joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x34
cdq
and edx, 0xf
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
lea edi, [edx + eax]
sar edi, 4
and ebp, 0x8000000f
jns 0x40aa8a
dec ebp
or ebp, 0xfffffff0
inc ebp
mov dword [esp + 0x1c], ebp
je 0x40aa9f
test edi, edi
jne 0x40aa9e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
dec edi
mov eax, dword [esp + 0x58]
mov esi, dword [eax + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x4c], esi
mov esi, dword [eax + 0xc]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
test edi, edi
je 0x40ab32
mov ebp, dword [esp + 0x48]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x50], eax
push esi
push ebx
push dword [ebp + 4]
lea eax, [ebp + 0xf8]
push eax
call fcn.004097c0
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov ecx, dword [ebx]
mov eax, dword [eax + esi + 8]
add esi, 0x10
mov edx, dword [ebx + 4]
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0xc]
add ebx, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
dec edi
jne 0x40aad2
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
test ebp, ebp
je 0x40abfa
mov edi, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], eax
mov dword [ebp], edi
mov edi, ebp
mov dword [esp + 0x2c], ecx
mov dword [edi + 4], edx
lea edx, [esp + 0x34]
push edx
mov dword [edi + 0xc], eax
lea edx, [esp + 0x28]
mov eax, dword [esp + 0x4c]
push edx
mov dword [edi + 8], ecx
push dword [eax + 4]
lea ecx, [eax + 0xf8]
push ecx
mov dword [esp + 0x30], ecx
call fcn.004097c0
mov ebp, dword [esp + 0x2c]
add esp, 0x10
test ebp, ebp
je 0x40abba
mov eax, esi
lea edi, [ebx + 0x10]
sub eax, ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x50], eax
mov ebx, eax
mov al, byte [edi]
lea edi, [edi + 1]
mov cl, byte [edx]
lea edx, [edx + 1]
xor cl, al
mov byte [edx - 1], al
mov byte [ebx + edi - 1], cl
dec ebp
jne 0x40aba4
push esi
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x50]
push dword [eax + 4]
push dword [esp + 0x2c]
call fcn.004097c0
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
pop edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
pop esi
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
pop ebp
mov dword [eax + 4], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x48]
pop ebx
add esp, 0x34
ret
Function at 0x40ac20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x20
cdq
and edx, 0xf
push ebp
mov ebp, dword [esp + 0x30]
push esi
lea esi, [edx + eax]
mov eax, dword [esp + 0x38]
sar esi, 4
push edi
mov edi, dword [esp + 0x34]
and eax, 0x8000000f
jns 0x40ac4c
dec eax
or eax, 0xfffffff0
inc eax
mov dword [esp + 0x34], eax
je 0x40ac60
test esi, esi
jne 0x40ac5f
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
dec esi
push ebx
mov ebx, dword [esp + 0x44]
test esi, esi
je 0x40acbe
mov ecx, dword [esp + 0x34]
lea edx, [ecx + 8]
mov eax, dword [edi]
xor eax, dword [ebx]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
xor eax, dword [edi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 8]
xor eax, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
xor eax, dword [edi + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push ebp
push eax
push dword [ecx + 4]
push edx
call fcn.00409da0
mov ecx, dword [esp + 0x44]
mov ebx, ebp
add esp, 0x10
add edi, 0x10
add ebp, 0x10
lea edx, [ecx + 8]
dec esi
jne 0x40ac70
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40ad72
mov edx, dword [edi + 8]
xor edx, dword [ebx + 8]
mov eax, dword [edi]
xor eax, dword [ebx]
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 4]
mov esi, dword [edi + 0xc]
xor esi, dword [ebx + 0xc]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x14], eax
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x38]
push edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], esi
push dword [eax + 4]
lea ecx, [eax + 8]
push ecx
mov dword [esp + 0x4c], ecx
call fcn.00409da0
mov ebx, dword [esp + 0x48]
add esp, 0x10
xor esi, esi
test ebx, ebx
je 0x40ad39
lea edx, [ebp + 0x10]
sub edi, ebp
lea esp, [esp]
mov cl, byte [esp + esi + 0x20]
lea edx, [edx + 1]
mov al, byte [edi + edx - 1]
xor al, cl
mov byte [edx - 1], cl
mov byte [esp + esi + 0x20], al
inc esi
cmp esi, ebx
jb 0x40ad20
lea eax, [esp + 0x20]
push eax
push eax
mov eax, dword [esp + 0x3c]
push dword [eax + 4]
push dword [esp + 0x48]
call fcn.00409da0
mov eax, dword [esp + 0x30]
lea ebx, [esp + 0x30]
mov dword [ebp], eax
add esp, 0x10
mov eax, dword [esp + 0x24]
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 0xc]
pop ebx
pop edi
pop esi
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x34]
pop ebp
add esp, 0x20
ret
Function at 0x405d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00405f20
test dword [edi + ecx + 0x7900fd69], ebp
add bl, bl
cmp eax, 0x4108dc
adc al, 0xf
stc
out dx, al
add byte [ebp - 0x7e], bl
mov eax, dword [0x410384]
test eax, eax
jne 0x405e2e
mov dword [0xea410384], 0xed
call ebp
pop esp
rol byte [eax], 0
mov esi, eax
and esi, esi
je 0x405db3
mov eax, dword [0x410358]
test esp, ecx
jne 0x405d89
push eax
push str.CommandLineToArgvW
push 4
call 0x8ba940
add esp, 0xc
mov dword [0xe10358], eax
test eax, eax
psllq mm5, qword [edi - 0x72ff5300]
loop 0x405d88
add byte [ebp + 0x5651fce2], cl
invalid
push ecx
push esi
call eax
mov ebp, edx
test esi, esi
je 0x405db3
scasd eax, dword es:[edi]
pop edi
cld
mov eax, dword [ebp + 0xc]
push edx
push esi
push eax
call fcn.0040a664
popfd
and eax, 0x51bb0108
push esi
outsd dx, dword [esi]
add edi, edi
adc eax, sym.imp.KERNEL32.dll_GlobalFree
cmpsd dword [esi], dword es:[edi]
call dword [0x1240c0be]
mov ebx, eax
call cs:[ecx + 0x72241578]
add eax, 0x85e85000
add byte [eax], al
cwde
mov edi, dword [ebp + 0x10]
add esp, 0xc
test edi, edi
je 0x405e02
test dword [eax], eax
add byte [eax - 0x7cef8275], bl
les ecx, [eax*4 - 0x72d28b01]
xor al, 7
lea esi, [edi + eax]
xor al, 0
add byte [eax], al
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [edi], eax
call dword [0x1740c124]
mov edi, dword [edi]
mov ecx, esi
mov esi, dword [eax]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jnp 0x405dc7
adc dword [edi], 3
das
movsb byte es:[edi], byte [esi]
push ebx
call dword [0xa9c050]
mov esi, dword [sym.imp.MSVCRT.dll___p__wenviron]
call esi
mov ecx, dword [eax]
pop dword [ebp - 0xe93b37]
salc
mov edi, dword [eax]
cmpsd dword [esi], dword es:[edi]
salc
push edi
invalid
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xbf
Function at 0x409fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a15b
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40a14e
mov ebp, dword [eax]
cmp ebp, 0
je 0x40a14e
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40a029
mov ebx, 0x5fe393
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042a460
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40a0ac
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40a05a
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x40a080
inc eax
cmp eax, 8
jb 0x40a03e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x40a037
mov ebx, 0x6da6a0
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40a054
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40a14a
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40a037
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40a146
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40a146
mov eax, 1
cmp al, 0
jne 0x40a037
mov ecx, edx
jmp 0x40a037
xor eax, eax
jmp 0x40a136
xor ebx, ebx
jmp 0x40a0e3
mov ebx, 0x6da6a0
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
call fcn.00450ed0
jmp fcn.00409fd0
Function at 0x40a170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a30e
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40a2fc
mov ebp, dword [eax]
cmp ebp, 0
je 0x40a2fc
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40a1c9
mov ebx, 0x5fe393
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042a460
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40a25a
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40a1fe
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x40a229
inc eax
cmp eax, 8
jb 0x40a1e2
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x40a1db
mov ebx, 0x6da6a0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40a1f8
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40a2f8
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40a1db
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40a2f4
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40a2f4
mov eax, 1
cmp al, 0
jne 0x40a1db
mov ecx, edx
jmp 0x40a1db
xor eax, eax
jmp 0x40a2e4
xor ebx, ebx
jmp 0x40a291
mov ebx, 0x6da6a0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
call fcn.00450ed0
jmp fcn.0040a170
Function at 0x40a320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a4b2
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40a4a5
mov ebp, dword [eax]
cmp ebp, 0
je 0x40a4a5
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40a379
mov ebx, 0x5fe393
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.0042a460
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40a403
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, 8
jae 0x40a3b1
mov esi, ecx
shl esi, 3
add esi, 8
mov ebx, edx
add ebx, esi
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp eax, dword [esp + 0x1c]
jne 0x40a3ab
cmp esi, dword [esp + 0x18]
je 0x40a3d7
inc ecx
cmp ecx, 8
jb 0x40a38e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, edx
add ebx, eax
mov edx, dword [ebx]
xor ebp, ebp
cmp edx, ebp
jne 0x40a387
mov ebx, 0x6da6a0
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
mov ebx, edx
add ebx, ecx
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40a3ab
mov eax, edx
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov edx, ebp
imul edx, ecx
add edx, 0x48
mov ebx, eax
add ebx, edx
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40a4a1
shl ebx, cl
dec ebx
mov ecx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov edx, dword [edi + 0xc]
add edx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40a387
shr ecx, 1
and ecx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, ecx
imul ebp, ebx
mov ecx, eax
add ecx, ebp
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40a49d
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40a49d
mov eax, 1
cmp al, 0
jne 0x40a387
mov edx, ecx
jmp 0x40a387
xor eax, eax
jmp 0x40a48d
xor ebx, ebx
jmp 0x40a43a
mov ebx, 0x6da6a0
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
call fcn.00450ed0
jmp fcn.0040a320
Function at 0x442df0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x442fdf
sub esp, 0x3c
mov edi, dword [esp + 0x40]
mov ecx, dword [edi + 4]
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xe9
xchg ebp, eax
jne 0x442e37
mov ebp, dword [edi + 4]
add ebp, 5
mov dword [esp + 0xc], ebp
mov esi, ecx
inc esi
mov eax, dword [esi]
cdq
mov ebx, dword [esp + 0xc]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xeb
xchg ebp, eax
jne 0x442e62
mov ebp, dword [edi + 4]
add ebp, 2
mov dword [esp + 8], ebp
mov eax, ecx
inc eax
movzx eax, byte [eax]
movsx eax, al
cdq
mov ebx, dword [esp + 8]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xcc
xchg ebp, eax
jne 0x442e70
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xor edx, edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
movzx ebp, byte [ecx + 1]
xor edx, edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edx
movzx ebp, byte [ecx + 2]
xor edx, edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edx
movzx ebp, byte [ecx + 3]
xor edx, edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x38], ecx
movzx ebp, byte [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
call fcn.0042ac40
mov ebx, 0x5f79aa
mov dword [esp], ebx
mov dword [esp + 4], 0xc
call fcn.0042b650
mov ebx, dword [esp + 0x38]
mov dword [esp], ebx
call fcn.0042b610
mov ebx, 0x5f5784
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042b650
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0042b4e0
mov ebx, 0x5f5784
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042b650
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0042b4e0
mov ebx, 0x5f5784
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042b650
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0042b4e0
mov ebx, 0x5f5784
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042b650
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.0042b4e0
mov ebx, 0x5f5784
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042b650
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0042b4e0
mov ebx, 0x5f57a6
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042b650
call fcn.0042acc0
mov ebx, 0x5fea9e
mov dword [esp], ebx
mov dword [esp + 4], 0x22
call fcn.0042a460
add esp, 0x3c
ret
call fcn.00450ed0
jmp fcn.00442df0
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x67c04c12
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0xafd4404
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x41a1e8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a1ec]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp dword [0x2d4c7ec], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x854]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ecx, dword [0x41a1f0]
mov edx, dword [0x41a1f4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x2d4c7ec], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d4c7e8]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0x2d4c7ec], 0x3eb
mov dword [0x2d4c7e8], eax
mov eax, dword [0x2d4c73c]
cmove eax, dword [ebp - 8]
mov dword [0x2d4c73c], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], edx
and dword [ebp - 8], 0
mov dword [0x2d4c7e4], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0x2d4c7ec], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x401359
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0x2d4c7ec], 0xb03
mov dword [ebp - 4], ecx
jne 0x40139c
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jne 0x40127f
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret