joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2ded
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop dword [esp]
call fcn.004b2ded
xchg edi, eax
dec cl
jecxz 0x4b19f2
mov edi, 0xebe5f644
pop edx
sbb ebp, dword [eax - 0x75]
and bl, byte [ebp - 0x54]
stc
cmc
jmp 0x4b2dcc
call fcn.004b35bb
inc eax
idiv byte [edx]
xor eax, 0x9c07092b
xor dword [ebp + 0x38], esp
mov al, byte [0xaf5ccd07]
mov dh, 0xe8
not byte [eax]
add byte [eax], al
push word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 4], eax
push si
lea esp, [esp + 2]
popal
jmp 0x4b1a55
test cl, cl
je 0x4b1d88
jne 0x4b2e03
jo 0x4b2de2
sti
cwde
xor al, ch
insd dword es:[edi], dx
or byte [edi + 0x21], bl
xlatb
or dword ds:[eax - reloc.MSVCRT.dll_strncpy], ebp
or dword [eax - reloc.MSVCRT.dll_strncpy], ebp
push edi
pushal
xchg dh, dl
setns ch
jmp 0x4b2dbc
push dx
pop word [esp]
jmp 0x4b2e0a
inc edx
inc esi
jmp 0x4b1a55
lea esp, [esp + 4]
mov cl, byte [esi]
lea edi, reloc.MSVCRT.dll_strncpy
sub esp, 1
lea esp, [esp + 1]
jmp 0x4b2e5a
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
push esi
lea esi, [ecx + 0x24]
jmp 0x4b2de4
lea esp, [esp + 2]
jmp 0x4b2e67
movzx eax, byte [edx]
rol edi, cl
movzx edi, cl
sub esp, 0x12
jmp 0x4b2e44
sub eax, edi
lea esp, [esp + 0x10]
je 0x4b1d72
jne 0x4b1d88
sbb esi, dword [edx + 0x6d]
jl 0x4b2edf
idiv dword [edi + reloc.MSVCRT.dll_strncpy]
nop
cld
dec edi
salc
inc ecx
jmp 0x4b2e33
and al, 4

Function at 0x51515e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x51518c
mov esi, eax
mov bx, ax
mov eax, dword [esp]
mov cl, 0xa9
pop cx
sub ah, dh
jmp 0x5151d2
stc
mov dx, 0xc8b
stc
push word [esp + 2]
mov dword [esp], edx
xchg si, dx
jmp 0x5151bc

Function at 0x515822
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x17]
lea esp, [esp + 0x17]
xchg dl, ah
xchg word [esp + 0xa], bp
jmp 0x515849
not si
xchg dword [esp + 0x10], eax
mov eax, edx
xchg ecx, eax
cpuid
mov bp, di
jmp 0x5157ea
push word [esp + 0x10]
xchg word [esp + 0x19], cx
neg bx
mov bh, 0x37
jmp 0x515800
sete bh
lea esp, [esp + 3]
pop dword [esp + 4]
bswap ebx
not edi
jmp 0x51587b
mov esi, 0x9209a3fd
bswap eax
pop word [esp + 2]
xchg dword [esp + 3], esi
lea ebp, [eax*4]
mov cx, sp
jmp 0x515833
lea ebp, [ecx + 0x89]
xchg edx, eax
xchg edx, eax
pop ax
bswap ecx
cpuid
jmp 0x5158ec
xchg dword [esp + 3], esi
lea edx, reloc.MSVCRT.dll_strncpy
mov dx, bx
pop word [esp + 2]
add esp, 4
xchg cx, dx
jmp 0x515865
mov al, byte [esp]
xchg bl, al
bt di, bx
mov si, di
cld
xchg byte [esp], ch
jmp 0x5158b8
lea edi, [edi + ebp]
xchg esi, edx
rol ax, cl
rdtsc
clc
mov ebx, eax
jmp 0x5158ce
Function at 0x515bc9
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
btc bx, bp
pop word [esp + 9]
mov byte [esp + 4], dh
xchg word [esp + 0x1e], ax
jmp 0x515bb7
xchg di, si
mov dh, 0x7b
mov bh, byte [esp + 3]
mov bh, 0xc
call 0x515bc9
aam 0x47
xchg byte [esp + 0x13], bl
clc
jmp 0x515c07
mov ax, 0x70de
push esp
xchg bl, bh
mov bx, 0x18df
sub esp, 9
jmp 0x515b8e
xchg byte [esp + 0x10], bh
mov al, bh
mov bh, byte [esp + 2]
setg ah
mov ecx, edx
jmp 0x515c17
not si
lea eax, [edi + edi]
cpuid
sub esp, 9
std
mov ebp, esp
jmp 0x515bf1
mov ch, 0x7d
std
mov bp, 0xe2b5
sub bx, 0x7e5a
lea esp, [esp + 0x2a]
jmp 0x515cb2
mov al, bh
push dword [esp + 4]
pop si
rdtsc
mov byte [esp + 7], cl
pop edx
jmp 0x515c39
inc ecx
mov cl, 0x76
push cx
bt dx, ax
add esp, 0xb
mov byte [esp + 3], ch
jmp 0x515c4f
xchg word [esp + 0xb], ax
setl al
pop ecx
mov ax, dx
mov word [esp], bx
lea edi, [ecx*4]
jmp 0x515c7e

Function at 0x515e93
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov ebp, 0xa4235707
neg cx
xchg dh, al
clc
xchg cl, ah
jmp 0x515ea2
add esp, 0x11
or ecx, 0xecf24d63
lea ecx, [edx + esi]
btr dx, bp
jmp 0x515ee4
not dx
mov ax, word [esp]
bt esi, esi
setnp ch
jmp 0x515e6c
xchg cl, dl
lea esp, [esp + 0xf]
setae bh
mov bl, 0x33
adc si, 0x8495
mov eax, 0xb3a7f053
jmp 0x515e7c
add esp, 0
bswap edx
bsf bp, bx
xchg di, ax
lea esp, [esp + 3]
lea esp, [esp + 4]
jmp 0x515ece

Function at 0x516a44
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
inc ch
jmp 0x516a69
mov dx, 0x296f
mov edi, 0x522c2f38
mov edx, ebp
lea edi, [edx + ebp]
pushfd
xchg byte [esp + 0x20], dl
jmp 0x516aaa
cpuid
bsr bp, ax
add esp, 2
not al
rdtsc
jmp 0x516b3f
add esp, 4
cld
sub esp, 0x13
mov eax, edi
shl ebx, cl
dec dl
jmp 0x516b10
add esp, 0x1d
push esp
mov di, 0x5f94
mov dl, cl
rdtsc
xchg word [esp + 5], bx
jmp 0x516ad1
lea esp, [esp + 0xd]
lea edx, [edx*4]
xchg ebx, eax
cpuid
bswap edx
jmp 0x516b27
setle dh
mov edi, 0x537beab3
mov esi, 0x42efb423
bswap edx
lea edx, [esi + ebp]
btr ebp, eax
jmp 0x516afa
push dword [esp + 6]
setbe ch
bts ecx, eax
btr si, dx
push ebx
mov edi, esi
jmp 0x516b59
pop word [esp + 2]
cpuid
lea esp, [esp + 4]
xchg di, si
push word [esp + 0x1b]
mov cx, word [esp + 0x14]
jmp 0x516ae7
lea edx, [esi*4]
pop dx
xchg ebp, eax
neg bx
bswap eax
mov ch, dl
jmp 0x516c53
pop di
mov eax, dword [esp]
std
bsf eax, esi
neg eax
mov al, dh
call fcn.00516b82
mov byte [esp + 5], ch
push word [esp + 6]
lea ecx, [edi*4]
mov bl, 0x63
add esp, 0x10
xchg bl, dh
jmp 0x516b99

Function at 0x51700a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, dh
lea ebx, [esi*4]
mov cx, sp
rdtsc
mov di, si
setb bh
jmp 0x517012
rdtsc
xchg byte [esp + 2], cl
jmp 0x516fed
mov word [esp + 2], si
xchg si, ax
lea esp, [esp + 2]
sub ebx, esi
sub esp, 0xc
cpuid
jmp 0x51713f
bswap ebp
cpuid
bts esi, edi
mov bl, byte [esp + 0xa]
xchg byte [esp + 8], cl
neg ebx
jmp 0x51704f
xchg byte [esp + 7], dh
xchg dword [esp + 0xa], ecx
pop di
cpuid
lea eax, [edx*4]
xchg dword [esp + 4], edi
jmp 0x517065
pop edi
mov esi, ebx
neg si
mov byte [esp + 0xa], dh
stc
setg bl
jmp 0x517097
Function at 0x51720f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
jmp 0x517216
push ebx
pushal
bt bp, ax
xchg al, cl
lea esi, [edi + 0xfc]
popal
jmp 0x51724f
push edi
rdtsc
mov si, word [esp + 0xb]
mov word [esp + 0x15], si
not ch
lea edi, [ebp - 0xce]
jmp 0x51729f
xchg dword [esp + 7], ecx
rcr bl, cl
mov dx, 0x1011
mov eax, 0xc6cc59b5
inc ebx
jmp 0x5172b7
mov bl, 0xa9
push word [esp + 7]
neg dx
add esp, 0x16
xchg di, ax
sub ecx, 0x3fc8cff9
jmp 0x517289
neg dx
cpuid
mov eax, 0x6c56d0ef
cpuid
pop word [esp + 4]
sub esp, 0x1a
jmp 0x5172f3
stc
lea eax, reloc.MSVCRT.dll_strncpy
cpuid
push word [esp + 2]
jmp 0x517306
mov edx, esp
pop edi
push dword [esp + 8]
lea esp, [esp + 0x15]
mov byte [esp + 2], dh
mov ebp, edi
jmp 0x5172dd
lea ecx, [edx + edi]
cmp bx, bx
pop dword [esp + 8]
xor esi, 0xae2f5275
push dword [esp]
mov word [esp + 0xb], cx
jmp 0x51733a
rdtsc
lea ecx, [edi*4]
mov cl, byte [esp + 0xe]
neg dl
dec bx
xchg byte [esp], cl
jmp 0x5173b0
pushfd
call fcn.0051736f
mov word [esp + 0xf], bx
add esp, 0xe
stc
lea ecx, [esi*4]
xchg ch, dl
xchg ecx, ebp
jmp 0x517437
mov ebp, edx
mov dword [esp + 6], edi
mov ecx, dword [esp + 0xd]
cpuid
mov ecx, ebp
cpuid
jmp 0x517385
popal
mov si, word [esp]
mov al, 0x3e
push ebp
lea ecx, [edi - 0x79]
mov word [esp + 1], si
jmp 0x5173e5
rol ecx, 0x10
lea edi, [edx + edi]
std
pushal
dec edx
xchg ah, ch
jmp 0x5173c2
mov al, byte [esp + 2]
call fcn.00517414
bsr edi, ebp
mov bx, cx
bswap edi
mov ah, 0xd3
mov ecx, 0xeb99db27
jmp 0x5174ec
bsf ecx, edx
bsr esi, ecx
pop ebp
cmc
mov dl, 0x11
mov ebp, edx
jmp 0x5173d8
xchg bl, bh
push word [esp]
pop ax
add esp, 3
btc ecx, eax
inc eax
jmp 0x517406
xchg bp, bx
call 0x51749a
setae al
mov dword [esp + 9], edx
add esp, 3
lea ebp, [esp + esi]
rol edx, 7
mov eax, 0x4f667361
jmp 0x517484
xchg ah, ch
not al
mov ch, 0x55
mov dword [esp + 3], esi
xchg byte [esp], al
mov bl, byte [esp + 7]
jmp 0x517448
dec ebx
sub esp, 1
call fcn.005174bf
fisttp dword [ebx - 0x25]
mov esi, 0xec6ecc4d
bound eax, qword [0x667920f4]
pop ebp
cpuid
bswap ebx
mov byte [esp + 8], bl
xchg dword [esp], edx
jmp 0x517450
lea eax, reloc.MSVCRT.dll_strncpy
xchg dword [esp + 2], ebx
lea edx, [esp - 0xed]
mov eax, esp
mov word [esp], di
cpuid
jmp 0x517471
Function at 0x5175e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], bh
mov dword [esp], ebx
xchg dword [esp], eax
pop esi
std
jmp 0x51769f
lea eax, reloc.MSVCRT.dll_strncpy
mov ah, 0x3a
mov ax, word [esp]
push sp
jmp 0x517636
rcl dl, 5
xchg ch, al
mov bx, sp
mov cx, 0xd5b6
cld
std
jmp 0x517610
mov bh, byte [esp + 1]
add esp, 2
add esp, 0
xchg byte [esp], cl
bt esi, esi
xchg si, bp
jmp 0x517682
mov si, word [esp]
or bl, dl
lea edi, [edi + ebp]
dec ch
not cx
cld
jmp 0x517626
mov edi, dword [esp]
xchg edx, esi
setp al
cmc
mov eax, 0x53a3619d
jmp 0x5176c5
bts bx, dx
mov bx, di
not ebp
bt ecx, ecx
mov byte [esp], al
mov ah, 0x32
jmp 0x51766c
mov dh, byte [esp]
setae dl
xchg ebp, eax
mov ah, 0xb6
mov ah, byte [esp]
dec bh
jmp 0x51765b
inc si
mov dx, sp
rcr di, cl
shl eax, 0x18
mov dl, byte [esp]
jmp 0x517b53
sub esp, 2
cpuid
neg bp
rdtsc
pop si
cld
jmp 0x5176af
mov word [esp + 2], sp
setp cl
call fcn.005177dd
in al, 0x7a
sbb eax, 0x11920dec
and eax, 0x9214f313
add byte [edi - 0x6e], ah
cpuid
bt cx, bx
rdtsc
xchg ch, bl
sub esp, 0x10
xchg dl, ch
jmp 0x517887
lea ebp, [edi + ebp]
lea esp, [esp]
dec ebx
mov cl, 0xb0
inc edx
neg ebx
jmp 0x517ac2

Function at 0x51784a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
call fcn.0051702f
mov dword [esp], ecx
call 0x51783f
push word [esp + 2]
lea esp, [esp + 2]
mov dword [esp], ebx
jmp 0x51781a
mov word [esp + 7], sp
lea esp, [esp + 2]
mov dword [esp + 4], eax
jmp 0x5177ec
push esi
pop word [esp]
push esi
lea esp, [esp + 2]
mov dword [esp], esp
pushal
jmp 0x517860
fcomp qword [ebx - 0x3f]
add byte [ebx - 0x77], 0x3c
and al, 0x89
adc al, 0x24
call 0x5177f4
push word [esp + 2]
jmp 0x517a82
neg esi
sub dword [eax - 0x77], ecx
and al, 0xd
mov dword [esp + 0xd], esp
lea esp, [esp + 0x17]
lea esp, [esp + 1]
mov dword [esp + 4], ebp
mov dword [esp], esi
call 0x51784a
jmp 0x5178e9
jnp 0x51783a
or ah, byte [ebp + 0x2f2d58d4]
jo 0x5178c0
add byte [eax - 0x17], dl
xor bh, dl
invalid
je 0x51785c
invalid
push es
cmc
adc dword [eax - 0xc], edi
push 0xd
cld
pop ss
outsb dx, byte [esi]
loope 0x517966
adc bl, ah
add dh, byte [eax + 0x22d7b022]
sal dl, 0x67
not dword [edx - reloc.MSVCRT.dll_strncpy]
push cs
imul ebx, dword [eax + reloc.MSVCRT.dll_strncpy], 0x700cff0c
cmc
or al, 0xff
or al, 0x70
out 0x74, al
adc ebp, esi
pop ebx
sbb byte [ebx], 0x8b
out dx, al
sbb eax, 0x127ce8b2
jne 0x5178a5
aaa
fimul word [ecx - 0x27]
mov eax, 0xea70e04b
js 0x51794b
ljmp 0x9fa:0x9f0f925d
xchg edi, eax
xchg dword [edx + ebx*4], eax
std
or al, 0xea
xor dword [eax], esi
xor ebp, dword [edx]
inc ebp
hlt
mov eax, dword [eax + 8]
push eax
jmp 0x51702a
idiv bh
jmp ebp
mov cl, byte [0x9465028c]
jbe 0x51790b
sbb dword [ecx - 0x20fe418], ecx
jp 0x51795e
invalid
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x517958
push dword [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
mov eax, dword fs:[0x30]
jmp 0x5179ef
Function at 0x40ec70
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422191
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x460880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
call dword [0x424854]
lea ebx, [edi + 0x20]
mov dword [ebp - 4], 0
push 0
mov ecx, ebx
mov dword [edi], vtable.ShakeDialog.0
mov dword [edi + 8], vtable.ShakeDialog.1.0
mov dword [ebp - 0x1c], ebx
call dword [0x4243b0]
push 8
mov byte [ebp - 4], 1
mov dword [ebx], vtable.ShakeWorker.0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call fcn.0041ac47
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
push ebx
mov ecx, esi
mov byte [ebp - 4], 2
call dword [0x424330]
mov dword [esi], vtable.QThread.0
mov ecx, ebx
push esi
mov byte [ebp - 4], 1
mov dword [ebx + 8], esi
call dword [0x42433c]
mov ecx, dword [ebx + 8]
push 7
call dword [0x424328]
push edi
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 3
mov byte [edi + 0x30], 0
call fcn.0040f390
mov esi, dword [0x424878]
mov ecx, edi
push 0xb
call esi
push 2
mov ecx, edi
call esi
push 7
mov ecx, edi
call dword [0x42487c]
push 0x40812
mov ecx, edi
call dword [0x424864]
push 1
push 0x78
mov ecx, edi
call dword [0x424860]
push 0xc
mov dword [ebp - 0x14], fcn.0040f200
mov dword [ebp - 0x24], fcn.00418dc0
mov dword [ebp - 0x20], 0
call fcn.0041ac47
push 0x45fe60
push 0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
push 0
push eax
mov dword [eax], 1
mov dword [eax + 4], 0x402eb0
mov dword [eax + 8], ecx
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
mov edi, dword [0x424338]
call edi
mov esi, dword [0x4243d8]
lea ecx, [ebp - 0x18]
add esp, 0x28
call esi
push 0x10
mov dword [ebp - 0x24], fcn.0040f280
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], fcn.00418de0
call fcn.0041ac47
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
push 0x45fe48
push 0
mov dword [eax], 1
push 0
push eax
mov dword [eax + 4], 0x40b6f0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
call edi
add esp, 0x28
lea ecx, [ebp - 0x14]
call esi
push 0x10
mov dword [ebp - 0x24], 0x40f1f0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0x418da0
call fcn.0041ac47
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
push 0x45fe48
push 0
mov dword [eax], 1
push 0
push eax
mov dword [eax + 4], 0x405080
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
call edi
add esp, 0x28
lea ecx, [ebp - 0x14]
call esi
mov ebx, dword [ebp - 0x10]
push ecx
mov eax, esp
mov dword [eax], 0x84
mov ecx, dword [ebx + 0x1c]
call dword [0x42483c]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x411a60
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422766
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push edi
mov eax, dword [0x460880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
call dword [0x424854]
lea ecx, [edi + 0x34]
mov dword [ebp - 4], 0
mov dword [edi], vtable.VersionDialog.0
mov dword [edi + 8], vtable.VersionDialog.1.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call dword [0x4243c8]
push 0
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 1
call dword [0x42428c]
push edi
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00412d60
push 0xb
mov ecx, edi
call dword [0x424878]
push 2
mov ecx, edi
call dword [0x424878]
push 7
mov ecx, edi
call dword [0x42487c]
push 0x812
mov ecx, edi
call dword [0x424864]
push 1
push 0x78
mov ecx, edi
call dword [0x424860]
lea eax, [ebp - 0x18]
push eax
call fcn.004050f0
mov ecx, eax
call fcn.00415200
mov ecx, eax
call dword [0x424890]
mov eax, dword [ebp - 0x14]
mov ecx, edi
push 0x104
add eax, 0xbe
push 0x122
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xa0
push eax
call dword [0x42486c]
mov ecx, edi
call fcn.00411cb0
mov ecx, edi
call fcn.00412200
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4144d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x460880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, 1
je 0x414511
mov byte [ebp - 0x11], 1
test eax, eax
jne 0x414515
mov byte [ebp - 0x11], 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [ebp + 8]
push 8
push 0x20
call dword [0x4242c0]
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x41453e
call dword [0x4242c8]
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
mov ebx, dword [ecx + 4]
shl ebx, 5
add ebx, eax
lea edx, [eax + ecx]
add ebx, ecx
mov eax, dword [edi + 0xc]
add eax, edi
cmp byte [ebp - 0x11], 0
je 0x4145e9
cmp edx, ebx
je 0x4145fb
nop
mov edi, eax
mov esi, edx
add eax, 0x20
add edx, 0x20
push esi
mov ecx, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
call dword [0x424350]
mov edx, dword [esi + 4]
xor edx, dword [edi + 4]
and edx, 1
xor edx, dword [edi + 4]
mov dword [edi + 4], edx
mov ecx, dword [esi + 4]
xor ecx, edx
and ecx, 2
xor ecx, edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
xor eax, ecx
and eax, 4
xor eax, ecx
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x18]
mov dword [edi + 0x14], ecx
lea ecx, [edi + 0x18]
push eax
call dword [0x424130]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp edx, ebx
jne 0x414570
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
jmp 0x4145f9
sub ebx, edx
and ebx, 0xffffffe0
push ebx
push edx
push eax
call fcn.0041ff66
add esp, 0xc
mov ecx, dword [esi]
mov eax, dword [edi + 8]
xor eax, dword [ecx + 8]
and eax, 0x7fffffff
xor eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov ecx, dword [esi]
mov eax, dword [ecx]
test eax, eax
je 0x414628
cmp eax, 0xffffffff
je 0x41464e
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x41464e
cmp dword [ebp + 8], 0
je 0x414645
cmp byte [ebp - 0x11], 0
jne 0x414645
push 8
push 0x20
push dword [esi]
call dword [0x4242bc]
add esp, 0xc
jmp 0x41464e
push dword [esi]
mov ecx, esi
call fcn.00414440
mov dword [esi], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b825
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x424068]
test eax, eax
je 0x41b864
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b864
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b864
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41b864
cmp dword [ecx + 0x74], 0xe
jbe 0x41b864
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x9ee740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9ee78c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9ee752
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9ee7f0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9ee842
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9ee848
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa06d37
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a069f7

Function at 0xa0bb31
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a0b9b0

Function at 0xa110e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa1110d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa1110d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4efe51f3
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x56880998
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x9963ce
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section._RDATA
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3e8b1e52
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100203d3
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002040a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10020412
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret
Function at 0x100324ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10032509
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100324ea
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10032507
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10025506
mov dword [eax], 1
jmp 0x100324df
jmp 0x10032527
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10032527
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret