joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406a80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
mov eax, dword [eax]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0
mov cx, word [eax + 0x14]
lea edi, [ecx + eax + 0x18]
mov dword [ebp - 0x14], edi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 6]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
jge 0x4020e1
mov eax, dword [edi + 0x24]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x402007
lea edx, [ebp - 0x24]
push 0x4093a0
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x4b
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
push 0x4000
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x4020c5
ret
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov ecx, dword [edx*4 + 0x458030]
mov dword [ebp - 0x1c], ecx
je 0x402026
mov eax, ecx
or ah, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x10]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x402088
lea edx, [ebp - 0x28]
push 0x4093a0
push edx
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x10
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
test al, 0x40
je 0x402067
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, 0x40207c
ret
test al, 0x80
je 0x402076
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov eax, 0x40207c
ret
jbe 0x4020cc
lea ecx, [ebp - 0x2c]
push 0x4093a0
push ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x2c], 0xf
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x4020c5
ret
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
inc ecx
add edi, 0x28
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edi
jmp 0x401f9a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403050
Capabilities:
Enumerate device drivers on windows

Disassembly:
push 0xffffffffffffffff
push 0x406b8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7b0
push ebp
mov ebp, ecx
lea eax, [esp + 8]
push edi
push eax
lea ecx, [esp + 0x17c]
xor edi, edi
push 0x640
push ecx
mov dword [esp + 0x18], edi
call sub.PSAPI.DLL_EnumDeviceDrivers
cmp eax, edi
jne 0x4030b3
push edi
push edi
push 0x458a88
call sub.MFC42.DLL_AfxMessageBox
pop edi
pop ebp
mov ecx, dword [esp + 0x7b0]
mov dword fs:[0], ecx
add esp, 0x7bc
ret
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x7c0], edi
test ecx, 0xfffffffc
jbe 0x403172
push ebx
push esi
lea ebx, [esp + 0x180]
mov eax, dword [ebx]
cmp eax, 0x80000000
jae 0x4030ed
inc dword [0x4590ac]
jmp 0x40315d
lea edx, [esp + 0x18]
push 0x64
push edx
push eax
call sub.PSAPI.DLL_GetDeviceDriverBaseNameA
push 0
push 0
push 0
lea eax, [esp + 0x24]
push 0
lea esi, [ebp + 0x60]
push eax
push edi
push 1
mov ecx, esi
call sub.MFC42.DLL_CListCtrl::InsertItem
mov ecx, dword [ebx]
lea edx, [esp + 0x10]
push ecx
push str.0x_08X
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, esi
push eax
push 1
push edi
call sub.MFC42.DLL_CListCtrl::SetItemText
mov edx, dword [ebx]
lea ecx, [esp + 0x7c]
push 0x104
push ecx
push edx
call sub.PSAPI.DLL_GetDeviceDriverFileNameA
lea eax, [esp + 0x7c]
mov ecx, esi
push eax
push 2
push edi
call sub.MFC42.DLL_CListCtrl::SetItemText
mov ecx, dword [esp + 0x14]
mov edx, ecx
inc edi
shr edx, 2
add ebx, 4
cmp edi, edx
jb 0x4030dc
pop esi
pop ebx
xor edi, edi
mov eax, dword [0x4590ac]
shr ecx, 2
sub ecx, eax
lea eax, [esp + 8]
push ecx
push 0x458a6c
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov dword [0x4590ac], edi
call sub.MFC42.DLL_AfxGetThread
cmp eax, edi
je 0x4031a7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x4031a9
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [eax + 0x20]
push ecx
push 0x3ea
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [esp + 8]
mov dword [esp + 0x7c0], 0xffffffff
call fcn.0040652a
mov ecx, dword [esp + 0x7b8]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x7bc
ret
Function at 0x4053a0
Capabilities:
Enumerate services

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x406f9b
push eax
mov eax, 0x3854
mov dword fs:[0], esp
call fcn.00406670
push ebx
push ebp
push esi
push edi
push 0x80000004
xor ebp, ebp
push str.ServicesActive
mov dword [esp + 0x20], ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x1c], edi
jne 0x4053f5
push ebp
push ebp
push 0x458d94
call sub.MFC42.DLL_AfxMessageBox
jmp 0x4054fc
lea eax, [esp + 0x10]
push ebp
lea ecx, [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x30]
push 0x3840
push edx
push 3
push 0x30
push edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x40], ebp
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cmp eax, ebp
jne 0x405432
push ebp
push ebp
push 0x458d88
call sub.MFC42.DLL_AfxMessageBox
jmp 0x4054fc
cmp dword [esp + 0x10], ebp
jbe 0x405495
lea ebx, [esp + 0x24]
jmp 0x405442
mov edi, dword [esp + 0x1c]
mov eax, dword [ebx]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x2c]
push ebp
push 1
lea esi, [eax + 0x60]
mov ecx, esi
call sub.MFC42.DLL_CListCtrl::InsertItem
mov ecx, dword [ebx + 4]
push ecx
push 1
push ebp
mov ecx, esi
call sub.MFC42.DLL_CListCtrl::SetItemText
mov edx, dword [ebx]
push edi
push edx
lea esi, [ebx + 8]
sub esp, 0x1c
mov ecx, 7
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x3c]
push ebp
call fcn.004055f0
mov eax, dword [esp + 0x10]
inc ebp
add ebx, 0x24
cmp ebp, eax
jb 0x40543e
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push 0x458d74
push ecx
mov dword [esp + 0x3878], 0
call sub.MFC42.DLL_CString::Format
add esp, 0xc
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x4054d2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x4054d4
xor eax, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + 0x20]
push ecx
push 0x3ea
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [esp + 0x14]
mov dword [esp + 0x386c], 0xffffffff
call fcn.0040652a
mov ecx, dword [esp + 0x3864]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3860
ret
Function at 0x4055f0
Capabilities:
Access peb ldr_data
Query service configuration

Disassembly:
push 0xffffffffffffffff
push 0x406fb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push 0x800
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_operatornew
mov ebp, eax
mov eax, dword [esp + 0x30]
add esp, 4
dec eax
je 0x405687
sub eax, 3
je 0x405666
sub eax, 3
je 0x405645
push str.
jmp 0x40568c
push 0x458e4c
lea edx, [esp + 0x10]
push 0x458e48
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x18]
add esp, 0xc
add esi, 0x60
push eax
jmp 0x4056a6
push 0x458e40
lea ecx, [esp + 0x10]
push 0x458e48
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
add esp, 0xc
add esi, 0x60
push edx
jmp 0x4056a6
push 0x458e38
lea eax, [esp + 0x10]
push 0x458e48
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
add esp, 0xc
add esi, 0x60
push ecx
mov edi, dword [esp + 0x28]
push 2
push edi
mov ecx, esi
call sub.MFC42.DLL_CListCtrl::SetItemText
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
push 1
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
jne 0x4056db
push eax
push eax
push 0x458e28
call sub.MFC42.DLL_AfxMessageBox
jmp 0x405791
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0x800
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x405791
mov eax, dword [ebp + 4]
cmp eax, 4
ja case.default.0x405705
jmp dword [eax*4 + 0x4057b8]
push 0x458e20
jmp 0x405726
push 0x458e18
jmp 0x405744
push 0x458e10
jmp 0x405762
push 0x458e04
lea edx, [esp + 0x10]
push 0x458e48
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
jmp 0x405779
push 0x458df8
lea ecx, [esp + 0x10]
push 0x458e48
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
jmp 0x405779
push 0x458df0
lea eax, [esp + 0x10]
push 0x458e48
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ecx
push 3
push edi
mov ecx, esi
call sub.MFC42.DLL_CListCtrl::SetItemText
mov edx, dword [ebp + 0xc]
mov ecx, esi
push edx
push 4
push edi
call sub.MFC42.DLL_CListCtrl::SetItemText
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040652a
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 0x28
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401c66
pop dword [ebp - 0x38]
mov eax, 0x94f4faf0
add eax, 0x6b4b2176
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x31f05553
add dword [ebp - 0x48], 0x1c61eff8
mov dword [ebp - 0x44], 0xed5f8245
sub dword [ebp - 0x44], 0xbb2c3600
mov dword [ebp - 0x40], 0xba1dcd19
add dword [ebp - 0x40], 0x922e7715
mov dword [ebp - 0x3c], 0xebfa5417
sub dword [ebp - 0x3c], 0xebfa5417
lea eax, [ebp - 0x48]
push eax
mov eax, 0x1258f1cb
sub eax, 0x1218c177
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x152853ca
sub dword [ebp - 0x48], 0xa0b5ea74
mov dword [ebp - 0x44], 0xc1e00e66
add dword [ebp - 0x44], 0x7f8c530f
mov dword [ebp - 0x40], 0x2e0c4b1d
sub dword [ebp - 0x40], 0xca9cdeb1
mov dword [ebp - 0x3c], 0xa39622c0
add dword [ebp - 0x3c], 0x5c69dd40
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x934b5e5a
sub eax, 0x930b2e2e
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x371f6
push 0
call eax
mov ecx, 0x8f5b9dd5
sub ecx, 0x8f5b5344
mov edi, eax
mov esi, 0xdb8df7bc
add esi, 0x24b27844
add esi, dword [ebp - 0x38]
mov ebx, 0xfa3169c8
sub dword [ebp - 0xc], 0xa6ff688b
mov edx, dword [esi]
add edx, ebx
sub dword [ebp - 0x14], 0x254fd33e
mov dword [edi], edx
xor dword [ebp - 0x20], 0x4fcbfbc5
add edi, 0x41d2aaeb
add edi, 0xbe2d5519
add esi, 4
loop 0x401d82
add eax, 0x11d17
mov ebx, eax
add eax, 0x72c17288
add eax, 0x8d3e8d7d
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.10036322
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.10036322
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.10036322
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001dc93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001dca2
pop dword [ebp - 0x50]
mov eax, 0x78b37a9e
add eax, 0x974e6204
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x60073931
add dword [ebp - 0x60], 0xee4b0c1a
mov dword [ebp - 0x5c], 0x8d6c73f7
add dword [ebp - 0x5c], 0xa4c6d84e
mov dword [ebp - 0x58], 0x60c790d7
add dword [ebp - 0x58], 0xeb84b357
mov dword [ebp - 0x54], 0xae722a79
sub dword [ebp - 0x54], 0xae722a79
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x797ed8ce
sub dword [ebp - 0x60], 0x50c6f78
mov dword [ebp - 0x5c], 0xdf5ddaea
add dword [ebp - 0x5c], 0x620e868b
mov dword [ebp - 0x58], 0xdde5aebc
add dword [ebp - 0x58], 0x8589bdb0
mov dword [ebp - 0x54], 0x37a4b0d9
add dword [ebp - 0x54], 0xc85b4f27
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x4edd91cc
sub eax, 0x3edb718c
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a8f8
push 0
call eax
mov ecx, 0xb4086bfa
sub ecx, 0xb4081a3f
xor ebx, ebx
add ebx, eax
mov esi, 0x10031c00
add esi, dword [ebp - 0x50]
mov edx, 0x8072c0be
add edx, 0xfdcb9cff
mov edi, dword [esi]
xor dword [ebp - 0x38], 0xa78cefa8
sub edi, edx
xor dword [ebp - 0x10], 0x69688c55
mov dword [ebx], edi
add ebx, 4
add esi, 4
loop 0x1001ddbb
add eax, 0x139bf
xor ebx, ebx
add ebx, eax
add eax, 0x13699ff2
sub eax, 0x13699fed
mov ecx, 0x6ad491b6
sub ecx, 0x5ad491b6
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1001deb6
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x289c]
cdq
sub eax, edx
sar eax, 1
push 1
mov dword [edi + 0x292c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0x2930], eax
mov eax, dword [edi + 0x2d50]
test eax, eax
je 0x1001df26
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x28a0]
push dword [edi + 0x289c]
push dword [edi + 0x2930]
push dword [edi + 0x292c]
push dword [edi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push edi
call fcn.1001df2f
pop ecx
pop edi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402d04
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov eax, dword [ecx + 8]
inc eax
imul eax, dword [ecx]
shl eax, 2
push eax
call fcn.005db443
add esp, 4
mov ecx, edi
mov dword [esp], eax
push eax
push esi
call fcn.00403032
push 0x10
call fcn.005db443
add esp, 4
mov ebp, eax
mov esi, dword [edi]
lea eax, [esi*4]
push eax
call fcn.005db443
add esp, 4
mov dword [ebp], eax
xor eax, eax
inc eax
mov ecx, esi
mov edx, dword [ebp]
add edx, ecx
mov dword [ebp + eax*4], edx
inc eax
add ecx, esi
cmp eax, 4
jne 0x402d5a
xor eax, eax
test esi, esi
jle 0x402d84
xor ecx, ecx
mov dl, byte [ebx + ecx*4]
mov esi, dword [ebp + eax*4]
mov byte [esi + ecx], dl
inc ecx
mov esi, dword [edi]
cmp ecx, esi
jl 0x402d73
inc eax
inc ebx
cmp eax, 4
jne 0x402d6d
xor eax, eax
mov ebx, dword [esp]
test esi, esi
jle 0x402da7
xor edx, edx
mov esi, dword [ebp + eax*4]
mov cl, byte [ebx + edx*4]
xor byte [esi + edx], cl
inc edx
mov esi, dword [edi]
cmp edx, esi
jl 0x402d96
inc eax
inc ebx
cmp eax, 4
jne 0x402d90
cmp dword [edi + 8], 2
jl 0x402e38
xor eax, eax
inc eax
mov dword [esp + 4], 4
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
jle 0x402de7
xor ecx, ecx
mov edx, dword [ebp + eax*4]
movzx esi, byte [edx + ecx]
mov bl, byte [esi + 0x611e24]
mov byte [edx + ecx], bl
inc ecx
mov esi, dword [edi]
cmp ecx, esi
jl 0x402dcf
inc eax
cmp eax, 4
jne 0x402dc9
mov ecx, edi
push ebp
call fcn.00403230
mov ecx, edi
push ebp
call fcn.0040330c
mov esi, dword [edi]
mov eax, esi
imul eax, dword [esp + 4]
add eax, dword [esp]
xor ecx, ecx
test esi, esi
jle 0x402e22
xor edx, edx
mov esi, dword [ebp + ecx*4]
mov bl, byte [eax + edx*4]
xor byte [esi + edx], bl
inc edx
mov esi, dword [edi]
cmp edx, esi
jl 0x402e11
inc ecx
inc eax
cmp ecx, 4
jne 0x402e0b
mov eax, dword [esp + 8]
inc eax
add dword [esp + 4], 4
cmp eax, dword [edi + 8]
jl 0x402dc3
xor eax, eax
test esi, esi
jle 0x402e58
xor ecx, ecx
mov edx, dword [ebp + eax*4]
movzx esi, byte [edx + ecx]
mov bl, byte [esi + 0x611e24]
mov byte [edx + ecx], bl
inc ecx
mov esi, dword [edi]
cmp ecx, esi
jl 0x402e40
inc eax
cmp eax, 4
jne 0x402e3a
mov ecx, edi
push ebp
call fcn.00403230
mov eax, dword [edi]
mov ecx, dword [edi + 8]
imul ecx, eax
mov edx, dword [esp]
lea ecx, [edx + ecx*4]
xor edx, edx
test eax, eax
jle 0x402e8d
xor esi, esi
mov eax, dword [ebp + edx*4]
mov bl, byte [ecx + esi*4]
xor byte [eax + esi], bl
inc esi
mov eax, dword [edi]
cmp esi, eax
jl 0x402e7c
inc edx
inc ecx
cmp edx, 4
jne 0x402e76
xor ecx, ecx
mov ebx, dword [esp + 0x24]
test eax, eax
jle 0x402eb1
mov edx, dword [ebp + ecx*4]
xor esi, esi
mov al, byte [edx + esi]
mov byte [ebx + esi*4], al
inc esi
mov eax, dword [edi]
cmp esi, eax
jl 0x402ea4
inc ecx
inc ebx
cmp ecx, 4
jne 0x402e9a
mov eax, dword [ebp]
test eax, eax
je 0x402ec8
push eax
call fcn.005db44c
add esp, 4
push ebp
call fcn.005db44c
add esp, 4
push dword [esp]
call fcn.005db44c
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc