joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
mov ecx, 0x40ea61a7
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
mov ecx, 0x7585569c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x41f320
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x41f342
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f349
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f338
mov eax, 1
add ebx, ebx
jne 0x41f35b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f350
jne 0x41f36c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f350
xor ecx, ecx
sub eax, 3
jb 0x41f380
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f3f2
mov ebp, eax
add ebx, ebx
jne 0x41f38b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f398
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f3bc
inc ecx
add ebx, ebx
jne 0x41f3a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f39d
jne 0x41f3b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f39d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f3dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f3cd
jmp 0x41f33e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f3dc
add edi, ecx
jmp 0x41f33e
pop esi
mov edi, esi
mov ecx, 0x202
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f3fa
cmp byte [edi], 6
jne 0x41f3fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41f3ff
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f477
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ffc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20000]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f42c
mov ecx, edi
jns 0x41f45b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20008]
or eax, eax
je 0x41f471
mov dword [ebx], eax
add ebx, 4
jmp 0x41f449
call dword [esi + 0x20004]
mov ebp, dword [esi + 0x2000c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41f4ab
sub esp, 0xffffff80
jmp 0x40290c
Function at 0x401b82
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401b99
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x401bb8
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401bbd
inc edi
cmp edi, dword [ebp - 8]
jb 0x401baf
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x401cac
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x401c3f
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x401be9
cmp cl, 0xff
jne 0x401c6e
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, 5
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x401c7f
movzx esi, byte [edx + 0x404264]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
test bl, bl
je 0x401c2f
cmp bl, 0xff
jne 0x401c7c
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x401c07
dec ecx
shl edx, cl
and edx, 7
je 0x401bd6
movzx ecx, byte [edx + 0x404264]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x40425c], 0
mov cl, byte [ebx + 4]
je 0x401c6b
test cl, cl
je 0x401c6b
cmp cl, 0xff
jne 0x401bd6
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401baa
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401baa
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x4034f3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4034fd
repz ret
jmp fcn.004035ea

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100028d0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1000b040]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x1000297d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push 0x10009a6c
lea eax, [ebp - 8]
push str.CONOUT_
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
add esp, 0x14
call fcn.100014b0
mov esi, eax
call fcn.10001dc0
call fcn.10002050
mov ecx, dword [0x1000b504]
mov eax, dword [0x1000b4f0]
push 5
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi + 0x9c], ecx
mov ecx, dword [0x1000b514]
mov ecx, dword [ecx]
mov dword [esi + 0xa0], ecx
mov edi, dword [eax]
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
call dword [eax + 0x10]
mov edx, dword [edi + 4]
lea ecx, [edi + 4]
push 6
mov esi, eax
call dword [edx + 0x10]
push eax
push esi
push str.hp__d__d
call fcn.100018e0
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10003541
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3c4c512f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6b6308c4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x43b748
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
ret 0x4e4c
mov bh, 0x7b
and al, 0x12
and al, 0xa1
sub ecx, dword [ebp - 0x58]
add al, 0xb9
loope 0x43b717
leave
loope 0x43b66f
int1
cmp eax, 0x88459669
hlt
in eax, 0x6f
push edi
pop ecx
fdivr dword [ebp - 0x13]
xor dword [eax + 0x6d48316e], ebp
jnp 0x43b73d
lea ebp, [ebx - 0x1f]
mov ah, 0xa8
jge 0x43b705
leave
lodsd eax, dword [esi]
sal byte [0xaedd28a0], cl
call 0xfcb1ef5a
inc esp
outsb dx, byte [esi]
ficom dword [eax - 0x72179bc8]
int3
lds edi, [ebx + esi]
or byte [ebp + 0x392d6e29], ah
hlt
jne 0x43b6df
lea ebp, [eax + 0x59]
cmpsb byte [esi], byte es:[edi]
pushal
sbb bh, ch
movsd dword es:[edi], dword [esi]
add byte [esi], dh
mov al, 0xae
lcall 0xad17, 0xbcfb72b5
out dx, eax
mov ebx, 0x8dab4da8
clc
lodsd eax, dword [esi]
inc edi
cmp al, 0x15
xor dl, byte [esp + ebp*2 - 0x719034b]
xor eax, 0x4c97785d
xchg byte [ecx - 0x32a2f51e], ah
adc ebp, ebp
dec ecx
add byte es:[edi - 3], al
cmp eax, 0xe8c3d86
cld
push ss
mov ss, word [esi + 0x36f37c1a]
sbb bh, byte [ebx + esi*8 + 0x36]
dec esp
loopne 0x43b74e
std
inc ebx
stc
xor ah, 0x4c
ja 0x43b7cc
pop es
push cs
sub edi, ebp
cld
cld
pushfd
sub byte [edi], bh
scasb al, byte es:[edi]
wait
cmpsd dword [esi], dword es:[edi]
sbb bh, byte [eax + ecx*4]
mov fs, word [edx + 8]
add cl, byte [eax + ecx]
pop ss
out 0xdc, eax
je 0x43b7af
xlatb
pushfd
inc ebx
fisttp dword [edx]
mov ebx, 0xe1353e01
jl 0x43b78a
fistp qword [ecx + 0x131406ab]
mov dl, 0x25
inc edi
mov esi, 0xce4430d
or eax, dword [ebx]
inc edi
std
or al, 0xb
add eax, dword [edi - 3]
xor al, 0xc2
pop ds
mov edx, 0xf76b8e0e
test edi, 0xd6df1cd
test byte [ebx], dl
sar ebp, 0xdb
lodsb al, byte [esi]
adc eax, dword [ebx - 0x7c]
int1
stosb byte es:[edi], al
int 0xf7
mov eax, dword [0x1237f113]
xor eax, dword [bx]
push ss
inc ebp
adc eax, 0x23ee2c0
daa
jmp dword [edi]

Function at 0x445d60
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x4f634579
or bh, 0xe1
out dx, al
push 0xeee95dc8
out dx, al
add eax, dword [edx + ebx + 0x12]
jle 0x445d14
invalid
Function at 0x465f38
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebx + eax - 1], edi
out 0x32, eax
imul ebp, dword [esi + ebp*8 - 0x71cb3e8d], 0x4226e4e7
inc edx
inc eax
inc edx
cmp al, 0x87
lcall 0xd7dd, 0xbdfd44d3
fistp dword [ecx]
ret
and eax, 0xe93b827
pop esi
add dword [esi], ebx
mov al, byte [0xc54da4b1]
add eax, 0x864c8431
inc edx
nop
invalid
xor dword [esp + ecx*2 - 0x736fbd7a], eax
jo 0x465eb8
test byte [ebx + esi*4 + 0x43f17ae3], ah
movsb byte es:[edi], byte [esi]
mov bl, 0xe3
jp 0x465edb
inc ebx
adc byte [ebx], al
lds ecx, [0xd04ce25b]
xor byte fs:[ebx + ebp*2 + 0x430c158e], ah
xor byte [ebx + ebp*2 + 0x430c158e], ah
loop 0x465f5a
jg 0x465f4e
movsb byte es:[edi], byte [esi]
invalid
jge 0x465ecd
ja 0x465ee5
loopne 0x465ea8
or eax, 0x71478180
fcmovbe st(0), st(7)
in al, 0x33
retf
lodsd eax, dword [esi]
xor al, 0xcc
jne 0x465f87
mov ah, 0x73
add ebx, esi
inc eax
dec esp
dec esp
movsd dword es:[edi], dword [esi]
ja 0x465f1c
lodsd eax, dword [esi]
mov bh, 0x84
adc eax, 0xa4710180
jno 0x465ef4
in eax, 0xa3
pop ebp
inc ebp
push cs
das
mov byte [0x41456786], al
inc ecx
xchg ebp, eax
and byte [ecx + 0x75636a63], al
xor esp, edx
sub esi, dword [ebx + 0x7f]
xchg dl, dl
les eax, [ebx + 0x69]
push ss
cmpsb byte [esi], byte es:[edi]
add dl, byte [eax + 0x65abf2a2]
dec esp
pop edx
pushfd
mov al, 5
aad 0x91
test eax, eax
js 0x465f4e
ret
je 0x465f94
or byte [ebx - 0x2ab0f14e], 0xb6
ret
adc cl, byte [esp + ebp - 0x60]
imul esp, dword [edi + 0x47], 0xffffffe2
or eax, 0x1c8551b
in al, 0xb6
jae 0x465fc7
pushfd
push ebp
dec edx
inc eax
xchg edx, eax
inc ecx
in al, 0x74
inc eax
mov dword [0xaced9664], eax
popal
mov esi, dword [ecx - 0x2b0e93e3]
int1
aam 0xb8
lodsd eax, dword [esi]
jg 0x465fca
invalid
and al, 0x25
push edi
invalid
and eax, 0xe807b493
pop esp
out 3, al
push cs
lahf
je 0x46603d
out 0x1d, eax
and eax, eax
sub eax, 0xe97e4a1
inc edi
in al, dx
pop ss
or esp, dword [ecx - 0xa]
push ebx
xor al, 0x80
mov ah, 0x51
movsb byte es:[edi], byte [esi]
push esi
invalid
ljmp 0x647b:0x6588f5fc
Function at 0x4bb4c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3420
cmp edx, dword [eax]
je 0x4bb4e3
add eax, 8
inc ecx
cmp eax, 0x4c34b0
jl 0x4bb4d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3420]
jne 0x4bb611
mov eax, dword [0x4c7dac]
cmp eax, 1
je 0x4bb5eb
test eax, eax
jne 0x4bb514
cmp dword [0x4c3348], 1
je 0x4bb5eb
cmp edx, 0xfc
je 0x4bb611
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb54b
lea eax, [ebp - 0x1a4]
push 0x4c0960
push eax
call fcn.004bbea0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc330
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb58e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc330
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c095c
push edi
call fcn.004be200
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0940
push eax
call fcn.004bbea0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbeb0
lea eax, [ebp - 0xa0]
push 0x4c093c
push eax
call fcn.004bbeb0
push dword [esi + 0x4c3424]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbeb0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0914
push eax
call fcn.004be174
add esp, 0x2c
pop edi
jmp 0x4bb611
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3424]
push 0
push eax
push dword [esi]
call fcn.004bc330
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40d8d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x40d917
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.0040d8c8
pop ecx
mov eax, dword [ebp - 8]
add eax, 0x46
mov dword [ebp - 4], eax
sub dword [ebp - 4], 0xa
sub dword [ebp - 4], 0x3c
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, esi
xor byte [eax], cl
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x40d8e4
cmp dword [ebp + 0xc], 0x2d
pop esi
jne 0x40d92f
or dword [0x1bfe53c], 0xffffffff
mov dword [0x1bfe538], 0xa62e7790
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42076d
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x73f3add9
das
stosb byte es:[edi], al
sub byte [edi + 0x1e47f2b6], ch
inc edi
xor byte [esi - 0x43], al
out dx, al
cmp al, 0x8f
js 0x4207ba
ret 0x1726
sub byte [0xd03d7159], ah
adc cl, byte [edi + 0x36]
push ebp
scasb al, byte es:[edi]
in al, dx
xor al, 0x30
dec ebx
mov word [edi - 0x6c955048], es
jb 0x42083f
or bl, 0x8c
dec esp
jmp 0x41a0787
mov ebx, 0x8c6aeb07
cmp cl, ah
fnstsw word [eax]
inc esp
pushfd
bound ebx, qword [edi]
cmp byte [ecx + edx - 0x4e], bh
add byte [ebp + 0x49], al
pop eax
cmp esp, ebx
mov byte [eax + ecx], bl
mov ecx, 0xaab1ca67
out dx, eax
dec esi
adc al, 4
aas
xchg byte [ebx - 0x16], bh
enter 0x6703, 0x4c
push edi
nop
invalid

Function at 0x4ba915
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33a8
cmp edx, dword [eax]
je 0x4ba937
add eax, 8
inc ecx
cmp eax, 0x4c3438
jl 0x4ba928
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33a8]
jne 0x4baa65
mov eax, dword [0x4c7d2c]
cmp eax, 1
je 0x4baa3f
test eax, eax
jne 0x4ba968
cmp dword [0x4c32d4], 1
je 0x4baa3f
cmp edx, 0xfc
je 0x4baa65
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba99f
lea eax, [ebp - 0x1a4]
push 0x4bfb70
push eax
call fcn.004bb300
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb790
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9e2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb790
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb6c
push edi
call fcn.004bd660
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb50
push eax
call fcn.004bb300
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb310
lea eax, [ebp - 0xa0]
push 0x4bfb4c
push eax
call fcn.004bb310
push dword [esi + 0x4c33ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb310
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb24
push eax
call fcn.004bd5d4
add esp, 0x2c
pop edi
jmp 0x4baa65
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33ac]
push 0
push eax
push dword [esi]
call fcn.004bb790
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40e680
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0040e697
Function at 0x41cb80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559622
mov eax, dword fs:[0]
push eax
sub esp, 0x4f0
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4e8], ecx
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x28
call fcn.00421570
movzx eax, al
test eax, eax
je 0x41cc80
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.00485370
add esp, 0xc
lea ecx, [ebp - 0x4e4]
call fcn.0047aa6f
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4e4]
call fcn.0047b582
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00419540
mov byte [ebp - 4], 1
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x290]
push eax
call fcn.0047335a
add esp, 8
mov dword [ebp - 0x4ec], eax
mov ecx, dword [ebp - 0x4ec]
push ecx
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x28
call fcn.00420510
lea ecx, [ebp - 0x290]
call fcn.0041b370
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.004195b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e4]
call fcn.00474e50
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x58
call fcn.00421570
movzx edx, al
test edx, edx
je 0x41ccfa
push 0x561cb0
lea ecx, [ebp - 0x248]
call fcn.00419540
mov dword [ebp - 4], 2
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
call fcn.0047335a
add esp, 8
mov dword [ebp - 0x4f0], eax
mov edx, dword [ebp - 0x4f0]
push edx
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x58
call fcn.00420510
lea ecx, [ebp - 0x2a8]
call fcn.0041b370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.004195b0
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x70
call fcn.00421570
movzx eax, al
test eax, eax
je 0x41cd74
push 0x561cc0
lea ecx, [ebp - 0x260]
call fcn.00419540
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.0047335a
add esp, 8
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
push eax
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x70
call fcn.00420510
lea ecx, [ebp - 0x2c0]
call fcn.0041b370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.004195b0
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x40
call fcn.00421570
movzx ecx, al
test ecx, ecx
je 0x41cdf1
lea edx, [ebp - 0x278]
push edx
call fcn.00419670
mov ecx, eax
call fcn.0046ccf3
mov dword [ebp - 4], 4
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.0047335a
add esp, 8
mov dword [ebp - 0x4f8], eax
mov edx, dword [ebp - 0x4f8]
push edx
mov ecx, dword [ebp - 0x4e8]
add ecx, 0x40
call fcn.00420510
lea ecx, [ebp - 0x2d8]
call fcn.0041b370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.004195b0
cmp dword [ebp + 8], 0
je 0x41ce28
mov eax, dword [ebp - 0x4e8]
mov byte [eax], 1
lea ecx, [ebp - 0x4fc]
push ecx
push 0
mov edx, dword [ebp - 0x4e8]
push edx
push 0x41eff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x4e8]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464e95
mov esp, ebp
pop ebp
ret 4
Function at 0x41ce50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x41cf01
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 1]
test edx, edx
je 0x41cf01
mov ecx, dword [ebp - 4]
call fcn.0041f290
mov dword [ebp - 8], 0
mov eax, 1
test eax, eax
je 0x41cec3
cmp dword [ebp - 8], 0x14
jl 0x41cea0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 3]
test edx, edx
jne 0x41cea0
jmp 0x41cec3
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 2]
test ecx, ecx
je 0x41cead
jmp 0x41cec3
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41ce84
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 2]
test ecx, ecx
jne 0x41cf01
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x41cf17
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x422f00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x422f18
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x422f6b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x422f39
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x422f5c
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x422f30
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x5cc2f0], eax
jmp 0x422f0f
jmp 0x422f76
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x800
jae 0x422fae
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x5cbef0]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
mov edx, dword [ebp - 0x10]
shr edx, 8
xor edx, dword [ecx*4 + 0x5cc2f0]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x5cc2f0], edx
jmp 0x422f6d
mov dword [0x5ce2f0], fcn.00428100
call fcn.004233e0
test eax, eax
jne 0x422fcb
mov dword [0x5ce2f0], 0x428210
mov esp, ebp
pop ebp
ret