joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
and byte [edi - 0x3ceb8c26], bh
mov ebp, 0xb103832
push esp
mov bh, 0x99
stosb byte es:[edi], al
sbb ch, byte [esp + ecx*4]
lea edx, [ebx + 0x4d1da05]
sbb esi, dword [edx + 0x42]
add esi, dword [ebp - 0x77]
mov es, word [edx - 0x4c]
ficom dword [esi + edi - 0x864dd4]
mov edx, 0x8aba815c
invalid
in eax, dx
jmp 0x403cac
inc edi
jl 0x403d22
xor dword [edi], ecx
salc
retf 0x71c2

Function at 0x40897b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
and esi, edi
inc esi
call fcn.0040899e
xor dword [ebx], eax
inc ebx
add esi, 0x81ca8598
cmp ebx, ecx
jne fcn.0040897b
add esi, 0x4e9d08a4
ret
Function at 0x29eea10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x2591015
lea edi, [esi - 0x2190015]
push edi
or ebp, 0xffffffff
jmp 0x29eea32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x29eea39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29eea28
mov eax, 1
add ebx, ebx
jne 0x29eea4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x29eea5c
jne 0x29eea7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29eea7b
dec eax
add ebx, ebx
jne 0x29eea68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x29eea40
add ebx, ebx
jne 0x29eea77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x29eeacd
xor ecx, ecx
sub eax, 3
jb 0x29eea93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x29eeb02
sar eax, 1
mov ebp, eax
jmp 0x29eea9e
add ebx, ebx
jne 0x29eea9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29eea6c
inc ecx
add ebx, ebx
jne 0x29eeaac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29eea6c
add ebx, ebx
jne 0x29eeab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x29eeaae
jne 0x29eeaca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x29eeaae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x29eeaec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x29eeade
jmp 0x29eea2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x29eeaec
add edi, ecx
jmp 0x29eea2e
pop esi
mov edi, esi
mov ecx, 0x14c588
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x29eeb0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x29eeb0f
lea edi, [esi + 0x25eb000]
mov eax, dword [edi]
or eax, eax
je 0x29eeb80
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25eec7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25eecb8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x29eeb35
mov ecx, edi
jns 0x29eeb64
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x25eecc0]
or eax, eax
je 0x29eeb7a
mov dword [ebx], eax
add ebx, 4
jmp 0x29eeb52
call dword [esi + 0x25eecbc]
mov ebp, dword [esi + 0x25eecc4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x29eebb4
sub esp, 0xffffff80
jmp 0x410390
Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x438ca1
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
mov eax, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], edx
mov ebx, dword [esp]
add esp, 4
add ebx, 1
sub edx, ebx
call fcn.00438cec
or edx, ebx
xor dword [ecx], eax
add edx, 0xc186d775
sub ebx, 0x477c0541
inc ecx
inc ebx
cmp ecx, edi
jne fcn.00438ca1
sub ebx, 0x859d4e8e
mov edx, edx
add ebx, edx
ret
Function at 0x43b64b
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
add edi, ecx
sub ecx, 0x8ff7d09d
inc ecx
call fcn.0043b686
add edi, edi
mov ecx, ecx
mov ecx, 0x36e6d0bb
xor dword [esi], edx
add edi, ecx
mov edi, edi
sub ecx, ecx
inc esi
and ecx, ecx
add edi, ecx
cmp esi, ebx
jne fcn.0043b64b
or ecx, edi
sub ecx, 1
and edi, ecx
ret
Function at 0x452630
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c90
mov eax, dword [ebp - 8]
call fcn.00404c90
xor eax, eax
push ebp
push 0x4526fb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404ca0
push eax
call sub.kernel32.dll_LoadLibraryExA_1
test eax, eax
mov eax, dword [ebp - 4]
call fcn.00404ca0
push eax
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [0x55561c], eax
cmp dword [0x55561c], 0
je 0x4526d5
mov eax, dword [ebp - 8]
call fcn.00404ca0
push eax
mov eax, dword [0x55561c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x555620], eax
mov eax, dword [0x555630]
push eax
push 0x40
push 0x1556093c
push 0x555620
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.nTDLL_ZwProtectVirtualMemory
mov edx, 0x555620
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.00452620
mov eax, dword [0x55561c]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452702
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404800
ret

Function at 0x438ca2
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
add esi, ebx
sub esi, 0x26e3f490
add esi, esi
call fcn.00438ce4
inc ebx
inc esi
mov ebx, 0xd654fabb
xor dword [eax], edx
add esi, 0xc00004df
add esi, esi
sub esi, 0x45b2ec11
add eax, 1
sub ebx, esi
dec ebx
cmp eax, edi
jne fcn.00438ca2
sub esi, 1
mov ebx, ebx
ret
Function at 0x414f6f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00415300
mov ebx, esp
lea eax, [ebp - 0x24]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414fc8
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
call fcn.00415023
dec eax
neg eax
sbb eax, eax
and ax, 0x1000
add eax, 0x11000
add eax, edi
cmp esi, eax
jae 0x414fcc
xor eax, eax
jmp 0x41501b
call fcn.00415023
cmp eax, 1
je 0x414ffc
cmp esi, edi
jbe 0x414feb
mov eax, esi
push 0x4000
sub eax, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 4
push 0x1000
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call fcn.00415023
dec eax
lea ecx, [ebp - 8]
neg eax
sbb eax, eax
push ecx
and eax, 0x103
inc eax
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ecce7
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4eca52
sub eax, edx
and edx, edx
call fcn.004ecd29
or eax, edx
mov edx, 0x19541d97
or edx, eax
xor dword [esi], edi
mov edx, 0x74038148
add esi, 1
or eax, edx
mov eax, 0x27bf8c6
sub edx, 0x21a0befb
cmp esi, ecx
jl fcn.004ecce7
dec edx
or eax, eax
dec edx
ret
Function at 0x43fa03
Capabilities:
Hash data with crc32

Disassembly:
je 0x43fbf7
jne 0x43fbf7
cmp dword [0x69a7642c], esi
lea edi, [eax + 0xcd0ea8]
cmp dword [0xd0c3a8], ecx
or dword [eax + 0x20], 0x80
mov byte [eax + esi - 1], 0
cmp dword [0xdeb3d8], edi
mov dword [0x112765ac], eax
mov dword [esi], 0xace0bc
movsx eax, word [ebp - reloc.uxtheme.dll_GetThemeFont]
push 0xaab9a8
int1
rcr byte [esi], 1
loop 0x43f2e7
sub eax, 0x22a93090
aaa
out 0x83, al
leave
jmp [eax + reloc.uxtheme.dll_HitTestThemeBackground]
movsd dword es:[edi], dword [esi]
add byte [eax + 0x4561b4], bh
mov eax, 0x10d7a2b8
mov edx, 0xb1ced4
push 0xa76714
mov dword [esi], 0x9fb764
push 0x4f0dcc
mov dword [edx + esi + 0x13c], 0x10261f8c
push 0x697a2e6c
mov byte [ebp - 0x132], 0
mov ecx, 0x15
sti
and bh, byte [edi + 0x4232049f]
cmp byte [eax], bl
mov al, byte [0x6b249244]
dec edi
arpl word [eax], bx
cwde
jmp 0x43fa03
not ecx
xor ebx, ebx
je 0x43fafa
jne 0x43fafa
cmp dword [ebp + 0xc], eax
jmp dword [ecx*4 + 0x86d66c]
shr ecx, 8
je 0x43f8c9
jne 0x43f8c9
mov dword [0x112b2da8], eax
neg dword [ebp + 0x12]
push 0xa233fc
push 0x1016adc0
mov dword [0x1124da0c], eax
mov dword [0x111d2de4], eax
cmp dword [ebp + 0x1c], 0x80000000
mov dword [esi], 0xa0e618
pmaddwd xmm6, xmmword [0x69809430]
mov eax, 0x10dab0f8
push 0x100d8c6c
mov ecx, dword [0x42be3c]
movzx eax, word [reloc.uxtheme.dll_GetThemeFont]
add ebp, 0x518
mov dword [esi + 0x5c], 0x42edc0
push 0xaf4520
cmp byte [0xdef019], 0
mov dword [esp + 0xec], 0x1028d9a4
hlt
mov dword [ebp - 0x128], ebx
mov dword [ebp - 4], 0xfffffffe
push 0x43fb85
ret
push eax
push 0x43fe3a
ret
je 0x43f33b
movzx eax, byte [esi]
xor eax, ecx
je 0x43fd59
jne 0x43fd59
mov ecx, dword [0x1152b260]
lock cmpxchg dword [ebx], edx
mov dword [esi + 0x694], 1
mov dword [esi + 4], 0x63eba0
jmp dword [0x49140c]
xor ecx, dword [eax*4 + 0x401240]
push 0x43f5f1
ret
mov eax, edx
dec edx
mov dword [ebp - 0x130], edx
test eax, eax
jmp 0x43f814
mov dword [ebp - 0x124], esi
jmp 0x43f925
cmp ecx, 0x39b5d60d
sete bl
jmp 0x43f464
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b19b0
push 0x4a41c0
mov eax, dword fs:[0]
jmp 0x43f67a
and eax, 0xff
jmp 0x43f37a
Function at 0x4a3b50
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4b24e0
call fcn.004a7eb0
call fcn.004a7b81
movzx esi, ax
push 2
call fcn.004a7981
pop ecx
mov eax, 0x5a4d
cmp word [sym.imp.uxtheme.dll_GetThemeTextExtent], ax
je 0x4a3a07
sub ebx, ebx
jmp 0x4a3a3a
mov eax, dword [0x40003c]
cmp dword [eax + sym.imp.uxtheme.dll_GetThemeTextExtent], 0x4550
jne 0x4a3a03
mov ecx, 0x10b
cmp word [eax + sym.imp.shlwapi.dll_StrCmpW], cx
jne 0x4a3a03
sub ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4a3a3a
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004a73a3
or eax, eax
jne 0x4a3a4e
push 0x1c
call fcn.004a3b29
pop ecx
call fcn.004a6e06
or eax, eax
jne 0x4a3a5f
push 0x10
call fcn.004a3b29
pop ecx
call fcn.004a7a68
and dword [ebp - 4], 0
call fcn.004a73b8
or eax, eax
jns 0x4a3a79
push 0x1b
call fcn.004a3b29
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x5c46b0], eax
call fcn.004a7aa8
mov dword [0x5bee48], eax
call fcn.004a7666
or eax, eax
jns 0x4a3a9f
push 8
call fcn.004a6ee1
pop ecx
call fcn.004a789f
or eax, eax
jns 0x4a3ab0
push 9
call fcn.004a6ee1
pop ecx
push 1
call fcn.004a6f1b
pop ecx
or eax, eax
je 0x4a3ac3
push eax
call fcn.004a6ee1
pop ecx
call fcn.004a7e58
push esi
push eax
push 0
push sym.imp.uxtheme.dll_GetThemeTextExtent
call main
push eax
pop esi
mov dword [ebp - 0x24], esi
or ebx, ebx
jne 0x4a3ae5
push esi
call fcn.004a7177
call fcn.004a6f0c
jmp 0x4a3b1a
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.004a7ef5
ret
call fcn.004a79ce
jmp 0x4a39d9
Function at 0x43b65f
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop ebx
sub edx, 0xefc25884
sub eax, 0xdf85136f
inc edx
call fcn.0043b6a6
sub edx, 0xc2198f5d
xor dword [ecx], ebx
or edx, edx
add ecx, 1
sub eax, 1
sub edx, 1
cmp ecx, edi
jne fcn.0043b65f
and edx, eax
sub eax, edx
inc eax
ret
Function at 0x75a770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x246000]
mov dword [edi + 0x31b210], 0x7cc19ba
push edi
or ebp, 0xffffffff
jmp 0x75a79a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x75a7a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x75a790
mov eax, 1
add ebx, ebx
jne 0x75a7b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x75a7c4
jne 0x75a7e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x75a7e3
dec eax
add ebx, ebx
jne 0x75a7d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x75a7a8
add ebx, ebx
jne 0x75a7df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x75a835
xor ecx, ecx
sub eax, 3
jb 0x75a7fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x75a86a
sar eax, 1
mov ebp, eax
jmp 0x75a806
add ebx, ebx
jne 0x75a806
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x75a7d4
inc ecx
add ebx, ebx
jne 0x75a814
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x75a7d4
add ebx, ebx
jne 0x75a821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x75a816
jne 0x75a832
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x75a816
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x75a854
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x75a846
jmp 0x75a796
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x75a854
add edi, ecx
jmp 0x75a796
pop esi
mov edi, esi
mov ecx, 0x11e03
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x75a872
cmp byte [edi], 0x19
jne 0x75a872
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x75a877
lea edi, [esi + 0x355000]
mov eax, dword [edi]
or eax, eax
je 0x75a8ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x35f4d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x35f67c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x75a8a4
mov ecx, edi
jns 0x75a8d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x35f680]
or eax, eax
je 0x75a8e9
mov dword [ebx], eax
add ebx, 4
jmp 0x75a8c1
call dword [esi + 0x35f690]
mov ebp, dword [esi + 0x35f684]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x75a923
sub esp, 0xffffff80
jmp 0x599015
Function at 0x4017e0
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
clc
jae 0x4017eb
call 0x63d0a5
add byte [eax], al
mov eax, 0x23
cmp eax, 0x100
jl 0x4017f9
call 0x3dcb7c51
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x450e00], eax
mov edx, 0xda4c2ca8
call fcn.00401160
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
call edx
stc
jb 0x401829
call 0xff4082f8
adc eax, sym.imp.USER32.dll_WindowFromDC
push 0
call dword [sym.imp.USER32.dll_WindowFromDC]
push 8
call fcn.0040232a
push 4
mov esi, eax
call fcn.0040232a
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x401ad0
push 0
push 0
mov dword [eax], 0x4016f0
call fcn.004053bf
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x401891
cmp dword [edi], 0
je 0x40189e
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi], eax
je 0x4018a5
push 0
push dword [esi + 4]
push dword [esi]
call fcn.0040216e
add esp, 0xc
test eax, eax
jne 0x4018ac
pop edi
mov dword [esi], eax
mov dword [esi + 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [edi], 0
call fcn.00401f10
push 1
call fcn.00401f10
push 5
call fcn.00401f10
push 2
call fcn.00401f10
int3

Function at 0x402c97
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402cd6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402cd6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402cd6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402cd6
cmp dword [ecx + 0x74], 0xe
jbe 0x402cd6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407864
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41226c
push 0x412264
push str.FlsAlloc
push 0x1e
call fcn.004076e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407898
push dword [ebp + 8]
mov ecx, esi
call dword [0x410138]
call esi
jmp 0x40789e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4078e2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41227c
push 0x412274
push str.FlsGetValue
push 0x20
call fcn.004076e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407919
push dword [ebp + 8]
mov ecx, esi
call dword [0x410138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x5d8aab
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5d87dc
mov ecx, ecx
add ebx, 1
or ecx, ebx
call fcn.005d8aed
sub ebx, 0xe77119f4
or ecx, ecx
xor dword [esi], eax
sub ecx, ebx
add esi, 2
mov ecx, 0x39868daa
or ebx, ebx
cmp esi, edx
jl fcn.005d8aab
or ecx, ebx
mov ebx, ebx
inc ebx
ret
Function at 0x403499
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x8b8838], 0x594
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x4034da
push esi
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
push 0x402b88
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov eax, dword [0x807fb8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x807fbc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00403492
mov eax, dword [0x807fc0]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x807fc4]
add ebx, 0x23f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x8b8838], 0xc
mov dword [ebp - 4], ecx
jne 0x403565
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
add dword [ebp - 4], ecx
mov ecx, dword [0x8b8838]
cmp ecx, 0xfa9
jne 0x403583
mov dword [0x8b7dd4], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x403591
mov dword [0x8b7788], esi
lea ecx, [ebx + eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
shr eax, cl
mov dword [0x8b7dd0], 0xf4ea3dee
add eax, dword [ebp - 0x1c]
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x8b8838], 0x213
mov dword [ebp - 0x14], ecx
jne 0x4035cf
push esi
push 0x402bf8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x8b8838], 0xc
jne 0x403616
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push esi
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push esi
lea eax, [ebp - 0x830]
push eax
push 0x402c38
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ebx + eax]
xor dword [ebp - 4], edx
shr eax, cl
add eax, dword [ebp - 0x20]
cmp dword [0x8b8838], 0x121
mov edi, eax
jne 0x40364b
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
xor dword [ebp - 4], edi
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x403515
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4