joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x67c33bd6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x48fc4a3d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x1001ff3d
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001ff77
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001ff75
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x1001ff95
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001ff95
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret
Function at 0x10024b28
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x7e43
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.10024797
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10024b5d
xor eax, eax
jmp 0x10024cad
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.100247e4
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10024b85
xor eax, eax
jmp 0x10024cad
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.10024844
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10024ba4
xor eax, eax
jmp 0x10024cad
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
push 0x1ebf
lea eax, [ebp - 0x24]
push eax
call fcn.10024653
add esp, 0x1c
push 0x100a
lea eax, [ebp + 8]
push eax
push 0x6f22
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.100248a3
add esp, 0x18
push 0x36c9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0x5ba2
call fcn.1002492d
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x10024c22
lea eax, [ebp - 0x14]
push eax
push 0x39af
push 1
lea eax, [ebp - 4]
push eax
call fcn.10024a75
add esp, 0x10
push dword [ebp - 4]
call fcn.10023dea
pop ecx
test eax, eax
jne 0x10024c33
xor eax, eax
jmp 0x10024cad
push 0x6283
push dword [ebp - 4]
push 1
push 0x4ed
call fcn.1001d4c2
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10024c95
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10024c69
xor eax, eax
jmp 0x10024cad
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10024c82
xor eax, eax
jmp 0x10024cad
push 1
push 0x18fd
lea eax, [ebp - 4]
push eax
call fcn.10024ad9
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10024ca6
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10024caa
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10038908
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov dword [ebp - 8], 0x3629aa8
mov dword [ebp - 0x10], 0x8900fdb6
mov dword [ebp - 0xc], 0x33563700
mov dword [ebp - 0x44], 0x5ee56e31
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003893f
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jle 0x10038956
mov dword [ebp - 0x14], 1
jmp 0x1003895a
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
jge 0x1003896b
mov dword [ebp - 0x18], 1
jmp 0x1003896f
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jl 0x10038987
mov dword [ebp - 0x1c], 1
jmp 0x1003898b
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0xa2d3
jge 0x1003899d
mov dword [ebp - 0x20], 1
jmp 0x100389a1
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x20], eax
je 0x100389b2
mov dword [ebp - 0x24], 1
jmp 0x100389b6
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x24]
jg 0x100389c7
mov dword [ebp - 0x28], 1
jmp 0x100389cb
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x28], eax
jge 0x100389dc
mov dword [ebp - 0x2c], 1
jmp 0x100389e0
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2c], eax
jg 0x100389f1
mov dword [ebp - 0x30], 1
jmp 0x100389f5
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x30], eax
jle 0x10038a15
cmp dword [ebp - 0xc], 0
je 0x10038a15
mov eax, 0xfae
test eax, eax
je 0x10038a15
mov dword [ebp - 0x34], 1
jmp 0x10038a19
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x34], eax
je 0x10038a2a
mov dword [ebp - 0x38], 1
jmp 0x10038a2e
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x38], eax
jge 0x10038a3f
mov dword [ebp - 0x3c], 1
jmp 0x10038a43
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
jne 0x10038a57
and dword [ebp - 0x40], 0
jmp 0x10038a74
call fcn.1006544b
mov esi, eax
call fcn.1006544b
imul esi, eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
mov eax, esi
cdq
idiv ecx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x40]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003bfcf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003c000
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1003bffb
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1003c0a8
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], eax
jae 0x1003c083
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + eax]
mov dword [edx], eax
jmp 0x1003c0a8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
add eax, dword [ecx + 0x10]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [eax + 0x14]
call fcn.10038908
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1004638a
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004639f
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x100463a7
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop ebp
ret
Function at 0x1004d366
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004d38c
push 0
push 0x17e7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1004d3e4
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 8], 0
jmp 0x1004d3a3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x1004d3b6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], 0xf99f
jmp 0x1004d39c
mov dword [ebp - 0xc], 2
jmp 0x1004d3c6
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x1004d3e4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004d3e2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1004d3bf
mov esp, ebp
pop ebp
ret
Function at 0x10079396
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10082330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006982c
mov dword [ebp - 0x14], eax
cmp dword [0x1066eab0], esi
jne 0x10079489
push 0x800
push esi
push 0x10009208
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10079416
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10079569
push esi
push esi
push 0x10009208
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10079569
push 0x10009220
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10079569
push eax
call ebx
push 0x1000922c
push edi
mov dword [0x1066eab0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000923c
push edi
mov dword [0x1066eab4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10009250
push edi
mov dword [0x1066eab8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066eac0], eax
test eax, eax
je 0x10079486
push 0x1000926c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066eabc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100794ae
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100794a1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100794c3
push 4
pop eax
jmp 0x1007956b
cmp dword [ebp - 0x14], esi
je 0x100794c3
push dword [0x1066eab0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100794a8
mov eax, dword [0x1066eabc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10079521
cmp dword [0x1066eac0], edi
je 0x10079521
push eax
call ebx
push dword [0x1066eac0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10079521
test eax, eax
je 0x10079521
call ecx
test eax, eax
je 0x10079516
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10079516
test byte [ebp - 8], 1
jne 0x10079521
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10079551
mov eax, dword [0x1066eab4]
cmp eax, edi
je 0x1007954e
push eax
call ebx
test eax, eax
je 0x1007954e
call eax
mov esi, eax
test esi, esi
je 0x1007954e
mov eax, dword [0x1066eab8]
cmp eax, edi
je 0x1007954e
push eax
call ebx
test eax, eax
je 0x1007954e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066eab0]
call ebx
test eax, eax
je 0x10079569
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007956b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x40ace0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
or eax, 0xffffffff
mov word [ebp - 0x1c], ax
xor eax, eax
push ebx
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x30], eax
xor ecx, ecx
push esi
xor esi, esi
mov eax, 0x65
mov edx, 2
mul edx
seto cl
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x2c], 0x65
neg ecx
or ecx, eax
enter 0xffffffffffffe851, 0xffffffffffffffea
push ebx
add dword [eax], eax
mov ebx, eax
add esp, 4
xor eax, eax
push 4
mov dword [ebp - 8], ebx
mov dword [ebp - 0x34], ebx
mov word [ebx], ax
call fcn.0042010a
add esp, 4
test eax, eax
je 0x40b626
mov dword [eax], 1
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 0x10]
xor edi, edi
cmp dword [edx + 8], esi
jbe 0x40ad8f
mov eax, dword [edx + 4]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40ad82
movzx ecx, word [eax + 8]
cmp cx, 0x3f
jg 0x40ad76
cmp cx, 0x30
jge 0x40ae3e
push eax
call fcn.0042017e
mov edx, dword [ebp + 0x10]
add esp, 4
mov eax, dword [edx + 4]
inc edi
mov dword [eax + edi*4 - 4], esi
cmp edi, dword [edx + 8]
jb 0x40ad55
mov ecx, dword [ebp + 0xc]
mov dword [edx + 8], esi
cmp word [ecx], si
je 0x40afa3
fldz
fld qword [0x4b2750]
fld qword [0x4b2748]
fld qword [0x4b2740]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x40ad76
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov eax, dword [ecx + 0xc]
cmp dword [eax], esi
je 0x473dff
push ecx
call fcn.0042017e
mov eax, dword [ebp - 0x10]
add esp, 4
jmp 0x40ad76
mov dword [ebp - 0x28], esi
jmp 0x40ad4b
invalid

Function at 0x4707b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
add esi, 4
movzx ebx, word [esi - 2]
movzx eax, word [esi]
push edi
mov edi, edx
inc di
sal byte [eax + ebx*2 + 0x6a], 0x5d
pop edx
cmp ax, 0x5c
jne 0x4707dd
cmp word [esi + 2], dx
jne 0x4707dd
add esi, 2
jmp 0x470816
cmp ax, dx
je 0x470821
cmp ax, bx
jne 0x4707ed
cmp word [esi + 2], dx
je 0x470827
cmp ax, 0x5b
jne 0x470816
movzx eax, word [esi + 2]
cmp eax, 0x3a
je 0x470806
cmp eax, 0x2e
je 0x470806
cmp eax, 0x3d
jne 0x470816
mov edx, edi
mov ecx, esi
call fcn.004707b3
xor byte [ebp + 0x5d6a0e75], al
pop edx
add esi, 2
movzx eax, word [esi]
inc di
sal byte [ebp - 0x55], 0xff
rcr byte [edi + 0x5e], 0x39
ret
inc eax
pop edi
pop esi
cmp ebx, eax
inc eax
mov dword [edi], esi
inc eax
jmp 0x470823
Function at 0x401e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
imul ebp, esp, 0x75e81378
or al, 0x56
lea eax, [ebp - 0x78]
push 1
cmp edx, dword [esi - 0x18]
mov dword [ecx], ecx
add byte [eax], al
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0x40c05a]
push eax
adc byte [ebx - 0x5397bf3e], al
aam 0xc
add byte [edx - 0x3a], dl
adc eax, 0x99c1cb
mov eax, dword [0x4102ac]
add esp, 0x14
test eax, eax
dec esi
invalid

Function at 0x40a2d0
Capabilities:
Encode data using xor

Disassembly:
or al, 0x50
invalid
push ebp
mov ebp, esp
jb 0x40a31a
or byte [ebx - 0x367afbb8], cl
jne 0x40a2ed
sbb dword [ebp + 0x156f500c], 0x38
rol byte [eax], 0x33
mov eax, dword [0xd004c25d]
xor esp, dword [ecx - 0x2ffb3da3]
mov eax, dword [eax + 0x32]
push 0xffffffffffffffcb
push eax
inc ecx
adc eax, sym.imp.KERNEL32.dll_WaitForSingleObject
test eax, eax
je 0x40a2e7
cmp eax, 0x80
je 0x40a296
cmp eax, 0x191
invalid
inc eax
add bh, bh
salc
test eax, eax
jne 0x40a327
pop esi
pop ebp
ret 4
call esi
add eax, 0xa9680
pop esi
pop ebp
ret 4

Function at 0x40a3da
Capabilities:
Terminate process

Disassembly:
sal byte [ebx - 0x75], 0x5c
or al, 0x51
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
push esi
mov ebx, dword [ebx - 0x4a]
rol byte [eax - 0x2e], 0xff
salc
jmp 0x5e4619ab
xor esp, dword [esi]
pop ebp
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0xa2e540
push eax
push dword fs:[0]
in eax, 0xa2
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
inc edi
inc ebp
invalid
mov eax, dword [edi]
jmp 0x4010de
sub edx, esp
rol dword [edi + ebp*8], 0xc5
or cl, byte [eax - 0x67]
xchg edi, eax
inc esp
aas
leave
mov ah, 0xb5
retf
Function at 0xaa2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aa21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaa207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa206a
add dl, dl
jne 0xaa2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa20dc
xor eax, eax
add dl, dl
jne 0xaa2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa217d
add dl, dl
jne 0xaa20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaa20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaa2075
mov eax, 1
add dl, dl
jne 0xaa20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa20e1
sub eax, ebx
mov ebx, 1
jne 0xaa2128
mov ecx, 1
add dl, dl
jne 0xaa210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaa213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa2136
cmp eax, 0x7d00
jae 0xaa216d
cmp eax, 0x500
jb 0xaa2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa2075
cmp eax, 0x7f
ja 0xaa2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaa219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaa2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406328
xor eax, eax
test eax, eax
je 0x40633a
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40633a
xor ecx, ecx
jmp 0x40633d
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406429
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42229c], 0
push esi
jne 0x406460
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40643a
mov dword [ecx*4 + 0x422298], eax
inc ecx
cmp ecx, 0x100
jl 0x406435
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406491
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422298]
xor eax, esi
inc ecx
dec edx
jne 0x406473
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x45224b96
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3b660463
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219