joyce8/EMBER2024-capa huggingface dataset:
Function at 0x588ae0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5debc1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6068d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.005857f0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x588b96
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.00562030
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.00562090
push eax
mov ecx, dword [ebp + 0xc]
call fcn.005857f0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00562090
push eax
mov ecx, dword [ebp + 8]
call fcn.00548d10
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00562070
mov eax, dword [ebp + 8]
jmp 0x588bb5
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00548cc0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x588fb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5decb1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6068d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x589058
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00562030
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.00562090
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00562090
push eax
mov ecx, dword [ebp + 8]
call fcn.00548d10
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00562070
mov eax, dword [ebp + 8]
jmp 0x589073
mov ecx, dword [ebp + 8]
call fcn.00548c90
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x589a30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5def21
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6068d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00562030
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.00562090
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00562090
push eax
mov ecx, dword [ebp + 8]
call fcn.00548d10
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00562070
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x59d6b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1f88
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x6068d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0x61d4d8]
test eax, eax
jne 0x59d6e5
call fcn.0059d5a0
movzx ecx, byte [0x61d4d1]
test ecx, ecx
jne 0x59d79f
movzx edx, byte [0x61d4d0]
test edx, edx
jne 0x59d79f
cmp dword [0x61d5dc], 0
je 0x59d748
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x61d5dc]
push ecx
call fcn.005894f0
add esp, 8
mov dword [ebp - 0x10], eax
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x186
mov eax, dword [0x61d5dc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x61d5dc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x59d79f
push 0x61d4d8
lea ecx, [ebp - 0x74]
call fcn.00585020
mov dword [ebp - 4], 0
push 0x10001
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00589300
add esp, 0x10
xor edx, edx
cmp eax, 2
sete dl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.005444f0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x59d79f
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5a9300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x5a930f
mov eax, dword [eax + 4]
jmp 0x5a9312
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5a939b
push esi
mov esi, dword [0x61d998]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x5a9380
cmp eax, 3
je 0x5a9380
cmp eax, 0x7b
je 0x5a9380
cmp eax, 0x57
je 0x5a9380
cmp eax, 0xa1
je 0x5a9380
cmp eax, 0x35
je 0x5a9380
cmp eax, 0x20
jne 0x5a9375
mov eax, dword [0x61d99c]
mov dword [ecx], eax
mov edx, dword [0x61d9a0]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x61d99c]
mov dword [ecx], eax
mov edx, dword [0x61d9a0]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x61d99c]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x61d9a0]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x5a93c8
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x5a93e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x5a93ef
mov eax, dword [eax + 4]
jmp 0x5a93f2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5a947b
push esi
mov esi, dword [0x61d998]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x5a9460
cmp eax, 3
je 0x5a9460
cmp eax, 0x7b
je 0x5a9460
cmp eax, 0x57
je 0x5a9460
cmp eax, 0xa1
je 0x5a9460
cmp eax, 0x35
je 0x5a9460
cmp eax, 0x20
jne 0x5a9455
mov eax, dword [0x61d99c]
mov dword [ecx], eax
mov edx, dword [0x61d9a0]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x61d99c]
mov dword [ecx], eax
mov edx, dword [0x61d9a0]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x61d99c]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x61d9a0]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x5a94a8
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x5aff32
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6068d0]
jne 0x5aff3c
repz ret
jmp fcn.005bc62c
Function at 0x5cb25f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.005bbe81
xor ebx, ebx
cmp dword [0x61e4e4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x5cb334
push 0x60c970
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x5cb29f
xor eax, eax
jmp 0x5cb3f8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x60c964
push edi
call esi
cmp eax, ebx
je 0x5cb298
push eax
call fcn.005bbe1e
mov dword [esp], 0x60c954
push edi
mov dword [0x61e4e4], eax
call esi
push eax
call fcn.005bbe1e
mov dword [esp], 0x60c940
push edi
mov dword [0x61e4e8], eax
call esi
push eax
call fcn.005bbe1e
mov dword [0x61e4ec], eax
lea eax, [ebp - 8]
push eax
call fcn.005b456f
test eax, eax
pop ecx
pop ecx
je 0x5cb302
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005b082d
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x5cb334
push 0x60c924
push edi
call esi
push eax
call fcn.005bbe1e
cmp eax, ebx
pop ecx
mov dword [0x61e4f4], eax
je 0x5cb334
push 0x60c90c
push edi
call esi
push eax
call fcn.005bbe1e
pop ecx
mov dword [0x61e4f0], eax
mov eax, dword [0x61e4f0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x5cb3ad
cmp dword [0x61e4f4], esi
je 0x5cb3ad
push eax
call fcn.005bbe8a
pop ecx
call eax
cmp eax, ebx
je 0x5cb37a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x61e4f4]
call fcn.005bbe8a
pop ecx
call eax
test eax, eax
je 0x5cb37a
test byte [ebp - 0x18], 1
jne 0x5cb3ad
lea eax, [ebp - 0xc]
push eax
call fcn.005b461e
test eax, eax
pop ecx
je 0x5cb395
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.005b082d
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x5cb3a4
or dword [ebp + 0x10], 0x200000
jmp 0x5cb3de
or dword [ebp + 0x10], 0x40000
jmp 0x5cb3de
mov eax, dword [0x61e4e8]
cmp eax, esi
je 0x5cb3de
push eax
call fcn.005bbe8a
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5cb3de
mov eax, dword [0x61e4ec]
cmp eax, esi
je 0x5cb3de
push dword [ebp - 4]
push eax
call fcn.005bbe8a
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x61e4e4]
call fcn.005bbe8a
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5d58ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x5d5984
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.005b0de0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x5d5947
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x5d5969
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x5d59df
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.005d564f
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x5d59cb
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x5d59df
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x5d5908
pop esi
pop ebx
leave
ret
Function at 0x5e5a4c
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x1c
push 0x61b940
call fcn.005bb5d4
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x5b0c55
push 0x12
call fcn.005b0bb5
pop ecx
mov eax, 0xff
jmp 0x5b0dca
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x5b0c70
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x5b0c4b
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x5b0ca2
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x61da4c], esi
mov dword [0x61da54], eax
mov dword [0x61da58], ecx
mov dword [0x61da5c], edx
mov dword [0x61da50], edi
call fcn.005b0bd9
mov dword [ebp - 0x20], eax
push 1
call fcn.005bde58
pop ecx
test eax, eax
jne 0x5b0ce8
push 0x1c
call fcn.005b0bb5
pop ecx
call fcn.005bc276
test eax, eax
jne 0x5b0cf9
push 0x10
call fcn.005b0bb5
pop ecx
call fcn.005bf998
and dword [ebp - 4], 0
call fcn.005bf70c
test eax, eax
jge 0x5b0d13
push 0x1b
call fcn.005b44c6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x61f680], eax
call fcn.005bf5d7
mov dword [0x61da3c], eax
call fcn.005bf51e
test eax, eax
jge 0x5b0d39
push 8
call fcn.005b44c6
pop ecx
call fcn.005bf2a1
test eax, eax
jge 0x5b0d4a
push 9
call fcn.005b44c6
pop ecx
push 1
call fcn.005b4704
pop ecx
test eax, eax
je 0x5b0d5d
push eax
call fcn.005b44c6
pop ecx
mov eax, dword [0x61da6c]
mov dword [0x61da70], eax
push eax
push dword [0x61da64]
push dword [0x61da60]
call section..xwrky
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x5b0d8b
push eax
call fcn.005b4864
call fcn.005b4886
jmp 0x5b0dc0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.005bb619
ret
call fcn.005bf9e0
jmp 0x5b0c1a
pop eax
sub eax, 5
sub eax, esi
mov dword [esi + 1], eax
popal
jmp 0x5b0dd0
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x3f086c3e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x1df85b8f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40f0e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40f11e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40f116
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40f120
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40f106
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40f200
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40f231
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40f231
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40f231
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4aed2355
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x253a51c9
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402d30
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x402da0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402df7
xor ecx, ecx
xor edx, edx
jmp 0x402dd9
cmp ax, 0x5c
jne 0x402e60
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402df7
cmp ax, 9
je 0x402de5
cmp ax, 0x20
jne 0x402dc0
test ecx, ecx
je 0x402e4b
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x402dd9
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x402e80
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004021b0
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x402e48
cmp ax, 0x20
je 0x402e48
jmp 0x402df7
cmp ax, 0x22
jne 0x402de9
and edx, 1
jne 0x402de9
xor ecx, 1
jmp 0x402dcd
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x402e10
Function at 0x402da0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x402da0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402df7
xor ecx, ecx
xor edx, edx
jmp 0x402dd9
cmp ax, 0x5c
jne 0x402e60
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402df7
cmp ax, 9
je 0x402de5
cmp ax, 0x20
jne 0x402dc0
test ecx, ecx
je 0x402e4b
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x402dd9
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x402e80
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004021b0
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x402e48
cmp ax, 0x20
je 0x402e48
jmp 0x402df7
cmp ax, 0x22
jne 0x402de9
and edx, 1
jne 0x402de9
xor ecx, 1
jmp 0x402dcd
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x402e10
Function at 0x10006c50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x10006c58
mov eax, esi
pop esi
ret