joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418c47
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412d56
and dword [ebp - 4], 0
cmp dword [0x44fcd4], 0
mov ebx, eax
jne 0x418cf8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x418da9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x418da9
push eax
call fcn.00412ce4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44fcd4], eax
call esi
push eax
call fcn.00412ce4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44fcd8], eax
call esi
push eax
call fcn.00412ce4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fcdc], eax
call esi
push eax
call fcn.00412ce4
pop ecx
mov dword [0x44fce4], eax
test eax, eax
je 0x418cf8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412ce4
pop ecx
mov dword [0x44fce0], eax
mov eax, dword [0x44fce0]
cmp eax, ebx
je 0x418d50
cmp dword [0x44fce4], ebx
je 0x418d50
push eax
call fcn.00412d5f
push dword [0x44fce4]
mov esi, eax
call fcn.00412d5f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x418d50
test edi, edi
je 0x418d50
call esi
test eax, eax
je 0x418d47
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x418d47
test byte [ebp - 0xc], 1
jne 0x418d50
or dword [ebp + 0x10], 0x200000
jmp 0x418d89
mov eax, dword [0x44fcd8]
cmp eax, ebx
je 0x418d89
push eax
call fcn.00412d5f
pop ecx
test eax, eax
je 0x418d89
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x418d89
mov eax, dword [0x44fcdc]
cmp eax, ebx
je 0x418d89
push eax
call fcn.00412d5f
pop ecx
test eax, eax
je 0x418d89
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fcd4]
call fcn.00412d5f
pop ecx
test eax, eax
je 0x418da9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x418dab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x17da7247
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x2fbc67ae
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4123c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4123a1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4123bf
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
inc esp
or bh, bh
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41241d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x412404
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41240d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x412417
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4123f9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x412383
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41246a
dec eax
je 0x412461
sub eax, 3
je 0x412458
mov dword [ebp - 4], 0x40
jmp 0x412487
mov dword [ebp - 4], 4
jmp 0x41246d
mov dword [ebp - 4], 0x20
jmp 0x41246d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4124b9
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x412439
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00411cca
inc edx
jae 0x4124d1
mov ecx, 0x6a1475ff
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x4124c5
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
add byte [eax], al
push ebx
push esi
push edi
call fcn.00411ca8
ret
Function at 0x4125a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00411cda
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00411c8f
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00411cda
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00411c8f
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00411cca
aam 0xbc
invalid

Function at 0x412c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x12fffffc], ebx
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00411cda
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00411c8f
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00411cca
dec esi
rcr edi, cl
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00411cca
or al, 0x57
invalid
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x57c12b4d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5a243f4c
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call fcn.1000106f
Function at 0x4089f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4c90b4]

Function at 0x4089fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x408a5b
mov eax, dword [edi + 0x3c]
xor esi, esi
mov ecx, dword [eax + edi + 0x78]
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov ebp, dword [ecx + 0x18]
test ebp, ebp
je 0x408a5b
mov ebx, dword [esp + 0x1c]
mov ch, byte [ebx]
mov edx, dword [eax + esi*4]
add edx, edi
mov cl, byte [edx]
cmp cl, ch
jne 0x408a56
mov eax, ebx
sub edx, ebx
test cl, cl
je 0x408a63
cmp byte [eax], 0
je 0x408a63
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x408a40
mov eax, dword [esp + 0x18]
inc esi
cmp esi, ebp
jb 0x408a31
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x408a8e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov edi, dword [edi]
mov eax, dword [edi + 0x30]
test eax, eax
je 0x408aa2
mov edx, dword [esp + 0x18]
test edx, edx
je 0x408ab5
mov dword [edx], eax
test ecx, ecx
je 0x408afe
mov ebp, dword [edi + 0x30]
xor ebx, ebx
xor esi, esi
movzx eax, word [ebp]
mov edx, eax
test ax, ax
je 0x408afa
nop dword [eax]
movzx ecx, ax
lea esi, [esi + 1]
movzx eax, ax
lea edx, [ecx - 0x41]
add ecx, 0x20
cmp dx, 0x19
movzx ecx, cx
cmova ecx, eax
movzx eax, cx
add ebx, eax
movzx eax, word [ebp + esi*2]
test ax, ax
jne 0x408ace
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jne 0x408aa2
invalid
inc edi
Function at 0x408b0e
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ecx
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
add eax, 0xc
push edi
mov eax, dword [eax]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x408b1f
mov ebp, dword [eax + 0x18]
mov eax, dword [0x4c93e4]
push 0
push eax
call fcn.00408a8e
mov edi, dword [0x4c940c]
add esp, 8
mov ebx, eax
mov edx, dword [edi]
test edx, edx
je 0x408b90
movzx eax, word [esi]
xor ecx, ecx
test ax, ax
je 0x408b5b
inc ecx
cmp word [esi + ecx*2], 0
jne 0x408b53
cmp cl, dl
je 0x408b68
cmp cl, byte [edi + 1]
jne 0x408c60
xor edx, edx
xor ecx, ecx
test ax, ax
je 0x408b82
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2]
test ax, ax
jne 0x408b71
cmp edx, dword [edi + 4]
je 0x408b90
cmp edx, dword [edi + 8]
jne 0x408c60
mov eax, dword [0x4c93dc]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edx, edx
mov esi, eax
cmp dword [0x4c9410], edx
jbe 0x408bcd
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x4c93d8]
add edx, eax
cmp edx, dword [0x4c9410]
jb 0x408bb2
push esi
push ebx
call fcn.004089fe
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x408c60
mov esi, dword [0x4c93e8]
lea eax, [esp + 0x10]
mov ecx, dword [0x4c9410]
push eax
push ecx
mov ecx, dword [0x4c93f4]
push ecx
push esi
call ebx
mov edx, dword [0x4c93e0]
mov ecx, 8
mov edi, dword [edx + ebp + 4]
add edx, ebp
cmp dword [0x4c93f4], ecx
jbe 0x408c2d
mov eax, dword [edx + ecx]
add eax, edi
mov dword [esi + ecx], eax
mov eax, dword [0x4c93d8]
add ecx, eax
cmp ecx, dword [0x4c93f4]
jb 0x408c16
mov eax, dword [0x4c9408]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
Function at 0x430b70
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4368a0
call fcn.004315d8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x438d38
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x430998
cmp eax, esi
jne 0x43098b
xor esi, esi
inc esi
mov edi, esi
jmp 0x43099b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43096f
xor esi, esi
inc esi
cmp dword [0x438d3c], esi
jne 0x4309ad
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4309e7
cmp dword [0x438d3c], ebx
jne 0x4309e1
mov dword [0x438d3c], esi
push 0x40102c
push 0x401020
call fcn.004cc000
pop ecx
pop ecx
test eax, eax
je 0x4309e7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x430abc
mov dword [0x438224], esi
cmp dword [0x438d3c], esi
jne 0x430a0a
push 0x40101c
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x438d3c], 2
test edi, edi
jne 0x430a17
xor eax, eax
mov ecx, 0x438d38
xchg dword [ecx], eax
cmp dword [0x438d48], 0
je 0x430a43
push 0x438d48
call fcn.00431430
pop ecx
test eax, eax
je 0x430a43
push ebx
push 2
push ebx
mov esi, dword [0x438d48]
mov ecx, esi
call dword [0x4392d8]
call esi
push dword [0x438230]
push dword [0x43822c]
push dword [0x438228]
call fcn.004173e3
add esp, 0xc
mov dword [0x438220], eax
cmp dword [0x438238], 0
jne 0x430aa1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x438224], 0
jne 0x430ab5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x438220]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00431525
jmp 0x430953

Function at 0x431314
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x436998
call fcn.004315d8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x431374
cmp eax, 0xffffffff
je 0x431374
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x43136d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x43136d
cmp edx, 0x10000000
jae 0x43136d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x43136a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4313e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x43141e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x431416
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x431420
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x431406
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x401461
test cl, 7
je 0x401461
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x423460]
dec esi
inc ecx
jmp 0x401442
cmp esi, 8
jb 0x401504
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x423860]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x423460]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x423c60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x424460]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x424860]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x424c60]
movzx edx, dl
xor edi, dword [edx*4 + 0x424060]
movzx eax, al
xor edi, dword [eax*4 + 0x425060]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x401473
pop ebx
jmp 0x401504
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x423460]
dec esi
inc ecx
test esi, esi
ja 0x4014f0
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x403511
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
jne 0x40352b
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40359c
mov ecx, esi
call fcn.0040349f
test al, al
je 0x403566
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x403566
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00403511
jmp 0x40359f
cmp dword [esi + 0xc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x40357d
call ebx
cmp eax, 0x6d
jne 0x40357d
xor eax, eax
jmp 0x40359f
cmp dword [esi + 0xc], 0
jne 0x403597
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x403597
call ebx
cmp eax, 0x21
jne 0x403597
push edi
jmp 0x40355a
or eax, 0xffffffff
jmp 0x40359f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x403892
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040dac0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4038d6
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.00406388
test al, al
je 0x4038d6
lea eax, [ebp - 0x1000]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x4038de
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040dac0
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x40392d
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.00406388
test al, al
je 0x40392d
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x403b1a
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040dac0
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004061b2
movzx eax, word [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ax, 0x2e
je 0x403b50
cmp ax, 0x20
je 0x403b50
push 0
push edi
call esi
test eax, eax
jne 0x403b7f
push edi
call fcn.00403af6
test al, al
jne 0x403b92
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.00406388
test al, al
je 0x403b92
push 0
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x403b92
cmp byte [ebp + 0xc], 0
je 0x403b8e
push dword [ebp + 0x10]
push edi
call fcn.004038de
xor eax, eax
jmp 0x403baa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x403ba7
cmp eax, 3
je 0x403ba7
xor eax, eax
inc eax
jmp 0x403baa
push 2
pop eax
pop edi
pop esi
leave
ret 0xc

Function at 0x403fdf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x44e13c]
call fcn.00401434
cmp byte [0x4377e1], 0
mov dword [0x44e13c], eax
jne 0x404013
cmp dword [ebp + 0xc], 0
jbe 0x404013
mov ecx, dword [0x44e238]
pop ebp
jmp fcn.00403306
pop ebp
ret 8
Function at 0x40481d
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.0040dac0
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x250]
mov edi, 0x800
push eax
jne 0x4048ac
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4048d9
push edi
lea eax, [ebp - 0x1250]
push eax
push dword [ebp + 0xc]
call fcn.00406388
test al, al
je 0x404885
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1250]
push eax
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4048d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40489f
cmp eax, 3
je 0x40489f
cmp eax, 0x12
je 0x40489f
xor eax, eax
inc eax
jmp 0x4048a1
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x4049a4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4048cf
or dword [ebp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [esi + 0x1044], al
cmp dword [ebp + 8], 0xffffffff
je 0x4049a4
push edi
push dword [ebp + 0xc]
push esi
call fcn.0040b50f
push edi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.004066f1
push 1
push 0
push 0
push dword [ebp - 0x234]
call fcn.0040e140
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x1028], eax
mov eax, dword [ebp - 0x248]
mov dword [esi + 0x102c], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x1038], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x103c], eax
lea eax, [ebp - 0x23c]
adc edx, edi
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x1004], edx
call fcn.0040b84b
lea eax, [ebp - 0x24c]
push eax
lea ecx, [esi + 0x1018]
call fcn.0040b84b
lea eax, [ebp - 0x244]
push eax
lea ecx, [esi + 0x1020]
call fcn.0040b84b
and dword [esi + 0x1040], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc