 8]
call fcn.004d1f80
mov esp, ebp
pop ebp
ret
Function at 0x408e23
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x409590
call fcn.004093a8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40a364
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x408e68
cmp eax, esi
jne 0x408e5b
xor esi, esi
inc esi
mov edi, esi
jmp 0x408e6b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408e3f
xor esi, esi
inc esi
cmp dword [0x40a368], esi
jne 0x408e7d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x408eb7
cmp dword [0x40a368], ebx
jne 0x408eb1
mov dword [0x40a368], esi
push 0x4010cc
push 0x4010c0
call fcn.00408f9c
pop ecx
pop ecx
test eax, eax
je 0x408eb7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x408f8c
mov dword [0x40a014], esi
cmp dword [0x40a368], esi
jne 0x408eda
push 0x4010bc
push 0x4010b4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40a368], 2
test edi, edi
jne 0x408ee7
xor eax, eax
mov ecx, 0x40a364
xchg dword [ecx], eax
cmp dword [0x40a36c], 0
je 0x408f13
push 0x40a36c
call fcn.00409200
pop ecx
test eax, eax
je 0x408f13
push ebx
push 2
push ebx
mov esi, dword [0x40a36c]
mov ecx, esi
call dword [0x40b0d4]
call esi
push dword [0x40a020]
push dword [0x40a01c]
push dword [0x40a018]
call fcn.00407429
add esp, 0xc
mov dword [0x40a010], eax
cmp dword [0x40a028], 0
jne 0x408f71
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x40a014], 0
jne 0x408f85
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40a010]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.0049a000
jmp 0x408e23

Function at 0x4090e4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4095b0
call fcn.004093a8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409144
cmp eax, 0xffffffff
je 0x409144
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40913d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40913d
cmp edx, 0x10000000
jae 0x40913d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40913a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4091b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4091ee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4091e6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4091f0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4091d6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x408d51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408d8f
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408d96
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c6a8
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x408f64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43a424], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x408fa1
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408f7e
mov dword [ecx*4 + 0x43a420], eax
inc ecx
cmp ecx, 0x100
jne 0x408f77
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408fc4
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a420]
jmp 0x408fab
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x119e3e14
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov dword [eax - 0x86f6f70], edx
not dword [eax - 0x6e6f6f70]
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4d33f4b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x406100
Capabilities:
Manipulate boot configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
or dword [ebp - 0xc], 0xffffffff
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x11000001
push dword [0x495c34]
xor ebx, ebx
mov dword [0x48e234], ebx
mov dword [ebp - 8], ebx
call fcn.0041ed88
test eax, eax
jge 0x406140
mov edi, 0xc000000e
jmp 0x406249
mov ecx, dword [ebp - 8]
cmp dword [ecx], 4
jne 0x4061b8
mov esi, dword [0x4945e0]
neg esi
sbb esi, esi
and esi, 0x4945e0
je 0x406136
cmp dword [esi], ebx
je 0x406136
cmp dword [esi + 0x28], ebx
je 0x4061a2
mov eax, dword [esi + 0x24]
inc eax
push eax
call fcn.0042a046
mov dword [0x48e234], eax
cmp eax, ebx
jne 0x406180
mov edi, 0xc0000017
jmp 0x406249
push dword [esi + 0x24]
push dword [esi + 0x28]
push eax
call fcn.00450cc0
mov eax, dword [esi + 0x24]
mov ecx, dword [0x48e234]
add esp, 0xc
mov byte [ecx + eax], bl
xor eax, eax
jmp 0x40626d
mov esi, dword [esi + 0x2c]
cmp esi, ebx
jne 0x4061b3
mov eax, 0xc000000f
jmp 0x40626d
push 3
pop eax
jmp 0x4061c0
xor eax, eax
mov esi, str._boot.ini
inc eax
lea edx, [ebp - 0xc]
push edx
push eax
push ecx
call fcn.0040a2cc
mov edi, eax
cmp edi, ebx
jl 0x406249
push 1
push dword [ebp - 0xc]
lea edi, [ebp - 4]
call fcn.00417789
mov edi, eax
cmp edi, ebx
jl 0x40623d
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.0041717d
mov edi, eax
cmp edi, ebx
jl 0x406235
mov esi, dword [ebp - 0x28]
lea eax, [esi + 1]
cmp eax, esi
jae 0x406207
mov edi, 0xc0000095
jmp 0x406235
push eax
call fcn.0042a046
mov dword [0x48e234], eax
cmp eax, ebx
jne 0x40621d
mov edi, 0xc0000017
jmp 0x406235
push ebx
push ebx
push eax
push ebx
push ebx
push esi
push dword [ebp - 4]
call fcn.004173d8
mov edi, eax
mov eax, dword [0x48e234]
mov byte [eax + esi], bl
mov eax, dword [ebp - 4]
call fcn.00416d44
mov eax, dword [ebp - 0xc]
call fcn.0040a2e7
cmp edi, ebx
jge 0x40625e
mov eax, dword [0x48e234]
cmp eax, ebx
je 0x40625e
push eax
call fcn.0042a097
mov dword [0x48e234], ebx
cmp dword [ebp - 8], ebx
je 0x40626b
push dword [ebp - 8]
call fcn.0042a097
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40be30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 9
push str.EFI_PART
push esi
call fcn.00453200
cmp eax, 9
jne 0x40be8b
mov edx, dword [esi + 0x10]
xor ecx, ecx
or eax, 0xffffffff
mov dword [esi + 0x10], ecx
cmp dword [esi + 0xc], ecx
jbe 0x40be74
push ebx
push edi
mov edi, dword [esi + 0xc]
movzx ebx, byte [ecx + esi]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x468588]
inc ecx
cmp ecx, edi
jb 0x40be57
pop edi
pop ebx
not eax
mov dword [esi + 0x10], edx
cmp edx, eax
jne 0x40be8b
xor eax, eax
inc eax
cmp dword [esi + 0x18], eax
jne 0x40be8b
cmp dword [esi + 0x1c], 0
je 0x40be8d
xor al, al
ret
Function at 0x420d4e
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 4], 0
push esi
push edi
mov esi, eax
call fcn.0042e5fd
test eax, eax
jne 0x420d89
mov dword [ebp + 8], 0xc0000098
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x420d7f
push ebx
call fcn.0042a097
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
movzx ecx, word [eax + 0x14]
movzx edi, word [eax + 6]
mov edx, dword [eax + 0x78]
lea ecx, [ecx + eax + 0x18]
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], edi
test edi, edi
jbe 0x420dce
lea edi, [ecx + 0xc]
mov dword [ebp + 8], edi
mov edi, dword [ebp + 8]
mov edi, dword [edi]
cmp edx, edi
jb 0x420dc4
mov edx, dword [ebp + 8]
mov edx, dword [edx + 4]
add edx, edi
mov edi, edx
mov edx, dword [ebp - 8]
cmp edx, edi
jb 0x420dce
add dword [ebp + 8], 0x28
inc eax
cmp eax, dword [ebp - 4]
jb 0x420daa
cmp eax, dword [ebp - 4]
jne 0x420ddc
mov dword [ebp + 8], 0xc0000225
jmp 0x420d72
mov edx, dword [edx + esi + 0xc]
test edx, edx
je 0x420dd3
imul eax, eax, 0x28
add ecx, eax
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0xc]
add esi, edx
sub eax, edx
push eax
push esi
mov dword [ebp + 8], esi
call fcn.00444a2d
pop ecx
mov esi, eax
pop ecx
lea eax, [esi + 1]
push eax
call fcn.0042a046
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x420e1f
mov dword [ebp + 8], 0xc0000017
jmp 0x420d72
push esi
push dword [ebp + 8]
push edi
call fcn.00450cc0
and dword [ebp + 8], 0
add esp, 0xc
lea eax, [esi + 1]
push 0x2e
push edi
mov byte [edi + esi], 0
mov word [ebx + 2], ax
mov word [ebx], ax
call fcn.004445b0
pop ecx
pop ecx
test eax, eax
je 0x420d7f
sub esi, eax
add esi, dword [ebx + 4]
cmp esi, 4
jne 0x420d7f
push str..EXE
push 5
push eax
call fcn.00445cdc
add esp, 0xc
jmp 0x420d7f
Function at 0x422864
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
call fcn.00423a7b
mov esi, eax
call fcn.00423a7b
mov ebx, eax
cmp ebx, esi
je 0x422870
rdtsc
mov esi, eax
mov edi, edx
call fcn.00423a7b
cmp eax, ebx
je 0x422881
rdtsc
push 0
sub eax, esi
pop esi
sbb edx, edi
push esi
add eax, 0x6b46
push 0xd68b
adc edx, esi
push edx
push eax
call fcn.00452fc0
push esi
push 0xf4240
push edx
push eax
call fcn.00445a30
pop edi
pop esi
mov dword [0x48e358], eax
mov dword [0x48e35c], edx
xor eax, eax
pop ebx
ret