joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e7c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43e7f3
push esi
call fcn.004418d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43e7ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43e879
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43e862
mov eax, dword [esi + 8]
test eax, eax
je 0x43e817
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43e85e
cmp eax, 2
je 0x43e862
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43e80a
cmp eax, 3
je 0x43e83d
cmp eax, 1
jne 0x43e80a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43e80a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43e80a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043e8a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43e888
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043e8a0
add esp, 4
pop esi
ret

Function at 0x44a3e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44a483
test eax, eax
jbe 0x44a483
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44a483
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44a42e
xor esi, esi
jmp 0x44a434
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44a45f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0044c3f0
add esi, eax
push esi
mov ebx, esi
call fcn.0044c3f0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44a440
pop ebp
test edi, edi
pop edi
jne 0x44a483
test ebx, ebx
je 0x44a483
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00454c30
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44a5c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44a6dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44a6dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004655bc
mov esi, eax
test esi, esi
je 0x44a6dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44a6dd
mov ecx, esi
call fcn.0044a530
cmp edi, eax
jge 0x44a6dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44a663
mov dword [esp + 0x34], 1
jmp 0x44a6be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44a6dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00449b00
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x44f120
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7b30
push 0x455f04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00454230
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f2d0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x44f311
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x44f37e
cmp dword [esp + 0x1c], 2
jne 0x44f37e
cmp dword [esp + 0x10], 5
jne 0x44f37e
cmp dword [esp + 0x14], 1
jne 0x44f37e
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44f368
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44f359
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x44f361
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x44f37e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret

Function at 0x465f60
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x465f98
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00464017
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00463fef
jmp 0x465fa4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x467651
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x467693
call fcn.0046d10a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x467693
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46768a
xor eax, eax
jmp 0x46769b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004676a1
pop edi
pop esi
pop ebx
ret 4

Function at 0x46d63a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46d668
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46d686
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046d5a0
jmp 0x46d686
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46d686
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046d5a0
test edi, edi
mov eax, edi
jne 0x46d670
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x408930
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.00408952
or ebx, esi
sub ebx, 0xb4d3e08c
xor dword [eax], edx
add esi, 0xd2adb66b
inc eax
cmp eax, edi
jne fcn.00408930
add esi, ebx
ret
Function at 0x16fff3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x180cc5
sub esp, 0x24
mov eax, dword [0x1e3038]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
xor ebx, ebx
mov dword [esp + 0xc], eax
push edi
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x180d33
mov eax, dword [edi]
lea ecx, [esp + 0x18]
add eax, esi
push eax
call fcn.00170656
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.001722b2
pop ecx
pop ecx
test al, al
jne 0x180d4a
lea ecx, [esp + 0x18]
add edi, 4
call fcn.00172249
inc ebx
cmp ebx, dword [esp + 0x14]
jb 0x180cfe
xor esi, esi
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00171844
add esp, 0x24
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + esi]
lea ecx, [esp + 0x18]
call fcn.00172249
jmp 0x180d35

Function at 0x172410
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18124e
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x181342
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, 0x1e5738
mov bl, byte [esi + edi]
push 0x1ca2b8
push ebp
call fcn.00171565
xor edx, edx
mov eax, esi
div dword [esp + 0x24]
pop ecx
pop ecx
push 0x12d159
push 0x1ca2c4
mov bh, byte [edx + section..PUFFI]
push 0x1e5820
xor bh, bl
call fcn.00171565
pop ecx
pop ecx
mov ecx, eax
call fcn.00173ee6
mov bl, byte [esi + edi]
push 0x12d159
push 0x1ca2d4
push ebp
call fcn.00171565
pop ecx
pop ecx
mov ecx, eax
call fcn.00173ee6
add byte [esi + edi], bh
push 0x12d159
push 0x1ca2e8
push ebp
call fcn.00171565
pop ecx
pop ecx
mov ecx, eax
call fcn.00173ee6
dec byte [esi + edi]
push 0x1ca308
push ebp
call fcn.00171565
add byte [esi + edi], 0xfe
push 0x1ca314
push ebp
call fcn.00171565
sub byte [esi + edi], bl
push 0x1ca328
push ebp
call fcn.00171565
inc byte [esi + edi]
push 0x1ca338
push ebp
call fcn.00171565
inc byte [esi + edi]
push 0x1ca344
push ebp
call fcn.00171565
inc byte [esi + edi]
push 0x1ca350
push ebp
call fcn.00171565
add esp, 0x30
inc esi
cmp esi, dword [esp + 0x18]
jb 0x181267
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x17426f
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x180d90
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x221f98], eax
pop edi
pop esi
ret
Function at 0x71e6fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x71e76c
xor dl, ch
pop bp
xchg byte [esp], bl
mov cx, 0xfac7
mov byte [esp], bh
mov ax, 0x44ef
jmp 0x71e742
Function at 0x71eb73
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xa], ecx
popal
pop cx
xchg bh, cl
cld
pop word [esp + 2]
jmp 0x71ebc2
mov ebp, dword [esp + 0x25]
xchg si, bx
xchg word [esp + 0x12], ax
cpuid
cmc
jmp 0x71eb4d
push dword [esp + 0x12]
push dword [esp + 0x10]
mov word [esp + 8], sp
clc
lea ecx, [esi + edi]
cmc
jmp 0x71ec05
mov esi, dword [esp + 0xb]
add esp, 5
mov word [esp], sp
sub esp, 0x18
jmp 0x71eb91
cpuid
xchg byte [esp], al
push edx
xchg dword [esp + 7], esi
lea edx, [eax + ebx]
btc esi, edi
jmp 0x71ebab
xchg dx, di
btc edx, edi
mov cx, word [esp + 0x1f]
jmp 0x71edbb
mov ebp, eax
add esp, 0x1d
xchg bx, bp
sub esp, 0x1a
xchg word [esp + 0x25], si
bsf bp, ax
jmp 0x71ebd4
push dword [esp + 8]
sub bl, ah
xchg dword [esp + 2], ebx
mov dword [esp + 0xf], esi
xchg dword [esp + 0x18], edi
lea edx, [esi - 0xfd]
jmp 0x71ebea
lea eax, [edx + edi]
xchg ebp, ecx
ror ah, 1
not edx
xchg bx, cx
xchg bp, si
jmp 0x71ec9b
btr esi, edx
mov cl, 0xba
bswap ecx
xchg dh, al
bswap ecx
rcl dx, cl
jmp 0x71ec42
mov edi, ecx
inc bl
mov dl, 0x14
mov di, dx
neg ch
bsf dx, ax
jmp 0x71ed08
bsf bp, ax
mov ax, dx
mov ecx, eax
clc
inc bl
bsr si, bp
jmp 0x71ec6c
mov cl, byte [esp]
lea edi, [esi + 0xbd]
mov bx, word [esp]
mov bp, bx
mov bl, byte [esp]
xchg cx, si
jmp 0x71ec82
lea esp, [esp + 0x41]
btr esi, esp
xchg dh, al
mov edx, dword [esp]
bsf dx, si
btr esi, edx
jmp 0x71ec5c
mov dword [esp + 3], ebp
rdtsc
lea edx, reloc.WINMM.dll_mmioCreateChunk
mov edx, ecx
mov dword [esp + 0xd], esi
mov al, ah
jmp 0x71ed96
push edx
mov bl, 0x90
sub esp, 0x12
lea ebp, [ebp - 0xef]
mov bp, 0xfe63
push dword [esp + 2]
jmp 0x71ecd2
clc
bsf cx, si
mov ax, 0x1a27
rcr eax, 0x1b
xchg ebx, edi
lea eax, [esi - 0x55]
jmp 0x71ecee
xchg dword [esp + 0xa], eax
push dword [esp + 0xc]
lea esp, [esp + 0x19]
mov si, 0xd191
sub esp, 0xa
jmp 0x71ed7e
pop dword [esp + 0xa]
mov word [esp + 0xc], dx
sub esp, 0xe
mov bl, 0xb8
mov ch, byte [esp + 0x21]
mov byte [esp + 0x28], dh
jmp 0x71ed1b
cpuid
cld
bswap esi
xchg word [esp + 0x1d], dx
cld
mov al, ah
jmp 0x71ed34
mov byte [esp + 0x13], ch
xchg byte [esp + 4], cl
and esi, ecx
pop cx
mov cl, ch
cmc
jmp 0x71ee00
rdtsc
mov byte [esp + 0xf], bh
pop bp
lea eax, reloc.WINMM.dll_mmioCreateChunk
mov ebp, ecx
jmp 0x71ed60
pop dword [esp + 0x10]
xchg word [esp + 0x11], ax
rdtsc
mov ebp, dword [esp + 0x15]
sub esp, 0xa
rdtsc
jmp 0x71ed51
lea ebp, [eax*4]
shr dh, 7
sub edx, eax
rdtsc
xchg dword [esp + 3], esi
sub esp, 0x18
jmp 0x71ecbd
bswap ebp
shl bx, cl
xchg dh, al
pop word [esp + 0xa]
cpuid
push dword [esp + 0x11]
jmp 0x71ede5

Function at 0x71f1d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
rdtsc
mov ecx, eax
push dword [esp + 2]
rdtsc
jmp 0x71f187

Function at 0x71f2ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, eax
cmc
rdtsc
neg ebp
xchg ch, dl
jmp 0x71f2d1
Function at 0x71f42d
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
mov dword [esp + 0x12], esi
bswap eax
push dword [esp + 0x1e]
xchg ah, bl
mov ch, byte [esp]
jmp 0x71f401
pop cx
sub esp, 0x18
mov si, dx
mov ecx, dword [esp + 0x1b]
btc ecx, ebx
mov ch, byte [esp + 6]
jmp 0x71f3c7
inc esi
ror ebx, 0x11
mov byte [esp + 0xf], bh
xchg byte [esp + 0x2e], dl
pop dword [esp + 0x12]
pop dword [esp + 5]
jmp 0x71f447
xchg byte [esp + 0xe], dl
btr ecx, esp
xchg bp, si
mov dword [esp], eax
jmp 0x71f42f
jmp 0x71f3ec
push word [esp + 0x29]
neg bx
cpuid
clc
rdtsc
mov word [esp + 0x12], di
jmp 0x71f4d6
mov dword [esp + 0x1e], esi
inc di
xchg dword [esp + 0x17], edi
push dword [esp + 0x24]
rdtsc
pop word [esp + 0x2a]
jmp 0x71f417
lea esp, [esp + 0x23]
setbe dh
mov si, 0xcd3f
mov di, word [esp]
lea esp, [esp + 5]
add edi, ebp
jmp 0x71f48f
sete dh
neg esi
mov di, word [esp + 3]
mov ah, byte [esp + 0x18]
pop dword [esp + 9]
xchg word [esp + 1], bx
jmp 0x71f4b4

Function at 0x71fb85
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc eax, edi
mov cl, ch
mov eax, 0x9410f7cc
mov bl, 0x50
mov ax, 0x7ae5
jmp 0x71f639
lea eax, [edx*4]
mov word [esp + 2], sp
xchg word [esp + 3], dx
xchg byte [esp + 1], al
jmp 0x71f5f0
mov word [esp], sp
xchg dword [esp], esi
push word [esp + 1]
xchg dh, al
mov ax, 0x98e3
rdtsc
jmp 0x71f607
mov esi, 0x62bc12e
push dword [esp + 4]
rdtsc
xchg di, dx
mov byte [esp + 7], dh
bsr cx, cx
jmp 0x71f6eb
lea esp, [esp + 1]
inc bp
bsr di, cx
neg dh
mov byte [esp], ah
push word [esp + 1]
jmp 0x71f623
mov word [esp + 2], dx
btc ebx, ebx
pop bp
xchg bh, cl
mov dl, dh
rdtsc
jmp 0x71f661
xchg dx, cx
sub esp, 0x12
pop word [esp + 0x23]
jmp 0x71f9c1
lea esi, [eax*4]
lea edi, [ecx*4]
xchg ebx, edi
mov word [esp + 8], bx
lea edi, [edx + edi]
ror ebx, 0x11
jmp 0x71f68f
mov esi, dword [esp + 0xf]
mov word [esp + 6], dx
cmc
mov si, word [esp + 8]
pop word [esp + 0x13]
pop word [esp + 7]
jmp 0x71f6a6
pop word [esp + 3]
cld
pop bp
push dword [esp]
sub esp, 0x1c
setbe dh
jmp 0x71f6ca
btr edi, edx
mov word [esp + 0x12], dx
bsf dx, ax
xchg byte [esp + 0x27], cl
mov dword [esp + 5], ebp
jmp 0x71f7d2
mov edi, dword [esp + 0x1d]
rdtsc
setle ch
not bx
mov ecx, 0xda500bea
not dh
jmp 0x71f6fe
lea esp, [esp + 2]
lea esp, [esp + 0x2c]
popal
pushal
pop word [esp + 0xf]
call fcn.0071f752
mov si, 0xa193
mov al, 0xee
xchg bp, di
lea eax, [ecx + edx]
xchg word [esp + 0x1b], si
sub bl, ah
jmp 0x71f76d
lea ebx, [ecx*4]
setp ah
xchg ch, dl
mov edx, dword [esp + 0x23]
lea ecx, [esi - 0x4d]
pop esi
jmp 0x71f71b
btr ebp, esp
bswap edx
push dword [esp + 4]
inc edi
xchg word [esp + 3], di
add esp, 0x11
jmp 0x71f67d
mov dword [esp + 0xf], esi
pop cx
pop dword [esp + 4]
bswap ebx
jmp 0x71fb3b
Function at 0x401510
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
mov ebx, eax
mov esi, edx
xor eax, eax
and esi, 3
je 0x40153b
mov ecx, 4
sub ecx, esi
cmp ecx, ebx
jbe 0x40152b
mov ecx, ebx
sub ebx, ecx
xor eax, eax
nop
movzx esi, byte [edx]
xor eax, esi
mov byte [edx], al
inc edx
dec ecx
jne 0x401530
cmp ebx, 4
jb 0x401598
mov ecx, dword [0x40b7b8]
push ebp
add ecx, 8
mov ebp, ebx
push edi
mov dword [esp + 0x10], ecx
shr ebp, 2
xor eax, dword [edx]
mov esi, dword [esp + 0x10]
xor ecx, ecx
lea edi, [ecx + 8]
nop
test al, 1
je 0x401567
xor ecx, dword [esi - 8]
shr eax, 1
test al, 1
je 0x401570
xor ecx, dword [esi - 4]
shr eax, 1
test al, 1
je 0x401578
xor ecx, dword [esi]
shr eax, 1
test al, 1
je 0x401581
xor ecx, dword [esi + 4]
shr eax, 1
add esi, 0x10
dec edi
jne 0x401560
mov dword [edx], ecx
add edx, 4
sub ebx, 4
dec ebp
mov eax, ecx
jne 0x401554
pop edi
pop ebp
movzx eax, al
test ebx, ebx
je 0x4015ab
nop
movzx ecx, byte [edx]
xor eax, ecx
mov byte [edx], al
inc edx
dec ebx
jne 0x4015a0
pop esi
pop ebx
pop ecx
ret
Function at 0x4015b0
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
sub esp, 0xcc
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
lea ecx, [eax + ebx + 0x80]
mov eax, 0xcccccccd
mul dword [ecx + 4]
push ebp
mov ebp, dword [ecx]
shr edx, 4
add ebp, ebx
mov dword [esp + 8], ebx
test edx, edx
je 0x40178b
lea ecx, [ecx]
cmp dword [ebp], 0
je 0x401613
add ebp, 0x14
dec edx
jne 0x4015f0
pop ebp
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00401a77
add esp, 0xcc
ret
add ebp, 0x14
dec edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], edx
je 0x40178b
push esi
push edi
jmp 0x401630
cmp dword [ebp], 0
je 0x401789
mov esi, dword [ebp + 0xc]
add esi, ebx
lea edi, [esp + 0x28]
xor ecx, ecx
movzx edx, byte [esi]
xor ecx, edx
inc esi
call fcn.00401a60
movzx eax, al
xor ecx, eax
mov byte [edi], cl
inc edi
test ecx, ecx
jne 0x401645
push 0x10
lea ecx, [esp + 0x3c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40169e
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x401778
add ebx, dword [ebp]
mov ecx, 1
mov eax, ebx
cmp dword [eax], 0
je 0x4016b9
lea ecx, [ecx]
add eax, 4
inc ecx
cmp dword [eax], 0
jne 0x4016b0
mov esi, dword [ebp + 0x10]
add esi, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea edi, [ecx*4]
push 0x40
push edi
push esi
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebx]
test eax, eax
je 0x40174c
mov ebp, esi
sub ebp, ebx
test eax, eax
jns 0x4016fb
mov ecx, dword [esp + 0x14]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x40173b
mov edx, dword [esp + 0x10]
lea edi, [esp + 0x58]
lea esi, [eax + edx + 2]
xor ecx, ecx
lea esp, [esp]
movzx eax, byte [esi]
xor ecx, eax
inc esi
call fcn.00401a60
movzx edx, al
xor ecx, edx
mov byte [edi], cl
inc edi
test ecx, ecx
jne 0x401710
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x58]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0x24]
mov dword [ebx + ebp], eax
mov eax, dword [ebx + 4]
add ebx, 4
test eax, eax
jne 0x4016e6
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [ebp + 0x10]
add esi, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ebx, dword [esp + 0x10]
add ebp, 0x14
dec dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
jne 0x401630
pop edi
pop esi
mov ecx, dword [esp + 0xd0]
pop ebp
pop ebx
xor ecx, esp
call fcn.00401a77
add esp, 0xcc
ret

Function at 0x401a77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x401a81
repz ret
jmp fcn.00401c26
Function at 0x403b1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402a77
and dword [ebp - 0x14], 0
cmp dword [0x40b744], 0
mov dword [ebp - 0x18], eax
jne 0x403bce
push 0x407d08
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403c76
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x407cfc
push ebx
call edi
test eax, eax
je 0x403c76
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x407cec
push ebx
mov dword [0x40b744], eax
call edi
push eax
call esi
push 0x407cd8
push ebx
mov dword [0x40b748], eax
call edi
push eax
call esi
push 0x407cbc
push ebx
mov dword [0x40b74c], eax
call edi
push eax
call esi
mov dword [0x40b754], eax
test eax, eax
je 0x403bce
push 0x407ca4
push ebx
call edi
push eax
call esi
mov dword [0x40b750], eax
mov eax, dword [0x40b750]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403c27
cmp dword [0x40b754], ecx
je 0x403c27
push eax
call esi
push dword [0x40b754]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403c27
test ebx, ebx
je 0x403c27
call edi
test eax, eax
je 0x403c1e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x403c1e
test byte [ebp - 8], 1
jne 0x403c27
or dword [ebp + 0x10], 0x200000
jmp 0x403c5a
mov eax, dword [0x40b748]
cmp eax, dword [ebp - 0x18]
je 0x403c5a
push eax
call esi
test eax, eax
je 0x403c5a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x403c5a
mov eax, dword [0x40b74c]
cmp eax, dword [ebp - 0x18]
je 0x403c5a
push eax
call esi
test eax, eax
je 0x403c5a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b744]
call esi
test eax, eax
je 0x403c76
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403c78
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a77
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219