joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411fea
Capabilities:
Encode data using xor

Disassembly:
cmp dh, byte [ebx]
adc dword [esi], ebx
push edx
pop sp
aas
xor ecx, ebp
push ds
sbb dword [ebx + 0x6165bbf2], esp
salc
rcr dword [eax - 0x5d], 0x45
sbb eax, 0x62021752
jae 0x412039
mov eax, dword [0xdb023972]
push 0x3c
retf
sub byte [esi], dl
scasb al, byte es:[edi]
and eax, 0x4cdf01a7
dec eax
lds eax, fs:[esi + 0x72]
arpl bp, bp
xor eax, 0xeca56e0c
shl byte [ebx], cl
or ch, byte [ebx + edi*4 - 0x71b4f88d]
js 0x412093
jbe 0x4120aa
fnsave dword [esi - 0x4f]
mov dword [0x8b2f291b], eax
pop ebx
jne 0x4120d2
pop eax
or al, 0xdb
cmp eax, 0x8a957ddc
cmp eax, 0x370efc93
les edi, [ecx + 0x4e]
mov ch, 0x97
jae 0x4120cf
mov ebx, 0xf2e20374
aam 0x61
pushfd
pop edi
js 0x412090
push 0xe9a02be9
mov ch, byte [eax - 0x60213ee6]
xor al, 0x8e
mov edi, dword [edx - 2]
leave
mov cs, word [ebx + 0x46c9fe7a]
dec cl
inc esi
xchg ecx, eax
pop ecx
invalid
xchg byte [edi - 0x4d290ce8], al
push cs
stosb byte es:[edi], al
xor dword [esi + 0x3e90a2ee], esp
loope 0x41206d
sbb al, 0x75
and byte [ecx - 0x7e], dl
stosb byte es:[edi], al
pop esp
mov ds, ebp
loope 0x412111
mov bl, byte [edi + 0x74f4f01]
ja 0x4f2c8b7d
stosb byte es:[edi], al
push 0xffffffffffffffeb
dec esi
jmp 0x4120bb
or al, 0x59
mov ecx, 0x190b478d
out dx, eax
or edi, esp
out 2, al
rol byte [0xa284a92], 1
invalid

Function at 0x41700f
Capabilities:
Encode data using xor

Disassembly:
rcl ebp, cl
and al, byte [0xb927fa14]
insd dword es:[edi], dx
and dword [edi + 0x21cee52c], ecx
mov ss, word [ecx]
pushal
sub byte [esp + ebx*2 - 0x7d184685], al
dec esp
cmp esi, edx
mov ah, 0x62
invalid
jg 0x41706f
in al, 0xe1
and al, byte [ebx]
sub esi, ecx
js 0x416fe9
and al, 0xf0
jmp dword [ecx + 0x57]
dec byte [edi + 0x26]
wait
add al, 0x25
sbb eax, 0xc86982d9
sti
push esi
xor dword [edx + 0x61], 0x1c341f5d
xor al, 0x1c
sal byte [ecx + 0x62], cl
outsd dx, dword [esi]
mov edx, 0x11c8bbe
idiv byte [ecx - 0x64ad6d8f]
pushal
dec ebp
mov ebx, 0x8972d6e9
mov dh, 0x17
and eax, 0xb3e5d000
out 0xf4, al
enter 0xffffffffffffb0a6, 0x43
mov al, 0x43
dec esi
add dword [ebx + 0x56], 0x68
inc ecx
out 0xd5, eax
push edi
daa
in al, 7
push es
cdq
pop eax
lodsb al, byte [esi]
xor al, byte [ebx - 0x46]
push ebp
jb 0x417082
pop esi
push edi
sub ch, byte [edx]
pop edi
or al, 0x49
add ebx, dword [esi - 0x344ec4e3]
mul byte [esp + ebp*2]
outsb dx, byte [esi]
xor byte [edx - 0x12], dh
cmc
or bl, bh
inc ebp
invalid

Function at 0x417e0c
Capabilities:
Encode data using xor

Disassembly:
inc ebx
inc ecx
mov ch, 0x7e
loop 0x417e0e
pop eax
sbb dword [ebp - 0x71], ecx
out dx, eax
in al, dx
sal edi, cl
stosd dword es:[edi], eax
cmp bl, dl
dec ebp
or bl, byte [edx]
or dh, dl
xor byte [edi], 0x87
adc dword [ecx + 8], ebx
xor ch, bl
push eax
sbb eax, ecx
lodsd eax, dword [esi]
das
xchg ebp, eax
cmovb esi, dword [edx + 0x5e79f568]
mov ss, word [ebp - 0x60]
sbb esp, dword [esi + 0x57]
std
lcall 0xd23b, 0xb0ecc006
sal dword [esi], 0xac
aam 0xbc
movsd dword es:[edi], dword [esi]
adc eax, 0x33e74a5f
mov ecx, 0xe8423364
cmc
add dword [esi - 0x14], edx
lahf
jb 0x417e1a
jmp 0xf9fbea7
Function at 0x418302
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52abd2
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4183ca
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52abd2
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5248ad
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418470
cmp edi, dword [esi + 0x7c]
jge 0x418470
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042cd14
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042cd14
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52abd2
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52abd2
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4183c2
jmp 0x418392
call fcn.00430f3b
int3
Function at 0x429152
Capabilities:
Encode data using xor

Disassembly:
push ebp
rcr ebx, 0xfa
aaa
push edi
mov ebx, 0x9a5dbdec
leave
inc esp
mov ebp, 0x44c99a5d
shl byte [edi + ebx*2], cl
lodsd eax, dword [esi]
cmp byte [0x5db722c2], ah
xor byte [ecx + 0x75], bh
js 0x429122
movsb byte es:[edi], byte [esi]
invalid
mov al, 0x20
mov ah, 0x7c
pop dword [esi - 0x6c]
push cs
fisubr word [edi + 0x2229950d]
add byte [ebp + 0x2f], al
in al, dx
sub ebp, ebp
jo 0x429137
mov ebx, eax
scasd eax, dword es:[edi]
clc
add dword [edi + 0x17338df1], eax
nop
adc bl, byte [eax - 0x41550f75]
xchg ebp, eax
movsd dword es:[edi], dword [esi]
mov al, byte [0x129e3963]
or al, cl
in al, 0xd1
and al, 0x8e
push ebx
inc ebx
jns 0x42911a
fild qword [ecx]
xor dword [esi + 0x66ec4aa6], esi
jle 0x4291b1
and al, ch
enter 0xfffffffffffffbdb, 0xffffffffffffff8d
pop eax
lahf
push ebp
jae 0x42921b
sub ecx, dword [ebx + esi*2 + 0x65]
into
xor byte [ebp + 0x4b], 0x51
inc ah
lcall 0xc8cc, 0x68230957
adc dl, al
push 0xc210c8cc
jmp 0x883a0965
dec edi
popfd
xchg edx, eax
push edx
ljmp 0x1c04

Function at 0x445fd2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
Function at 0x446019
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5588a2
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x44609a
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5588a2
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x55257d
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x446140
cmp edi, dword [esi + 0x7c]
jge 0x446140
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.0045a9e4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.0045a9e4
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5588a2
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5588a2
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446092
jmp 0x446062
call fcn.0045ec0b
int3

Function at 0x45cc32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38

Function at 0x46544f
Capabilities:
Encode data using xor

Disassembly:
push cs
out dx, eax
sar ebp, 1
push edi
cmpsd dword [esi], dword es:[edi]
cmp dword [ebp + 0x6935de42], esp
xor dword [ecx - 0x7a96658d], esp
xchg byte [edi], bh
aas
aas
mov bh, 0x82
test ch, ch
push edi
sbb dh, byte [ebx + 0x2d]
jg 0x46543e
and ch, ah
pop eax
arpl word [edx - 0x709c841e], cx
enter 0x66df, 0x5e
xchg byte [esp + ecx*8 + 0x7a19d6ea], cl
jae 0x46543c
adc edx, dword [edi + edx*2 + 0x43]
invalid

Function at 0x46cb76
Capabilities:
Encode data using xor

Disassembly:
push cs
lodsd eax, dword [esi]
out 3, al
rcr byte [edx + 0x739b061c], 0xc3
invalid
Function at 0x4a1913
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add byte [eax - 0x18], dl
inc edi
imul eax, dword [ecx], 0
mov edi, eax
test edi, edi
je 0x4a197e
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x60]
push ecx
push 0x3c
push edx
call dword [0x5361c4]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x50], 0x190
xor eax, eax
mov cl, byte [eax + 0x55ec5c]
mov byte [ebp + eax - 0x44], cl
inc eax
test cl, cl
jne 0x4a193d
mov ecx, edi
call 0xcd16e5a4
int3
jmp loc.00665250

Function at 0x4ad372
Capabilities:
Encode data using xor

Disassembly:
add edx, dword [ebx - 0x10]
adc byte [edx], dh
add esi, dword [eax + 0x43816c4b]
xchg dword [0xcf5b5eac], edi
sub byte [esi], bl
mov byte [0xf7a77777], al
jae 0x4ad3fe
and dword [ecx + ebp - 0x6a], edx
fimul word [edi + ecx + 0x57]
sub dword [esi + 0x570f4cde], edx
ror dword [ecx - 0x49], 1
mov ah, ah
push edi
dec ecx
mov bh, 0x8a
in al, 0x57
fdivr st(5), st(0)
mov ecx, 0x66640562
jle 0x4ad40b
test byte [edi - 0x2829569b], ch
cmp dl, byte [ecx]
scasd eax, dword es:[edi]
test eax, 0x113ad7d6
cmp dl, ah
pushfd
ror byte [ebp + ebp*2 - 0xf], 1
xor eax, 0xfc72bd6b
adc esi, dword [esi - 0x70e3169e]
jge 0x4ad3a4
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
mov esi, 0xef24763a
pop edi
mov esp, 0x4a2234e0
and byte [esi - 0x5f], ah
mov byte [ebx], bl
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
or eax, 0x5f2b22b4
int1
sbb eax, 0x635b94a5
test byte [ebx - 0x6d], bl
dec edi
push esp
jl 0x4ad3ae
and esp, dword fs:[ebx + ecx*2 - 0x5d]
popal
push ecx
cli
jecxz 0x4ad395
and al, 0xa7
in al, 0x14
aaa
in al, dx
test byte [ebp - 1], 0x56
out 0x69, eax
and eax, 0x53965655
push esi
xchg esi, eax
push ebx
sahf
lea esi, [eax - 0x7f]
jo 0x4ad38e
sbb dword [ebp + 0x62f47951], ebp
jnp 0x4ad40a
Function at 0x4ba05d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c13f0
cmp edx, dword [eax]
je 0x4ba07f
add eax, 8
inc ecx
cmp eax, 0x4c1480
jl 0x4ba070
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c13f0]
jne 0x4ba1ad
mov eax, dword [0x4c5d90]
cmp eax, 1
je 0x4ba187
test eax, eax
jne 0x4ba0b0
cmp dword [0x4c131c], 1
je 0x4ba187
cmp edx, 0xfc
je 0x4ba1ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba0e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baa40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004baed0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba12a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004baed0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf72c
push edi
call fcn.004bcda0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baa40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baa50
lea eax, [ebp - 0xa0]
push 0x4bf70c
push eax
call fcn.004baa50
push dword [esi + 0x4c13f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baa50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcd14
add esp, 0x2c
pop edi
jmp 0x4ba1ad
lea eax, [ebp + 8]
lea esi, [esi + 0x4c13f4]
push 0
push eax
push dword [esi]
call fcn.004baed0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4019b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi]
test ecx, ecx
je 0x4019ea
mov eax, dword [ecx]
and eax, 0xff
cmp eax, 0x80
jae 0x4019d5
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
test eax, eax
jne 0x4019e4
mov eax, dword [edi]
push eax
call fcn.00402770
add esp, 4
mov dword [edi], 0
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
push 0
inc esi
push esi
push edi
call fcn.004012c0
mov edi, dword [edi]
test edi, edi
je 0x401a1b
push esi
add edi, 4
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
pop edi
pop esi
mov eax, 4
pop ebx
ret 4

Function at 0x402a50
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
fild qword [esp + 0x10]
fstp qword [esp + 0x28]
fldz
fld qword [0x4f85a8]
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 0x44
jp 0x402a8f
lea ecx, [esp + 0x18]
fstp st(0)
push ecx
call esi
fild qword [esp + 0x18]
fst qword [0x4f85a8]
fstp qword [esp + 8]
fldz
fld qword [0x4f85a0]
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 0x44
jp 0x402ac3
lea edx, [esp + 0x20]
fstp st(0)
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp + 0x20]
fdivr qword [0x48b4b0]
fst qword [0x4f85a0]
fld qword [esp + 0x28]
pop esi
fsub qword [esp + 4]
fmulp st(1)
add esp, 0x30
ret
Function at 0x403a20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x477868
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
push 0x4f4700
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x403a64
xor edi, edi
xor esi, esi
jmp 0x403a77
push ebx
call fcn.00402560
mov edi, eax
add esp, 4
mov esi, edi
neg esi
sbb esi, esi
and esi, ebx
push edi
push esi
xor ebx, ebx
push ebx
push 0x4f4700
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403aef
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x48c8b8
push edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403aef
mov eax, dword [esp + 0x1c]
movzx edx, word [eax + 0x12]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
movzx edx, word [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov dword [esp + 0x30], 0xffffffff
cmp esi, ebx
je 0x403ada
cmp edi, ebx
je 0x403ada
push edi
call fcn.00402770
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x30], 0xffffffff
cmp esi, ebx
je 0x403b08
cmp edi, ebx
je 0x403b08
push edi
call fcn.00402770
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403ca0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call fcn.0045c600
mov ecx, dword [esp + 0x4c]
add esp, 0xc
lea edx, [esp]
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], 0x4f4700
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 5
mov dword [esp + 8], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp byte [esp + 0x44], 0
je 0x403d19
mov eax, dword [esp + 0x38]
test eax, eax
je 0x403d19
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x3c
ret
Function at 0x403f40
Capabilities:
Create process on windows
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x478e4b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
cmp byte [esp + 0x24], 0
je 0x403fe2
push 0x4f85e0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x30
call fcn.00402560
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x403fa1
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push eax
call fcn.00403d50
mov esi, eax
jmp 0x403fa3
xor esi, esi
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x418400
call fcn.0045d945
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push 5
push 0
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
dec ecx
mov eax, ecx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret

Function at 0x404020
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4eec64]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.0045c600
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x404075
xor al, al
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045c0ce
add esp, 0x98
ret
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x94]
setae al
xor ecx, esp
call fcn.0045c0ce
add esp, 0x98
ret
Function at 0x4070b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x476bf8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x10]
xor edi, edi
push eax
mov dword [esi], vtable.ytBaseThread.0
mov dword [esi + 8], edi
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0xc], edi
mov dword [esp + 0x14], edi
push 4
mov dword [esi], vtable.ytGetThread.0
mov dword [esi + 0x28], edi
call fcn.0045bbe0
add esp, 4
mov dword [esi + 0x2c], eax
cmp eax, edi
je 0x407115
mov dword [eax], 1
or eax, 0xffffffff
mov byte [esi + 0x40], 1
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x40efc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x40f01a
push esi
lea eax, [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
pxor mm7, mm7
movq mm5, qword [0x48c680]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
movd mm1, dword [esi]
punpcklbw mm1, mm7
movq mm4, mm1
punpckhwd mm4, mm4
punpckhdq mm4, mm4
movd mm0, dword [edi]
punpcklbw mm0, mm7
movq mm2, mm4
pxor mm2, mm5
pmullw mm0, mm2
psrlw mm0, 8
paddw mm0, mm1
packuswb mm0, mm7
movd dword [edi], mm0
add edi, 4
dec dword [ebp + 0x10]
jg 0x40eff4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4108a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
cmp ebp, 0x1000000
jb 0x4109d1
mov edi, dword [esp + 0x20]
mov eax, edi
call fcn.0040f920
cmp eax, 3
je 0x4109d1
mov eax, dword [edi + 8]
sub eax, dword [edi]
mov dword [esp + 0x18], eax
cmp ebp, 0xff000000
jae 0x410998
mov ecx, dword [edi + 4]
cmp ecx, dword [edi + 0xc]
mov dword [esp + 0x20], ecx
jge 0x4109c6
mov edx, dword [ebx + 4]
mov eax, dword [edi]
imul edx, ecx
mov esi, dword [ebx + 0x10]
add edx, eax
cmp byte [0x4f96b0], 0
lea esi, [esi + edx*4]
je 0x410928
cmp dword [esp + 0x18], 0x10
jbe 0x410928
mov edx, dword [edi + 8]
sub edx, eax
push edx
push ebp
push esi
call fcn.0040efc0
add esp, 0xc
jmp 0x410988
mov ebx, eax
cmp ebx, dword [edi + 8]
jge 0x410984
shr ebp, 0x18
mov edx, pe_nt_image_headers32
sub edx, ebp
lea esp, [esp]
mov eax, dword [esi]
mov ecx, eax
and eax, 0xff00ff
shr ecx, 8
imul eax, edx
mov ebp, ecx
and ebp, 0xffff00ff
imul ebp, edx
and ecx, 0xff00ff
imul ecx, edx
shr eax, 8
xor eax, ebp
mov ebp, dword [esp + 0x24]
and eax, 0xff00ff
xor eax, ecx
add eax, ebp
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, dword [edi + 8]
jl 0x410940
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
inc ecx
cmp ecx, dword [edi + 0xc]
mov dword [esp + 0x20], ecx
jl 0x4108f6
jmp 0x4109c6
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jge 0x4109c6
mov edx, dword [ebx + 4]
mov eax, dword [edi]
imul edx, esi
mov ecx, dword [edi + 8]
sub ecx, eax
push ecx
add edx, eax
mov eax, dword [ebx + 0x10]
lea ecx, [eax + edx*4]
push ebp
push ecx
call fcn.0040f020
inc esi
add esp, 0xc
cmp esi, dword [edi + 0xc]
jl 0x4109a0
cmp byte [0x4f96b0], 0
je 0x4109d1
emms
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x410d20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 0xc]
imul eax, dword [ecx + 8]
push esi
mov esi, dword [ecx + 0x10]
push edi
xor edi, edi
test eax, eax
jbe 0x410d84
push ebx
push ebp
mov eax, dword [esi]
mov edx, eax
shr edx, 0x18
inc edx
mov ebx, eax
and ebx, 0xffff00ff
imul ebx, edx
mov ebp, eax
and ebp, 0xff00
imul ebp, edx
xor ebx, ebp
mov ebp, eax
and ebp, 0xff00ff
imul ebp, edx
and ebx, 0xff0000
xor ebx, ebp
shr ebx, 8
and eax, 0xff000000
or ebx, eax
mov dword [esi], ebx
mov edx, dword [ecx + 0xc]
imul edx, dword [ecx + 8]
inc edi
add esi, 4
cmp edi, edx
jb 0x410d34
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret