joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485f80
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x485faf
push str.Couldnt_set_desired_mode
push edx
call fcn.004686c0
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x485fc6
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.004687a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x485fdd
push edi
call fcn.00485ce0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x485ff1
push edi
call fcn.00484d30
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x486005
push edi
call fcn.00485cc0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x486015
push edi
call fcn.00485e60
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x49a1a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x64c024]
mov edi, eax
add esp, 4
test edi, edi
jne 0x49a1cd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x49a217
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x49a21d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x49a27b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x49a240
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x49a2a7
mov eax, dword [esi + 4]
push 1
push 0x5de866
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5de867
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x49a280
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5064d0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x5064e8
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x5064ed
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x5065b6
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
cmp esi, 3
jl 0x506550
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
add edx, 2
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov cl, byte [eax + ebx]
jmp 0x506593
shl eax, 0x10
cmp esi, 2
jne 0x506560
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
add edx, 2
cmp esi, 1
jne 0x506586
mov al, 0x3d
jmp 0x50658f
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov byte [edx], al
mov cl, 0x3d
lea eax, [edx + 1]
sub esi, 3
lea edx, [eax + 1]
mov byte [eax], cl
add ebp, 4
add edi, 3
test esi, esi
jg 0x506503
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x514650
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.005d0060
mov eax, dword [0x64c00c]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xb0]
push ebx
mov ebx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, dword [esp + 0xac]
push edi
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], 0
test edi, edi
je 0x5146bd
cmp edi, eax
je 0x5146b1
test ebp, ebp
je 0x514730
test ebx, ebx
js 0x514730
mov dword [esp + 0x10], 1
mov dword [esi], edi
jmp 0x5146c3
test eax, eax
je 0x514730
mov edi, eax
push edi
call fcn.004bd970
add esp, 4
test al, 2
jne 0x514730
test ebp, ebp
je 0x51483b
push edi
mov dword [esp + 0x14], 1
call fcn.004bd8f0
add esp, 4
cmp eax, 0x90
jg 0x514730
cmp eax, ebx
jge 0x51474b
push dword [esp + 0x14]
push edi
push dword [esi + 4]
call fcn.004a2a80
add esp, 0xc
test eax, eax
je 0x514730
push ebx
push ebp
push dword [esi + 4]
call fcn.004a2e00
add esp, 0xc
test eax, eax
je 0x514730
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.004a2950
add esp, 0xc
test eax, eax
jne 0x514767
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045760b
add esp, 0x9c
ret
cmp ebx, 0x90
ja 0x514730
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.005af810
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x90
je 0x51478a
mov eax, 0x90
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.005af670
add esp, 0xc
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x514790
mov ebp, dword [esp + 0x14]
push ebp
push edi
push dword [esi + 8]
call fcn.004a2a80
add esp, 0xc
test eax, eax
je 0x514848
push edi
call fcn.004bd8f0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.004a2e00
add esp, 0x10
test eax, eax
je 0x514848
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x5147e0
push ebp
push edi
push dword [esi + 0xc]
call fcn.004a2a80
add esp, 0xc
test eax, eax
je 0x514848
push edi
call fcn.004bd8f0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.004a2e00
add esp, 0x10
test eax, eax
je 0x514848
push dword [esi + 8]
push dword [esi + 4]
call fcn.004a2e90
xor ebp, ebp
add esp, 8
test eax, eax
mov ecx, 1
cmovne ebp, ecx
jmp 0x51484a
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x51481f
jmp 0x51478e
xor ebp, ebp
test ebx, ebx
je 0x514860
lea eax, [esp + 0x18]
push 0x90
push eax
call fcn.00401320
add esp, 8
mov eax, ebp
jmp 0x514732

Function at 0x5c9155
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005c8fc6
Function at 0x65bbf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x65bd52
cmp edi, esi
je 0x65bd52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x65bd42
add edi, 4
jmp 0x65bca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x65bcb8
mov dword [ebp - 4], 2
jmp 0x65bcd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x65bccf
mov dword [ebp - 4], 1
jmp 0x65bcd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x65bd52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x65bd10
mov byte [ecx + 2], 0x3d
jmp 0x65bd1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x65bd2c
mov byte [ecx], 0x3d
jmp 0x65bd32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x65bca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd3e3d5
Capabilities:
Parse pe header

Disassembly:
rep movsd dword es:[edi], dword [esi]
and edi, 0x1b2519d6
sub eax, eax
movsx esi, bx
bswap si
pop edi
movzx esi, si
pop esi
mov esp, ebp
movsx ebp, sp
jmp 0x1a658a9
push ebp
clc
sar dx, cl
mov ebp, esp
bt edx, edi
neg dx
btr dx, bx
sub esp, 0x13c
push esi
xchg esi, esi
push edi
mov esi, eax
jmp 0x1b2a42b
jne 0x1be2551
mov eax, dword [ebp - 8]
test eax, eax
jmp 0x119e83f
je 0x1be2551
lea edx, [ebp - 0x13c]
jmp 0x121b707
mov esp, ebp
xchg ebp, ebp
movzx ebp, bp
pop ebp
ret 4
je 0x1224b53
mov ecx, 0x14e
test cx, cx
cmp ax, cx
jmp 0x1224b4d
push edx
mov dl, 0x41
not dx
movzx dx, ch
cdq
push edx
not dl
movzx edx, sp
mov edx, esi
push eax
rdtsc
bswap dx
push edi
lahf
mov edx, 0xf8
mov al, 0xf7
mov eax, esi
jmp 0x19fd2fc
jne 0x68b487
mov edi, dword [ebp + 8]
setg cl
movsx esi, si
mov ecx, 0x3e
lea esi, [ebp - 0x13c]
jmp 0x68b47f
call fcn.00451803
test al, al
jmp 0x1a0d667
je 0x1be2551
cmp dword [ebp - 0x13c], 0x4550
jne 0x1be2551
test dword [ebp - 0x126], 0x2000
jmp 0x1afcd07
je 0x1224b53
mov edx, 0x14d
cmp ax, dx
jmp 0x11e295d
pop ebp
jmp 0x1abf8cc
ret 4
jne 0x68b487
mov ax, word [ebp - 0x138]
mov cl, 0x62
mov ecx, 0x14c
cmp eax, ebp
cmp ax, cx
jmp 0x1a38971
je 0x1be2551
mov eax, 0x10b
cmp word [ebp - 0x124], ax
jmp 0x1af2841
lea eax, [ebp - 0x44]
push eax
push 0
movzx dx, dh
mov edi, ecx
cmovns dx, bp
mov ah, bh
push 0
cdq
push edi
mov edx, 0x40
mov eax, esi
jmp 0x1b60e61
je 0x1be2551
mov ecx, 0x5a4d
cmp edi, ebx
cmc
cmp word [ebp - 0x44], cx
jmp 0xd4ad41
call fcn.00451803
test al, al
jmp 0x1b3fc21
pop edi
lahf
mov eax, 0xc000007b
xchg si, si
movsx esi, bp
pop esi
jmp 0x11cbaaf
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x40d75b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40d76a
pop dword [ebp - 0x50]
mov eax, 0x5793fa9b
sub eax, 0x57532331
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3515f
push 0
mov eax, 0x2b18f288
sub eax, 0x2ad801f8
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x3ae3
xor edi, edi
add edi, eax
mov esi, 0x47dc5e57
sub esi, 0x479ab457
add esi, dword [ebp - 0x50]
mov ebx, 0xa77068a1
sub dword [ebp - 0x2c], 0xd26bca00
mov edx, dword [esi]
xor dword [ebp - 0x38], esi
xor edx, ebx
mov dword [ebp - 0x4c], 0xf33b3eb6
mov dword [edi], edx
add dword [ebp - 0x34], edi
add edi, 0xbdba359d
sub edi, 0xbdba3599
add esi, 0xf2b027ad
add esi, 0xd4fd857
loop 0x40d7bf
add eax, 0xf2f3b017
sub eax, 0xf2f2d1b8
mov ebx, eax
add eax, 0x4845b998
sub eax, 0x4845b993
mov ecx, 0xdc2982f2
sub ecx, 0xdbe982f2
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d29a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40d2a9
pop dword [ebp - 4]
mov eax, 0xbfe5b6eb
add eax, 0x405b1bbe
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x37aa8
push 0
mov eax, 0xd2f8e7ab
sub eax, 0xd2b806d3
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0xe6229147
add ecx, 0x19ddafff
xor edi, edi
add edi, eax
mov esi, 0x77cddc03
sub esi, 0x778ca03f
add esi, dword [ebp - 4]
mov ebx, 0xc226807f
add ebx, 0x35c79fac
mov edx, dword [esi]
xor edx, ebx
mov dword [edi], edx
add edi, 4
add esi, 0x10a12587
sub esi, 0x10a12583
loop 0x40d30a
add eax, 0xf7eb
mov ebx, eax
add eax, 0x3257034a
add eax, 0xcda8fcbb
mov ecx, 0xec75e43c
sub ecx, 0xec35e43c
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x4048fd
Capabilities:
Encode data using xor

Disassembly:
call fcn.00404820
mov ecx, 0x1f5
call 0x4048fd
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x404900
mov eax, 0x50402e1
out dx, al
clc
div esi
cmc

Function at 0x409f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ecx, dword [edi + 0xc5d8b53]
push esi
xchg esp, eax
jne 0x409f33
push edi
mov ecx, 0x18
xor esi, dword [esi - 0x590c0157]
mov eax, dword [ebx + 0x22]
mov eax, dword [0x20b958]
test eax, 0x8ba6f3fe
inc ebx
and ah, byte [ecx + 0x20b958]
add byte [eax], al
mov dword [ebp + 0xc], edx
jg 0x409fa5
cmp byte [ecx + 0x21e8a556], cl
xor dword [eax], eax
add byte [ecx + 0x56893846], cl
cmp al, 0x8b
fimul dword [eax*8 - 0x69b97430]
xor edi, edi
or ebp, dword [esi + 0x52]
invalid
salc
dec dword [ecx + 0x4e893856]
jo 0x409f46
push esi
cmp byte [ecx + 0x4bb0704e], cl
dec ebx
mov ebx, 0x8b984eac
ror dword [ebx + 0x20b9d7], 0xe8
mov dword ds:[esi - 0x1b], edi
jle 0x409f8c
call 0x847c13
mov dword [esi + 0x48], eax
mov dword [esi + 0x70], edx
mov edx, dword [ebx + 4]
mov ecx, dword [esi + 0x4c]
or eax, edx
or esp, dword [eax - 0x76b7b920]
dec esi
dec esp
push edi
mov eax, ecx
ror dword [esi - 0x41], 1
push 0xa
push eax
push ecx
mov byte [edi - 0x76ffffeb], bh
stosd dword es:[edi], eax
dec eax
dec ebx
add al, al
jns 0x409f90
mov dword [esi + 0x4c], edx
mov esi, edx
dec eax
sub dword [ecx + ebp*2 - 0x5f], 0x2b9ffd6
add byte [eax], al
add byte [ecx + 0x537b4c56], cl
sbb dl, ch
push esi
invalid
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x601529d7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2572141d
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x511530
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401ded
mov eax, dword [0x6145c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x61ad70]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x511708
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x511657
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x511657
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x511635
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x5115b9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5116c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x511728
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x511703
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x511728
jmp 0x511592
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403143
mov esp, ebp
pop ebp
ret
Function at 0x5117c0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401ded
mov eax, dword [0x6145c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x61ad70]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x5119ab
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x5118f6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x5118f6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x5118d2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x511849
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x511964
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5119cb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x5119a6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x5119cb
jmp 0x511822
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403143
mov esp, ebp
pop ebp
ret