joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21f15b3
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not ebx
inc ecx
dec ebx
dec edx
mov dword [esp + esi - 0x583a0293], ebp
inc sp
and ecx, dword [esp + ebx - 0xff92]
inc ecx
imul ecx, ecx
dec esi
mov dword [esp + esi - 0x583a0293], esp
inc ebp
movsx esp, cx
dec edx
mov dword [esp + esi - 0x583a029b], 0x51867c2b
inc esi
xor dword [esp + esi - 0x583a0293], ebx
or dword [esp + ebx*2 - 0x1ff34], ebx
dec esi
mov esp, dword [esp + esi - 0x583a0293]
dec esi
imul edi, dword [esp + esi - 0x583a029b]
inc ebp
adc bh, dl
dec ebp
arpl bx, bx
inc ecx
movsx edx, dh
inc sp
sbb edx, ecx
jns 0x21d2333
mov ebx, 0x3da88e01
inc ecx
mov edx, dword [ebp + ebx - 0x3da88e01]
inc ecx
mov eax, dword [ebp + ebx - 0x3da88dfd]
inc esi
mov eax, dword [ebx + ebp - 0x3da88df9]
dec esi
lea ebp, [ebx + ebp - 0x3da88dfd]
inc esp
movsx ebx, bl
dec esp
lea ecx, [ebx + 0x6f9d321c]
inc ecx
div eax
dec esp
lea esi, [ebx + ebx*4 - 0x14d69e7b]
inc edx
mov dword [ebx + ebp - 0x3da88e01], edx
inc ebp
movzx edx, cl
jmp 0x20f24d5

Function at 0x2228877
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0xb2130827
dec ecx
imul dl
setb al
not ecx
xor dx, ax
dec dx
jp 0x22390e9
xor ebx, ecx
bts eax, 0xab
btc eax, eax
adc edi, ecx
cdq
xadd eax, edx
bts eax, eax
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, 0x497d4af
shr cx, 0x6e
mov ecx, dword [ecx + esi - 0x496fffb]
push 0x7308299f
push 0xb81c71a8
inc dword [esp + 3]
adc esi, 4
neg dword [esp]
div ecx
push 0x6e9fce1a
mov dword [esi], edx
mov dword [esi + 4], eax
call fcn.023096e5
mov cl, byte [esi + 2]
mov eax, 0x31b47939
lea eax, [eax + eax*8 - 0x2a72177d]
adc dl, cl
bts ax, ax
mov word [esi + 2], dx
sal al, 0xe1
movzx edx, al
neg dl
mov eax, dword [ebp + edx*2 - 0x1b4]
mov ecx, 0x6d8d0122
lea ecx, [edx*4 - 0xc64a954]
dec cx
xor eax, ebx
and dx, cx
dec edx
not ecx
rol eax, 1
neg ecx
neg eax
bswap edx
rol eax, 1
not edx
imul edx, edx
lea eax, [eax + edx*2 + 0x45969703]
xor ebx, eax
imul ecx, ecx
imul edx, edx
add edi, eax
mov edx, dword [ebp + edx - 0x1c000009]
rol cl, 0xc5
sbb ebp, 8
jmp fcn.0149aa47
mov dword [esp + edx - 0x4b49439e], eax
add edi, ecx
sal eax, 0x8e
mov dx, word [esi + eax - 0xcf80000]
movzx ecx, ax
push ecx
sar eax, 0x56
add cl, byte [esi + eax*2 - 0x64]
not ax
shr ax, 0xa1
xadd word [esp + eax - 0x7fe0], ax
lea esi, [esi + eax + 2]
sete byte [esp + eax + 4]
jl 0x2237a38
shl dx, cl
mov word [eax + esi], dx
shl eax, 0xba
adc dword [esp + eax*8], edi
ret 4
imul al
call fcn.014e6138
mov eax, 0xff9dcb29
lea edx, [eax + eax*2 + 0x1610e43e]
xor eax, 0xef8f5bb0
mov ecx, dword [esi + eax - 0x10129099]
je 0x14ccea4
sal dx, 0xcb
sbb dl, dh
mov edx, dword ss:[ecx + eax - 0x10129099]
lea ecx, [eax + eax*8 - 0xd441f48]
dec al
mov dword [eax + esi - 0x10129098], edx
call fcn.022f71eb
or dx, 0xa6a2
ror eax, 1
movzx ecx, dl
add dword [esp + ecx - 0xeb], ecx
neg eax
push edx
not ecx
ror eax, 3
add cl, 0xa4
adc dx, cx
sbb eax, 0xda81cf39
xor byte [esp + 4], 0x94
ror eax, 3
shl dx, 0x21
imul dx, cx
inc byte [esp + 5]
xor ebx, eax
add edi, eax
movzx eax, word [esp + 4]
mov dword [esp + eax*8 - 0x4ce0c], eax
mov dword [esp + eax - 0x99c2], edi
ret 4
Function at 0x222a83e
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movsx ebx, si
inc esp
movsx edx, dl
inc edx
xor dword [esp + edi*2 - 0xe832], ebp
inc ecx
pop esp
inc ecx
movsx ecx, dl
cwde
dec ecx
sub edx, ebx
dec eax
arpl bp, bp
dec eax
adc esi, ebp
dec esp
or esi, esi
inc ecx
jmp esi
inc eax
adc dl, ch
dec ebp
lea ebp, [ebp + ebx - 0x24000020]
call fcn.021c9724
inc ecx
inc eax
inc cx
sal ecx, 0xe4
dec esp
mov dword [esp + ebx - 0x24000024], esi
inc ecx
movzx ecx, dh
inc ecx
not eax
dec eax
and ecx, 0x2131134
movsx ebp, dx
inc ecx
neg eax
inc ecx
ror eax, 1
movsx eax, cx
sar ecx, 0x1b
dec esp
mov dword [esp + ebx - 0x24000024], esp
inc ebp
mov esp, edx
inc esp
xor dword [esp + edx], eax
inc ecx
pop esp
dec eax
sar ebp, 0xc9
push ecx
dec ebp
arpl ax, ax
dec ecx
adc esi, eax
dec esp
lea ecx, [edx*4 + 0x15890b85]
inc esp
movzx eax, ax
dec ebp
or edi, dword [ebp + ebx - 0x24000022]
push ecx
mul bp
inc ecx
xor cl, byte [ebp + ebx*2 - 0x4800003e]
dec ecx
shr edi, cl
cdq
dec dword [esp + ebx - 0x2400001d]
jg 0x148a9e8
dec ebp
mov dword [ebp + ebx*2 - 0x48000044], edi
dec eax
mul dword [esp + ebx - 0x24000023]
jae 0x149e016
Function at 0x222d273
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
call eax
mov edi, 0x69742ba
and di, 0xd00c
mov ebp, dword [ebp + edi - 0x697400c]
jmp 0x1504948
jmp 0x149e24b
xor byte [ebx + 0x13a1820a], ah
out dx, al
lea esp, [esp + 0xc]
je 0x14ed3c3
mov eax, dword [ebp + ebx*4]
push 0x58a5b5b9
mov ch, 0xa5
pop eax
mov dword [esp], eax
call fcn.022e7d31
sysenter
push edi
mov dword [esp], 0xb79521a9
call fcn.014ba244
test edx, ebx
or al, byte [ebp - 0x998ccce]
xchg byte [edx + 0x3d], bl
xor ebx, dword [ebx - 0x3a]
xchg byte [edx + 0x3d], bl
ja 0x222d283
sahf
xchg byte [edx + 0x3d], bl
jg fcn.0222d273
cli
xchg byte [edx + 0x3d], bl
ja 0x222d2ce
je 0x222d338
or byte [edx + 0x46650b02], dl
cdq
imul ebx, esp, 0x68b26b85
and byte [ecx + 0x29], cl
je 0x222d26c
fadd qword [ebp + 0x2068b26b]
dec ecx
sub dword [edx + ebx*4 - 0x2d], esi
or al, 0x55
test byte [edi + edx*2 + 0x68205618], 0x1e
ror dword [edx*2 + 0x18578cf6], cl
push esi
and byte [eax + 0x1e], ch
cmp eax, 0x681c63b0
push ds
cmp eax, 0x68245d94
push ds
cmp eax, 0x84529074
aas
sub byte [edi - 0x4f], cl
aam 0x3b
lcall 0x2134, 0xb3d0f4a
xchg edx, eax
xor edi, dword [0xcc46340b]
pop edi
cmp eax, 0xba12340b
pop ss
cmp eax, 0xe1aa340b
mov ecx, 0xcf9b59c3
mov al, 0x34
dec edi
inc eax
ror byte [ebp + 0x4273348c], cl
int1
sub byte [edx + ebx*4 + 0x73], dh
cli
mov ch, 0xf7
mov word [edi - 0x80], ss
mov ah, 0xcc
imul ebx, dword [esi], 0x84e5e43d
imul ebx, dword [esi], 0xe093c43d
imul ebx, dword [esi], 0x5340483d
test byte [edi], bh
adc bh, byte [edx + 0x340b3d17]
stosb byte es:[edi], al
loope 0x222d2c8
ret
push ds
cmp eax, 0x84534048
aas
push dword [esi - 0x79]
jbe 0x222d306
push esi
cmp dl, byte [eax]
std
sbb dl, ah
jne 0x222d35c
fsubr qword [eax]
lds esi, [ebx]
mov ebp, dword [edx]
mov dh, 0x3c
xchg esi, eax
movsb byte es:[edi], byte [esi]
xor dword [ebx - 0x89898d3], 0xa066399c
pushfd
cmp dword [esi - 0x60], esp
jne 0x222d395
adc ch, byte [edi + 0x53]
stosb byte es:[edi], al
invalid
test ebp, esi
int 0x93
sub al, dh
clc
dec ebp
inc edi
pop edi
cmp byte [esi], al
loopne 0x222d408
inc edx
jp 0x222d3b0
xor bl, byte [edi + 0x7a]
out dx, eax
invalid
mov ecx, 0x60b05581
push 0x1fd6c987
and eax, edx
ja 0x222d3ff
salc
adc byte [eax + 0x3bec2237], al
lds esi, [esi]
jg 0x222d421
ret
add dword [esi + 0xd], eax
enter 0xffffffffffffc1ff, 2
inc esi
or eax, 0x2c1ffc8
mov edx, 0x7b74aa9
mov bh, 7
mov al, 0x71
or ebx, esp
pop dword [edi - 0x29]
into
into
jge 0x222d419
or eax, 0x54c1df9d
push esp
insb byte es:[edi], dx
xor esi, dword [eax]
retf 0xdf48
adc dword [esi], edi
cmp al, 0x7a
sub eax, 0xfc16c64e
fstp dword [esp + ebx*4]
pop ebx
xchg dword [esi - 0x61], eax
push ebp
fcmovnb st(0), st(4)
mov esi, dword [esi + ebp*2 - 0x76]
sbb byte [ebp - 0x4a], ah
mov esi, ebp
clc
xlatb
paddsw mm1, qword [ecx]
wait
cmc
pop ds
sub dl, cl
scasd eax, dword es:[edi]
dec edx
in eax, 0x74
or al, byte [ecx - 0x5e]
test dword ss:[eax], ebp
jae 0x222d3fe
pop esi
wait
or bl, byte [edi]
test byte [ebx], bl
xchg ebp, eax
fdivr dword [edi - 0x66ddd52f]
fsub dword [ecx + 0x40]
xchg dword [esi], esp
retf 0x46ed
Function at 0x225748b
Capabilities:
Encrypt data using chaskey

Disassembly:
push eax
ror dl, 1
sub al, ah
jle 0x22081e1
adc dl, 0x9e
rol word [esp + eax*8 - 0x1b701], 0xcc
xor bl, dl
bt eax, eax
and byte [esp + eax - 0x36da], 0xa6
lea edx, [esp + edx + 0x10]
sar dword [esp + eax - 0x36e1], 0x9c
or dword [esp + eax - 0x36de], 0x2a238e27
or al, byte [esp + eax*4 - 0xdb76]
mov dword [eax + edx - 0x36e1], ecx
mov dword [esp + eax*8 - 0x1b708], edi
ret 0xc
mov ecx, dword fs:[edx + eax*2 - 0x3618]
movzx edx, byte [ebp + eax - 0x1b11]
add eax, eax
lea ebp, [ebp + eax - 0x361d]
push eax
xor dl, bl
dec eax
neg dl
bt eax, eax
mov dword [esp + eax*2 - 0x6c2a], 0x8eb7d83e
shl dword [esp + eax*2 - 0x6c2c], 0x22
dec dl
sal dword [esp + eax*4 - 0xd858], 0xc1
jle 0x21d3a58
Function at 0x2311d72
Capabilities:
Encode data using xor

Disassembly:
dec edx
jmp 0x2257563
xor bx, cx
and ax, word [esp + eax]
xchg dword [esp + eax], eax
bts edx, 0x86
mov word [esi + edx*2 - 0x86], cx
xchg dword [esp + edx - 0x40], edx
imul word [esp + edx*2]
mul eax
sbb esi, 5
inc word [esp + 2]
xadd byte [esp + 1], al
pop ecx
jge fcn.01499eee
inc ecx
neg ebx
inc ecx
inc ebx
dec esp
mov dword [esp + ecx - 0x13812fbf], esp
call fcn.014d3893
mov edx, 0x6ea5a706
neg edx
sbb ebp, 3
mov edx, dword [ebp]
mov ecx, 0xc507cf25
sub cx, cx
ror ecx, 0xbd
xor edx, ebx
dec edx
bts ecx, 0x8e
bswap edx
xor cl, ch
shr ecx, cl
ror edx, 3
jmp 0x21e9059
dec cx
mul edx
add byte [esp + edx*2 + 2], ah
not cx
adc cx, 0xcc10
xor al, dl
rol cx, 1
cwde
or edx, eax
xor cx, 0xce91
jmp 0x2229c1b
not cx
sal cx, 0x8f
xor ebx, edx
bt ecx, ecx
rol cl, 5
sbb cx, cx
adc edi, edx
push ecx
mov edx, 0x3b2b6ab9
lea edx, [edx + edx - 0x256d71de]
mov ecx, dword [esi + ecx - 0xa00000]
add dx, word [esp + edx - 0x50e96393]
mov edx, dword [esi + edx - 0x50e90390]
jnp 0x223dc14
add dword [esi + 0x76], edx
push ds
invalid
neg ecx
cdq
add ecx, edx
shr edx, 0x1f
and word [esp + edx - 1], 0x1291
cwd
neg ecx
xor ebx, ecx
shl edx, 0xb4
shl word [esp + edx*4 + 1], 0x27
mov dword [esp + edx], eax
adc edi, ecx
div eax
div dword [esp + eax - 1]
movzx ecx, word [ebp + edx - 7]
or edx, eax
idiv dl
lea ebp, [ebp + eax*4 - 6]
cwd
xor cx, bx
shl ax, 0x21
cdq
jp 0x225416b
mov dword [esi + ecx - 0x4f820a5c], edx
mov edx, 0xf4805889
mov ecx, dword [ebp + ecx - 0x4f820a5c]
neg ax
xor ecx, ebx
btc edx, edx
lea ecx, [ecx + eax - 0x6402fd47]
mov dword [esp], edx
xor ecx, 0x6591de36
not dx
jmp 0x225e3d5

Function at 0x23129bf
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + eax*4 - 0x2a9c3fb8], edi
ret 8
mov dword [esp + eax*4 - 0x2a9c3fb8], 0xbfa8eb94
mov cl, byte [esi + eax - 0xaa70fec]
shr edx, cl
push eax
shl dword [esp + eax - 0xaa70fe6], 0x10
mov dword [esi + eax*4 - 0x2a9c3fb8], edx
cdq
jne 0x1490697
Function at 0x428dfa
Capabilities:
Check for software breakpoints

Disassembly:
jno 0x428dda
pop ds
add al, byte [eax]
insd dword es:[edi], dx
aas
jecxz 0x428e44
invalid
sub byte [eax], 0xf6
out 0xf0, al
mov cs, ebp
out dx, al
imul edx, dword [ecx - 0x48], 0x19
mov esp, 0xfacd4815
inc edx
jg 0x428e4c
enter 0xac9, 0xffffffffffffff98
xchg ecx, eax
mov edx, 0x17d67b99
jnp 0x428dce
pop ss
fst dword [ecx + 0x483565e8]
fdiv dword [eax + ecx*2]
xchg ecx, eax
call 0xd88ac365
xor al, 0x48
pop eax
shr dword [esi], 1
cmp dh, byte [eax - 0x55]
xchg edi, eax
sbb ch, byte [ecx]
popfd
inc edi
dec ebp
jo 0x428e36
mov esi, 0x761b4d1f
mov ebp, 0x8bb81d74
mov byte [0x71f0bbcb], al
adc eax, 0xffffff96
pop eax
push es
invalid
jno 0x428df6
sbb al, 0xbe
dec ecx
test byte [edx - 0x4d153972], bl
xchg edi, eax
loopne 0x428eac
fld st(5)
cmp eax, 0x4c823d6a
invalid
pop ebx
and al, 0xf0
sbb edx, dword [ebx - 0x35]
cmp al, 0xcc
mov bh, 0xee
pop es
imul esi, dword [ecx], 0xffffff8d
fisttp word [ebp - 0x36]
stosb byte es:[edi], al
shr dword [edi - 0x69], 1
xlatb
mov ebx, edx
inc edi
or byte [edi + 0x35], ch
mov eax, 0x7892372a
call eax
aam 0x35
ret 0x6ebd
neg dword [edi]
insd dword es:[edi], dx
div ebp
outsb dx, byte [esi]
mov ss, eax
mov eax, 0xc19da3a2
and edi, dword [eax + 0xb]
sub al, 0x89
call 0x49c0629d
sar byte [0xbc654669], 1
mov ebp, 0xaffb692f
push ds
fnstcw word [esi - 1]
mov ebx, 0x8281f0ff
rcr byte [0x6dc8d984], 1
lodsb al, byte [esi]
neg byte [edi]
clc
sub eax, 0xaf13eefd
loope 0x428edd
js 0x428f1b
xchg ecx, eax
sar byte [eax], 0xb9
rcl byte [esi + 0x6b92cbe5]
sub esi, eax
xchg esi, eax
in eax, 0xcb
xchg edx, eax
imul ebp, dword [ebx], 0xfffffff0
int1
pushfd
xchg ebx, eax
aas
sub edx, dword [edx]
ja 0x428eef
pop eax
fisubr word [edi + 0x2ad60cdf]
jo 0x428f10
inc dword [edi + 0x78]
push 0x54e0d01a
hlt
push eax
das
cmp esp, ebp
xchg byte [0xf2a82f26], ah
pop esp
loopne 0x428f5e
fistp word [eax + 9]
cli
cmp al, 0x3c
sbb dword [eax + eax*2 + 0x37], eax
loop 0x428f92
pushal
arpl word [edi], ax
iretd
invalid
dec edx
ret 0xcb38
Function at 0x627585
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x62e3d0
cmp edx, dword [eax]
je 0x6275a7
add eax, 8
inc ecx
cmp eax, 0x62e460
jl 0x627598
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x62e3d0]
jne 0x6276d5
mov eax, dword [0x636d78]
cmp eax, 1
je 0x6276af
test eax, eax
jne 0x6275d8
cmp dword [0x62e2f8], 1
je 0x6276af
cmp edx, 0xfc
je 0x6276d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62760f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00627f70
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628400
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627652
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628400
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62c6e4
push edi
call fcn.0062a2d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00627f70
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00627f80
lea eax, [ebp - 0xa0]
push 0x62c6c4
push eax
call fcn.00627f80
push dword [esi + 0x62e3d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00627f80
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a244
add esp, 0x2c
pop edi
jmp 0x6276d5
lea eax, [ebp + 8]
lea esi, [esi + 0x62e3d4]
push 0
push eax
push dword [esi]
call fcn.00628400
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x55921eed
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x36de6ee5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x41bce0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
add word [edi + 0x1b96c], 0xb
push edi
jmp 0x41bd02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41bd09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41bcf8
mov eax, 1
add ebx, ebx
jne 0x41bd1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41bd10
jne 0x41bd2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41bd10
xor ecx, ecx
sub eax, 3
jb 0x41bd40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41bdb2
mov ebp, eax
add ebx, ebx
jne 0x41bd4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41bd58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41bd7c
inc ecx
add ebx, ebx
jne 0x41bd68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41bd5d
jne 0x41bd79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41bd5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41bd9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41bd8d
jmp 0x41bcfe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41bd9c
add edi, ecx
jmp 0x41bcfe
pop esi
mov edi, esi
mov ecx, 0x12d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41bdba
cmp byte [edi], 2
jne 0x41bdba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41bdbf
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41be2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1bd58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1bdec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41bdec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1bdf4]
or eax, eax
je 0x41be28
mov dword [ebx], eax
add ebx, 4
jmp 0x41be09
call dword [esi + 0x1bdf0]
mov ebp, dword [esi + 0x1bdf8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41be62
sub esp, 0xffffff80
jmp 0x405a80
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064a1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x406491
pop esi
pop ebx
ret
Function at 0x401090
Capabilities:
Create process on windows

Disassembly:
push ecx
push 0x5cc278
push str.__________CALL_FINISH_PAGE_:__s
call fcn.00404cb0
add esp, 8
mov ecx, 0x5b87bf
mov eax, 0x5cc278
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4010d0
test dl, dl
je 0x4010cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4010d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4010b0
xor eax, eax
jmp 0x4010d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4010fc
push 5
push 0
push 0
push 0x5cc278
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push eax
push str.SHELL_RETURN_:__d
call fcn.00404cb0
add esp, 8
push 0
push 0
push 0x10
push dword [0x5cf76c]
mov dword [0x5cf7f0], 1
call dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
ret
Function at 0x40df50
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x40df99
mov al, byte [esi]
push eax
call fcn.0041d320
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x40df77
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x417b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x712], 0
je 0x417b83
cmp dword [edi + 0x1b0], 0
je 0x417b4d
push esi
push 1
push edi
call fcn.00409fa0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00409fa0
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x417b83
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x55a8c0
push 2
push eax
call fcn.00528240
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00528240
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x417f00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5c6a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov eax, dword [edx + 0xc]
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [eax + ecx*4 + 0x148]
push ecx
push eax
push edx
mov dword [ebp - 0x108], edx
call fcn.00418380
add esp, 0xc
test eax, eax
je 0x417f5b
pop edi
mov dword [esi], 0x1b
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518e98
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0x14]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x417fd8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x417fa0
xor edi, edi
mov dword [esi], 0x51
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518e98
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.00405cf0
push eax
push str.Send_failure:__s
push dword [ebp - 0x108]
call fcn.00417b90
mov eax, dword [ebp - 0x108]
add esp, 0x18
mov dword [eax + 0x964], ebx
mov dword [esi], 0x37
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00518e98
mov esp, ebp
pop ebp
ret