joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40531a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, byte [esp + 0x20]
xor edx, edx
push ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0xc], eax
movzx eax, byte [0x7bb5c2]
movzx ecx, bx
div ecx
push ebp
mov ebp, dword [0x7bb5d8]
mov dl, al
push esi
push edi
mov edi, dword [0x7bb5fc]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebp
mov ecx, dword [edi + ecx*4]
cmp ecx, 0x1085
jl 0x4053fb
lea eax, [edi - 0x178c]
mov edi, dword [esp + 0x10]
lea ebp, [ecx*4 + 0x178c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov esi, 0x1492
mov ecx, dword [esp + 0x34]
mov word [eax + ecx*2], si
mov eax, dword [0x7bb5dc]
movzx ecx, dl
movzx esi, bx
add ebx, 0xffff
mov al, byte [eax + ecx*4 + 0x20]
or al, byte [0x7bb600]
xor al, byte [edi + 0x1230]
inc dl
imul ecx, esi, 0xc
mov byte [esp + 0x30], dl
xor edx, edx
mov byte [0x7bb5c1], al
movzx eax, byte [0x7bb5d2]
div dword [ecx + edi + 0x28]
mov ecx, dword [esp + 0x20]
mov eax, edx
xor edx, edx
div dword [ecx + ebp]
xor edx, esi
add dword [ebp], edx
add ebp, 4
mov cl, byte [0x7bb5d2]
mov dl, byte [esp + 0x30]
xor cl, 0xfb
mov byte [0x7bb5d2], cl
cmp ebp, 0x59a0
jge 0x405376
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
jmp 0x405401
mov cl, byte [0x7bb5d2]
mov eax, dword [esp + 0x28]
inc dl
movzx esi, dl
xor edx, edx
mov eax, dword [eax + esi*4]
div dword [esi*4 + 0x178c]
xor edx, edx
imul eax, dword [edi + esi*8]
mov edi, dword [esp + 0x18]
xor dword [0x7bb5ec], eax
mov eax, dword [ebp + esi*4]
add eax, 0x12c6
xor dword [0x7bb5cc], eax
movzx eax, cl
lea ecx, [eax*8]
mov eax, dword [edi + esi*4]
div dword [ecx + ebp]
mov dword [ecx + ebp], edx
mov al, byte [0x7bb5d0]
mov byte [0x7bb5d1], al
movzx eax, bx
mov eax, dword [edi + eax*4 + 0x20]
add eax, dword [edi + 0x1d60]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x405d03
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
add dword [esp + 0xc], 0x9e
mov edx, dword [esp + 0x14]
push ebx
push ebp
mov ebx, eax
lea ebp, [eax - 0x9da]
push esi
xor ebx, 0x22cc
mov esi, ecx
push edi
mov eax, ebx
lea edi, [ecx - 0x1f59]
xor ecx, 0x658
xor eax, 0x1901
xor esi, 0x1ca
mov dword [esp + 0x18], ecx
cmp ecx, eax
jg 0x405da8
mov eax, dword [esp + 0x14]
add eax, 0xfffffd55
cmp ebx, eax
jg 0x405da8
mov ebx, dword [edx + 0x48]
cmp ebx, dword [edx + 0x54]
ja 0x405da8
mov ecx, dword [edx + 0x8c]
mov eax, dword [edx + 0x2c]
add eax, 0xfff2db39
add eax, ecx
add dword [edx + 0x74], eax
mov eax, dword [edx + 0xdc]
xor eax, ecx
xor eax, dword [0x7bb348]
xor eax, 0xfffe38b8
mov dword [edx + 0x8c], eax
mov eax, ebx
mov ecx, dword [0x79d454]
imul eax, ebx
add dword [ecx + 0xc0], eax
inc ebx
cmp ebx, dword [edx + 0x54]
jbe 0x405d61
mov ecx, dword [esp + 0x18]
xor ebp, 0x61c
cmp esi, ebp
je 0x405e04
xor edi, 0x22cc
cmp esi, edi
jg 0x405de5
mov eax, dword [0x7bb3ac]
cmp eax, dword [edx + 0xe8]
jb 0x405e04
mov eax, dword [0x79d454]
mov eax, dword [eax + 0xc8]
xor eax, 5
imul eax, dword [0x7bb368]
mov dword [0x7bb368], eax
jmp 0x405e04
mov eax, dword [0x79d454]
and esi, dword [esp + 0x1c]
cmp dword [eax + 0xdc], esi
jbe 0x405e04
mov eax, dword [edx + 0x104]
sub eax, 0x1e00
xor dword [edx + 0x20], eax
pop edi
pop esi
pop ebp
lea eax, [ecx - 0x58d]
pop ebx
ret
Function at 0x40674d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x7bb5c4]
mov ecx, dword [0x7bb5cc]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [0x7bb5c8]
mov dword [esp + 0x1c], eax
imul eax, ebx, 0xb23
dec dword [0x7bb5f4]
inc ecx
push esi
mov dword [0x7bb5cc], ecx
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x28], eax
movzx esi, bx
mov dword [esp + 0x14], ebx
movzx eax, word [edi + 0x25d8]
mov dword [esp + 0x30], eax
mov eax, dword [0x7bb5d4]
mov dword [esp + 0x20], esi
mov edx, dword [eax + 0x1ca4]
or edx, 0x16bc
dec ebp
inc ebx
mov dword [0x7bb5c8], ebp
dec byte [0x7bb5c3]
dec dword [0x7bb5d8]
mov dword [esp + 0x1c], ebx
dec ebx
dec byte [0x7bb5c2]
inc ecx
mov dword [0x7bb5cc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], edx
mov eax, dword [ecx]
movzx eax, byte [eax + edx]
cmp ebp, eax
jle 0x4068a4
movzx eax, si
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
add ecx, 4
mov dword [esp + 0x30], ecx
mov edi, dword [0x7bb608]
mov esi, dword [0x7bb5e8]
movzx eax, word [eax]
movzx ecx, byte [eax + edx + 1]
xor edx, edx
mov eax, 0x66d
div ecx
xor eax, ebp
or dword [esi + edi*4], eax
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax + ebp + 0x15]
add word [edi + ecx*2], ax
mov eax, dword [esp + 0x18]
movzx ecx, word [edi + 0x2370]
mov esi, dword [0x7bb5f8]
movzx eax, word [edi + eax*8]
add eax, ecx
cdq
idiv ebx
xor edx, edx
sub ax, word [esi + ebp*2]
mov word [esi + ebp*2], ax
mov eax, dword [0x7bb5e0]
movzx ecx, byte [0x7bb5c2]
movzx eax, word [edi + eax*2 + 0xe]
div ecx
mov eax, edx
xor edx, edx
div dword [0x7bb5fc]
mov edx, dword [esp + 0x1c]
movzx eax, ax
movzx ecx, word [edx + ebp*2]
imul eax, ecx
mov ecx, dword [esp + 0x30]
mov word [edx + ebp*2], ax
inc ebp
mov eax, dword [ecx]
mov edx, dword [esp + 0x10]
movzx eax, byte [eax + edx]
cmp ebp, eax
jg 0x4067f2
mov esi, dword [esp + 0x20]
mov cl, byte [0x7bb5d0]
mov eax, dword [esp + 0x24]
xor cl, 5
inc cl
movzx edx, si
mov byte [0x7bb5d0], cl
mov al, byte [eax + 0xc94]
or al, cl
movzx ecx, word [edi + edx*4 + 0x1e]
movzx eax, al
imul eax, ecx
mov ecx, dword [esp + 0x28]
mov word [edi + edx*4 + 0x1e], ax
mov al, byte [0x7bb5d2]
dec al
mov byte [0x7bb5d2], al
movzx eax, al
pop edi
pop esi
pop ebp
mov eax, dword [ecx + eax*4 + 0x2c]
xor eax, edx
pop ebx
add esp, 0x1c
ret
Function at 0x406a13
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea ebp, [eax - 0x18e]
mov dword [esp + 8], ebp
lea ecx, [esi - 0x15f]
xor esi, 0x1f5f
mov dword [esp + 0x1c], ecx
lea ecx, [eax - 0x227]
mov eax, dword [esp + 0x18]
add eax, 0xc8e
cmp ecx, eax
jge 0x406c78
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
push ebx
mov eax, dword [edi + 0x9c]
mov ecx, dword [edi + 0x98]
xor ecx, dword [edi + 4]
mov edx, dword [eax + ebp]
mov eax, 0x179d66
sub eax, ecx
add ebp, 4
add dword [edi + 0xc8], eax
mov eax, dword [0x79d454]
mov ebx, dword [edi + 0x58]
imul ebx, edx
mov ecx, dword [eax + 0xe0]
mov eax, dword [eax + 0xdc]
add ecx, 0xffffffe5
add eax, ecx
xor dword [edi + 0xa4], eax
mov eax, dword [edi + 0x8c]
mov ecx, dword [0x7bb384]
xor eax, 0xd24ba
sub ecx, eax
xor eax, eax
mov dword [0x7bb384], ecx
inc eax
sub eax, dword [0x7bb390]
sub eax, dword [edi + 0x60]
add ecx, eax
mov dword [0x7bb384], ecx
mov ecx, dword [edi + 0x5c]
mov eax, dword [edi + 0xb4]
mov byte [ecx + eax], bl
inc dword [edi + 0x5c]
mov eax, dword [0x79d454]
mov ecx, dword [edi + 0x3c]
sub ecx, dword [eax + 0xe8]
xor ecx, 0x60a5a
imul ecx, dword [edi + 0xe0]
mov dword [edi + 0xe0], ecx
mov eax, dword [edi + 0x80]
xor eax, 0x170e2b
or dword [edi + 0x1c], eax
mov eax, dword [edi + 0x104]
add eax, dword [0x7bb3a0]
mov ecx, dword [0x79d454]
xor eax, 0x307676
sub dword [ecx + 0xc8], eax
mov ecx, dword [edi + 0x104]
mov edx, dword [0x79d454]
add ecx, 0xfff1107b
mov eax, dword [edi + 0x4c]
add eax, ecx
add dword [edx + 0xdc], eax
mov eax, dword [0x79d454]
mov ecx, dword [eax + 0x104]
mov eax, dword [edi + 0xf8]
add ecx, 0xffcf898b
add eax, ecx
imul eax, dword [edi + 0xb0]
mov dword [edi + 0xb0], eax
mov ecx, dword [0x79d454]
mov eax, dword [0x7bb34c]
xor eax, 1
add dword [ecx + 0x64], eax
mov eax, 0x3ff48
sub eax, dword [edi + 0xf4]
sub eax, dword [0x7bb388]
add dword [0x7bb30c], eax
mov edx, dword [0x79d454]
mov eax, dword [edi + 0xe8]
dec eax
add eax, dword [edx + 0xa4]
add dword [edx + 0x64], eax
cmp ebp, 0x1c51e0
jl 0x406a57
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
add eax, 0x852
cmp esi, eax
jge 0x406be7
mov eax, ebp
xor eax, 0x3c5f
cmp esi, eax
jge 0x406bf6
mov ecx, dword [0x79d454]
mov eax, dword [ecx + 0x10]
add eax, 0x2fa0be2f
mov dword [ecx + 0x58], eax
mov dword [edi + 0x9c], 0x643000
mov eax, dword [esp + 0x24]
pop ebx
pop edi
pop esi
add eax, 0x4cf
pop ebp
pop ecx
ret
mov ebx, dword [esp + 0x18]
mov eax, esi
add ebx, 0xfffffdd9
xor eax, ebx
or eax, dword [edi + 0xa4]
cmp ebp, eax
jne 0x406be7
mov eax, dword [0x79d454]
mov eax, dword [eax + 0xa0]
xor eax, esi
add eax, 0x1901
cmp ebp, eax
jbe 0x406be7
mov esi, dword [edi + 0xb0]
mov edx, dword [edi + 0xf4]
sub esi, 0x18f2
imul esi, dword [edi + 0x6c]
sub edx, ebp
mov ecx, dword [edi + 0x10c]
mov eax, dword [edi + 0x94]
and ecx, ebx
mov edi, dword [esp + 0x18]
or eax, 0x22cf
add edi, 0xfffff8e0
and ecx, 0x15a3
add eax, edi
push eax
push ecx
push dword [0x79d454]
push edx
push esi
call fcn.00405467
add esp, 0x14
jmp 0x406beb
mov eax, dword [esp + 0x1c]
jmp 0x406bed
Function at 0x406d94
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
xor ecx, 0x7ab
push ebp
mov ebp, dword [esp + 0x1c]
add ebx, 0xffffe328
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
lea edx, [ebp + 0x57e]
mov dword [esp + 0x18], ecx
lea eax, [edi - 0x9e0]
xor edi, 0x3f7e
mov dword [esp + 0x1c], eax
lea eax, [edx + 0x5a1]
cmp ebx, eax
jge 0x406e0d
mov eax, dword [esi + 0xa4]
cmp eax, dword [esi + 0xf4]
ja 0x406df5
mov eax, 0xffffe061
sub eax, dword [esi + 0x60]
add dword [esi + 0x58], eax
mov eax, dword [0x7bb388]
xor eax, 0xfffffc70
sub dword [esi + 0x58], eax
sub edi, 0x65e
jmp 0x406ea8
mov eax, dword [esi + 0x94]
or eax, dword [esi + 0x8c]
cmp dword [esi + 0x1c], eax
ja 0x406ea8
mov edx, dword [esi + 0x74]
imul edx, dword [0x7bb354]
mov eax, dword [0x79d454]
or edx, dword [eax + 0xfc]
mov eax, dword [esi + 0xac]
sub eax, dword [esi + 0xf4]
imul ecx, eax, 0x18f2
mov eax, dword [esp + 0x18]
sub eax, dword [0x7bb2b0]
push eax
lea eax, [ebp + 0xbe5]
push ecx
lea ecx, [ebp - 0x1374]
or eax, ecx
or eax, dword [esp + 0x24]
push eax
push edx
push esi
call fcn.0040715f
mov ebx, eax
add esp, 0x14
lea ecx, [ebx + 0x1db8]
push ecx
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov ecx, dword [0x7bb2c8]
lea eax, [ebp - 0x1374]
xor ecx, eax
lea eax, [ebp + 0xbe5]
or ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x18]
lea edx, [ebp + 0x57e]
lea eax, [ebp + 0x964]
cmp edx, eax
je 0x406f71
mov eax, dword [0x79d454]
mov dword [eax + 0x9c], 0x79d458
mov eax, ebx
xor eax, 0x1f59
push eax
lea eax, [ebp + 0xa44]
push eax
push ebp
lea eax, [ecx + 0x376]
push eax
mov eax, edi
xor eax, 0x65e
push eax
lea eax, [ebx + 0x1dfa]
push esi
push eax
call fcn.00403d6c
add esp, 0x1c
xor edx, edx
mov ecx, dword [esi + 0x3c]
sub ecx, dword [esi + 4]
mov eax, dword [esi + 0x64]
sub eax, 0x1513d7e
imul ecx, eax
mov dword [esi + 0x3c], ecx
mov eax, dword [0x7bb370]
mov ecx, dword [esi + 0xf4]
add eax, 0xfffffffd
xor dword [esi + 0xe0], eax
mov eax, dword [esi + 0x80]
add eax, 0xffe4f2a8
add eax, ecx
xor dword [esi + 0xf8], eax
mov eax, ecx
sub eax, dword [0x7bb384]
sub eax, 0x3ff2d
xor eax, ecx
mov ecx, dword [esi + 0xb8]
mov dword [esi + 0xf4], eax
mov eax, dword [0x79d454]
mov eax, dword [eax + 0x78]
xor dword [edx + ecx], eax
add edx, 4
mov ecx, dword [0x79d454]
mov eax, dword [esi + 0xbc]
add dword [ecx + 0x78], eax
cmp edx, 0x16d18c
jl 0x406ef6
lea eax, [edi - 0x2c0]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406f7c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add edx, 0x5fc
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, 0x3e21
push esi
mov esi, dword [esp + 0x18]
xor ebp, 0xfac
add esi, 0xffffec8c
mov dword [esp + 0x1c], ebp
push edi
mov edi, dword [esp + 0x30]
add edi, 0x349
mov dword [esp + 0x2c], ebx
lea eax, [esi + 0x22cc]
mov dword [esp + 0x30], edi
cmp esi, eax
jge 0x407041
mov eax, dword [0x79d454]
xor edx, 0x1b7
xor esi, 0x1b25
mov eax, dword [eax + 0xc0]
mov dword [ecx + 0x78], eax
lea eax, [edx - 0x918]
push eax
push esi
lea eax, [edi - 0xc8]
xor edi, 0x2ed
push eax
push edi
lea eax, [ebp + 0x122]
xor eax, 0xae0
push eax
lea eax, [edx - 0x6b]
push eax
push ecx
call fcn.00404692
add esp, 0x1c
add ebx, 0x2ae
cmp dword [0x7bb3a0], 0xf904
je 0x407152
mov eax, dword [0x79d454]
add dword [eax + 0x98], 0x179d65
jmp 0x407152
mov edi, dword [ecx + 0x68]
mov eax, edx
sub eax, ebp
mov dword [esp + 0x1c], edi
cmp edi, eax
je 0x407152
imul eax, esi, 0x1f5f
mov dword [esp + 0x14], eax
sub eax, edx
cmp edx, eax
jge 0x407133
mov esi, dword [ecx + 0xa0]
mov eax, ebp
and eax, 0x1374
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], eax
cmp esi, eax
jl 0x407133
mov ebp, dword [esp + 0x2c]
mov eax, dword [ecx + 0xf4]
xor eax, dword [esp + 0x30]
add eax, dword [0x7bb328]
xor dword [ecx + 4], eax
mov eax, dword [ecx + 0x4c]
sub eax, edx
add eax, 0x1e00
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
mov eax, dword [esp + 0x24]
mov esi, dword [0x7bb340]
mov edx, dword [0x7bb2e0]
mov ebx, dword [0x7bb39c]
xor edx, ebp
mov ecx, dword [eax + 0x10c]
or ebx, 0x171a
mov edi, dword [eax + 0xc4]
imul ecx, dword [0x7bb348]
mov eax, dword [0x79d454]
and edi, dword [0x7bb3b4]
imul esi, ebp
and edi, 0x1374
mov eax, dword [eax + 0xe0]
imul ecx, ebp
sub eax, 0x22cf
push eax
push ecx
push edx
push esi
push edi
push ebx
push dword [esp + 0x3c]
call fcn.00404692
mov ecx, dword [esp + 0x40]
mov edx, eax
mov eax, dword [esp + 0x44]
add esp, 0x1c
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [esp + 0x10]
jge 0x407089
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, edx
add edi, 3
sub ecx, ebp
cmp edi, ecx
mov dword [esp + 0x1c], edi
mov ecx, dword [esp + 0x24]
jne 0x40705e
mov ebx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
lea eax, [ebx - 0x376]
pop ebx
pop ecx
pop ecx
ret
Function at 0x407464
Capabilities:
Accept command line arguments
Delete file

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea edx, [ecx - 0x1374]
push edi
lea edi, [ecx + 0x7b1]
add esi, 0xfffff82c
mov eax, edi
mov dword [esp + 0x20], esi
xor eax, 0xe86
add ebx, 0xfffff920
add ecx, 0x3a6
cmp esi, eax
je 0x407571
mov eax, edi
xor eax, 0x3b04
cmp esi, eax
je 0x40750e
sub esi, 0x177
xor ecx, 0xc3f
lea eax, [esi + 0x35e]
push eax
lea eax, [ebx + 0xbb5]
push eax
mov eax, dword [esp + 0x30]
add eax, 0x815
push eax
mov eax, esi
xor eax, 0xca2
push eax
push ecx
push dword [esp + 0x2c]
call fcn.004068f5
mov eax, dword [0x79d454]
add esp, 0x18
xor esi, 0xafc
mov ecx, dword [eax + 4]
sub ecx, dword [eax + 0xf4]
add ecx, 0x1e9e88
xor dword [0x7bb2ec], ecx
jmp 0x407591
mov ebp, dword [esp + 0x18]
lea eax, [ecx - 0x1dfa]
mov ebx, dword [ebp + 0x98]
cmp ebx, eax
jle 0x407591
lea edx, [esi - 0x15a3]
xor edi, 0x2021
mov dword [esp + 0x14], edx
mov esi, eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [0x7bb398]
push edi
add eax, ecx
or ecx, dword [0x7bb2b4]
push eax
push edx
add ecx, 0x1f5f
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, dword [esp + 0x14]
add ebx, 2
cmp ebx, esi
jg 0x407534
mov esi, dword [esp + 0x20]
jmp 0x407591
mov ecx, dword [0x79d454]
mov eax, dword [ecx + 4]
add eax, edx
cmp dword [ecx + 0x1c], eax
jae 0x407591
xor edx, 0x22cc
imul edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
lea eax, [esi - 0x845]
pop esi
pop ebp
pop ebx
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x7a94aa9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4f2a7d65
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x410f5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42104c]
jne 0x413fe3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x422720], eax
mov dword [0x42271c], ecx
mov dword [0x422718], edx
mov dword [0x422714], ebx
mov dword [0x422710], esi
mov dword [0x42270c], edi
mov word [0x422738], ss
mov word [0x42272c], cs
mov word [0x422708], ds
mov word [0x422704], es
mov word [0x422700], fs
mov word [0x4226fc], gs
pushfd
pop dword [0x422730]
mov eax, dword [ebp]
mov dword [0x422724], eax
mov eax, dword [ebp + 4]
mov dword [0x422728], eax
lea eax, [ebp + 8]
mov dword [0x422734], eax
mov eax, dword [ebp - 0x320]
mov dword [0x422670], 0x10001
mov eax, dword [0x422728]
mov dword [0x422624], eax
mov dword [0x422618], 0xc0000409
mov dword [0x42261c], 1
mov eax, dword [0x42104c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x421050]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x422668], eax
push 1
call fcn.00415efd
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402cf0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x422668], 0
jne 0x4140cf
push 1
call fcn.00415efd
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x412edd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x412eec
pop dword [ebp - 0x50]
mov eax, 0x401d49d1
sub eax, 0x3fdc1ae5
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3ab0a
push 0
mov eax, 0x9c67bd10
add eax, 0x63d85410
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x351045b0
add ecx, 0xcaf0024a
xor esi, esi
add esi, eax
mov edx, 0x1db216f9
sub edx, 0x1d6fa0f9
add edx, dword [ebp - 0x50]
mov edi, 0x3f00867e
xor dword [ebp - 0x4c], ecx
mov ebx, dword [edx]
add dword [ebp - 0xc], 0xc1c5624
xor ebx, edi
add dword [ebp - 0x30], ebx
mov dword [esi], ebx
xor dword [ebp - 0x14], edx
add esi, 4
add edx, 4
loop 0x412f47
add eax, 0xaba06643
sub eax, 0xab9f5388
xor ebx, ebx
add ebx, eax
add eax, 0x348488db
add eax, 0xcb7b772a
mov ecx, 0x53775396
sub ecx, 0x53375396
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x414eda
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42104c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004138c7
and dword [ebp - 0x14], 0
cmp dword [0x422ab4], 0
mov dword [ebp - 0x18], eax
jne 0x414f8d
push 0x402da4
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x415035
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x402d98
push ebx
call edi
test eax, eax
je 0x415035
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push 0x402d88
push ebx
mov dword [0x422ab4], eax
call edi
push eax
call esi
push 0x402d74
push ebx
mov dword [0x422ab8], eax
call edi
push eax
call esi
push 0x402d58
push ebx
mov dword [0x422abc], eax
call edi
push eax
call esi
mov dword [0x422ac4], eax
test eax, eax
je 0x414f8d
push 0x402d40
push ebx
call edi
push eax
call esi
mov dword [0x422ac0], eax
mov eax, dword [0x422ac0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x414fe6
cmp dword [0x422ac4], ecx
je 0x414fe6
push eax
call esi
push dword [0x422ac4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x414fe6
test ebx, ebx
je 0x414fe6
call edi
test eax, eax
je 0x414fdd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414fdd
test byte [ebp - 8], 1
jne 0x414fe6
or dword [ebp + 0x10], 0x200000
jmp 0x415019
mov eax, dword [0x422ab8]
cmp eax, dword [ebp - 0x18]
je 0x415019
push eax
call esi
test eax, eax
je 0x415019
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x415019
mov eax, dword [0x422abc]
cmp eax, dword [ebp - 0x18]
je 0x415019
push eax
call esi
test eax, eax
je 0x415019
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x422ab4]
call esi
test eax, eax
je 0x415035
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x415037
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410f5c
leave
ret
Function at 0x100150c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051dcc
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10069008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 0x30]
mov edi, dword [eax + 4]
mov ecx, edi
mov dword [ebp - 0x28], edi
mov eax, dword [edi]
call dword [eax + 4]
push 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.100165d8
mov byte [ebp - 4], 1
mov ecx, dword [0x1006b090]
mov eax, dword [0x1006be5c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x10015157
push ecx
lea ecx, [ebp - 0x18]
call fcn.100165d8
cmp dword [0x1006b090], 0
jne 0x10015146
mov eax, dword [0x1006b078]
inc eax
mov dword [0x1006b078], eax
mov dword [0x1006b090], eax
lea ecx, [ebp - 0x18]
call fcn.10016630
mov ecx, dword [0x1006b090]
mov dword [ebp - 0x24], ecx
cmp ecx, dword [edi + 0xc]
jae 0x1001516c
mov eax, dword [edi + 8]
mov esi, dword [eax + ecx*4]
test esi, esi
jne 0x10015201
jmp 0x1001516e
xor esi, esi
cmp byte [edi + 0x14], 0
je 0x10015187
call fcn.10019f4a
mov esi, dword [ebp - 0x24]
cmp esi, dword [eax + 0xc]
jae 0x1001518b
mov eax, dword [eax + 8]
mov esi, dword [eax + esi*4]
test esi, esi
jne 0x10015201
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10015196
mov esi, eax
jmp 0x10015201
push 0x18
call fcn.100155a4
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x18]
test eax, eax
jne 0x100151b3
lea eax, [edi + 0x1c]
push eax
lea ecx, [ebp - 0x70]
call fcn.100039d0
lea eax, [ebp - 0x3c]
mov dword [esi + 4], 0
push eax
mov dword [esi], vtable.std::ctype_char_.0
call fcn.1001a54c
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
call fcn.10003a80
mov dword [ebp - 0x14], esi
push esi
mov byte [ebp - 4], 3
call fcn.10019f1e
mov eax, dword [esi]
add esp, 4
mov ecx, esi
call dword [eax + 4]
mov dword [0x1006be5c], esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.10016630
mov eax, dword [esi]
mov ecx, esi
push 0x20
mov eax, dword [eax + 0x20]
call eax
mov edx, dword [edi]
mov ecx, edi
mov byte [ebp - 0x1d], al
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x10015230
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10015557
mov esp, ebp
pop ebp
ret 4

Function at 0x10042aaf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10042760

Function at 0x10042aba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100428ea

Function at 0x10046da5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10046a22