joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409071
Capabilities:
Encode data using xor

Disassembly:
psubq xmm1, xmm0
movq xmm0, qword [esp + 0x20]
paddq xmm1, xmm0
mov eax, dword [esp + 0xc]
mov ecx, 0
movq qword [esp + 0x20], xmm1
add eax, dword [esp + 0x20]
mov dword [esi + 0x310], eax
adc ecx, dword [esp + 0x24]
push ecx
mov dword [esi - 0x2fffcec], ecx
add eax, 0x2cdd941d
in al, dx
inc edi
fiadd word [ebp - 0x3d]
cmp bh, byte [ecx - 0x708b948f]
xchg byte [ebp - 0x6b], bh
or eax, 0x45a18ba5
mov cl, 0x2d
aad 0x7c
in eax, 0x3d
xchg edi, eax
cmc
and ch, ah
xchg esp, eax
invalid
mov esp, dword [ecx - 0x2ad24ebb]
jl 0x409003
cmp eax, 0xec22f597
std
sbb ebp, dword [esi]
insd dword es:[edi], dx
xchg ebp, eax
xor byte ds:[ebp + eax*2 - 0x4a127af3], ch
jne 0x408fcf
cmc
stosb byte es:[edi], al
inc ebp
and al, 0xe1
or byte [ebp + 0x4e], cl
xchg ecx, eax
and dl, byte [esi]
cmp eax, 0x79ff282e
jge 0x40905c
daa
invalid
add eax, 0xcbb434ec
popfd
mov bl, 0x90
mov ebp, 0x62be46a8
adc byte [ebp - 0x638b3224], ch
inc ecx
pop esi
or al, 0x1c
aad 0xd6
xchg byte [edi], bh
lds esp, fs:[esi - 0x4fe2521]
pop ss
cmp al, byte [ebp + ebp + 0x1e]
movsd dword es:[edi], dword [esi]
jne 0x409016
adc dword [esi - 0x23c31cc2], ebx
cmp byte [edx + 0x4cddf145], bl
dec ebp
lodsb al, byte [esi]
mov dl, 0x85
mov eax, dword [0x323df6ed]
in eax, dx
test byte es:[edi], 0xfc
pop ss
lahf
fst dword [eax - 0x5c]
int3

Function at 0x40c561
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x418cb89a]
mov byte [0xab49f191], al
cdq
invalid
Function at 0x429651
Capabilities:
Execute syscall

Disassembly:
insd dword es:[edi], dx
pop eax
push 0x21
xor al, bh
or ecx, eax
cmp dword fs:[ebx + edi*2], ebx
cld
invalid
sbb ah, al
dec dh
std
cmp eax, 0xde8da899
outsd dx, dword [esi]
salc
and byte [esi + 0x724aaa4], cl
sti
les ebx, [edx + 0x557acb14]
test byte [edx], bl
inc ecx
aam 0xd8
mov al, 0xa2
dec eax
invalid
jg 0x4295de
jno 0x429614
mov edx, 0x74f887c1
ret 0x3423
wait
mov cl, 0x10
xchg esi, eax
fiadd dword [0x57ad4979]
clc
sbb edx, edx
xor al, 0x5c
imul ecx, edx, 0x29e3c9c3
loope 0x429609
movsb byte es:[edi], byte [esi]
cmp edx, dword [ecx]
fcmovb st(0), st(0)
inc edx
fnstsw word [ebx + 0x51]
out dx, al
dec ecx
mov dh, 0x18
jo 0x429685
or eax, 0x7d36186f
cli
outsd dx, dword [esi]
sbb byte [esi], dh
jge 0x429677
jae 0x4296f5
ja 0x429631
inc ebx
mov bh, 0xf3
dec eax
dec eax
xchg ecx, eax
or byte [esi + 0x3e325147], ah
sal byte [ecx - 0x7c], 0xe1
call 0x364a3e4f
sar dword [esi + 0x46d648e0], cl
jecxz 0x42962c
jbe 0x4296f2
inc edi
pushfd
fcom dword ss:[esi + 0x68d9294d]
xor edx, esp
mov ah, 0xc6
out dx, eax
inc esi
cdq
cmpsb byte [esi], byte es:[edi]
int 0x2e
fsubr qword [ebx]
xbegin 0xc8cf5ef4
add esp, eax
fcom dword [edi]
mov byte [ecx - 0x1f], ch
inc dword [esi + 0x3a]
test al, 0x7d
rol byte [ebp - 0x58], 1
xchg esi, eax
push cs
ret
movsd dword es:[edi], dword [esi]
pop eax
mov bh, 0xe0
pop esp
into
int3
Function at 0x43b381
Capabilities:
Encode data using xor

Disassembly:
shr byte [ebx - 0x46ed0438], cl
ret
inc ebx
mov al, byte [ebx]
cli
xchg dword [ebx + 0x431be21e], eax
cmpsb byte [esi], byte es:[edi]
mov dl, 4
pop es
or al, 0xae
mov byte [0x96fa27d5], al
pop edx
jl 0x43b3e1
and dword [edi + 0xf17f65e], ebp
loope 0x43b3d4
out dx, al
cmpsd dword [esi], dword es:[edi]
xor dh, ah
in eax, 0xb1
jb 0x43b348
or eax, 0x59b280a6
cmpsb byte [esi], byte es:[edi]
xor byte [edx - 0x7ab799a7], 0x70
jne 0x43b3ad
pop ecx
dec ax
test dword [eax + 0x75], esi
stc
wait
mov esp, 0xccaaceb1
inc ecx
aas
test dword [edx], edx
fmul st(0)
or ebp, dword [edi]
salc
jle 0x43b3aa
jg 0x43b3cf
xor al, 0xa3
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
xor esi, dword [esi - 0x1c]
mov dl, byte [0xf0a6e062]
adc eax, 0xf0a6e062
xchg byte [ecx + 0x688d6c7b], cl
invalid
mov ch, 0x46
xor cl, al
push es
xor byte [edx + ebp*2 - 0x72], 0xf8
int 0x59
mov dh, 0xb0
and edi, 0x3c
push edx
movsd dword es:[edi], dword [esi]
xchg edi, eax
nop
push 0x72
pop es
and eax, 0xf89c005
mov ah, 0xe1
sub dl, byte [ebx + 0x7bb41ebf]
or bl, byte [ebx]
movsb byte es:[edi], byte [esi]
xchg ebx, eax
nop
invalid
Function at 0x4521c1
Capabilities:
Encode data using xor

Disassembly:
jae 0x4521ba
jmp 0x4521b5
dec edx
jp 0x452167
cmpsb byte [esi], byte es:[edi]
test dword [eax + 0x3f], eax
int3
iretd
enter 0x5dd0, 0xffffffffffffffbd
sbb ch, ch
in eax, dx
jle 0x45218d
mov esi, 0xd98cac75
ret 0x72ff
fld st(2)
push dword [edx - 0x38]
bswap eax
push ebx
fiadd dword [eax - 0x5be6b9c4]
pop es
mov ebp, 0x1fbca3c7
stc
test esi, ebx
wait
mov dh, 0x92
fstp xword [ebp - 0x344a6ce7]
fst dword [edx + edi*4 - 0x65e037de]
jb 0x45216a
push ebx
fimul dword [edi]
je 0x45220a
aam 0xb1
sub byte [0x4997f46], bh
popfd
xor dword [edi + edi*4 - 0x78], esp
lodsd eax, dword [esi]
pop ss
xchg ebp, eax
xchg dword [ecx], eax
invalid
and al, 0xc8
mov esp, 0x7dfc5104
insd dword es:[edi], dx
sar dword [ebx - 0x15593c3f], 1
cdq
insd dword es:[edi], dx
mov dh, 0x2a
pop edx
invalid
Function at 0x4679d1
Capabilities:
Encode data using xor

Disassembly:
shl byte [esi - 0x572149b4], cl
bound edi, qword [ebp - 0x15]
pop ds
mov ebp, 0xdbea1ab4
jle 0x4679b4
and bl, byte [edx]
ret 0x308a
lcall 0xd276, 0x50647b92
sal al, 0xcb
and edi, dword [ebp - 0x486f0a41]
pop ecx
adc edi, dword [edx]
add cl, byte [eax - 0x46]
mov al, byte [0x5ee6e143]
stosd dword es:[edi], eax
cmp bh, byte [edx + 0x59]
out dx, al
call 0x7b03855a
cli
xor esi, dword [ebp - 0x464ec9c3]
dec ecx
ror byte [ecx + 0x22], 0xab
adc dword [ecx + ebp*4], ebx
aaa
test dword [edx - 0x61ed951c], ecx
mov ch, 0x7a
jp 0x467a38
mov cs, word [ebx + 0x2c57ddd8]
out dx, al
push esp
xor ebp, dword [esi + 0x13b2e303]
add dl, byte [eax]
ror dword [0x410f808e], 0xc3
lcall 0x8070, 0x31664636
enter 0x3f2b, 0xffffffffffffffb5
push eax
movsd dword es:[edi], dword [esi]
pop esi
mov ah, 0x66
movsd dword es:[edi], dword [esi]
mov byte [0x28b579d1], al
mov ch, 0x19
mov ch, 0x36
xchg esi, eax
and al, 0xa4
jp 0x467995
fist word [ebp + 0x3dcdc15]
pop edi
cmp dword [eax - 0x4a4e6432], 0xffffffdd
lcall 0x31de, 0xe31e995d
pop esi
pop ecx
push eax
or byte es:[edx - 0x182e44d4], ch
invalid
Function at 0x4afb21
Capabilities:
Encode data using xor

Disassembly:
fisub dword [eax + 0x3a]
mov al, byte [0xe03aa01a]
pop ecx
jecxz 0x4afb65
mov dword [0x6339a319], eax
fsub dword [edx + 0x38]
mov byte [0xd738a218], al
pop edi
in eax, 0x3f
movsd dword es:[edi], dword [esi]
pop ds
movsd dword es:[edi], dword [esi]
aas
fist word gs:[ebp + 0x1f]
movsb byte es:[edi], byte [esi]
add esp, dword [edi + eax*2 + 0xfe40be4]
xor eax, 0x8d3e291e
fisub word [ecx - 0x58886ac3]
jnp 0x4afb40
mov bl, 0xe7
mul dword [esi + 0x153cb12f]
fmul qword [ecx]
bound edx, qword [0xddb29dba]
invalid
mov edx, 0xc7ddb29d
fisttp qword [edi - 0x39]
jl 0x4afb34
push edx
popal
inc edi
and dword [0x8a972157], ecx
int 0x4a
in al, dx
jnp 0x4afb29
xor dl, byte [esi + 0x5aaf9194]
sti
xchg dword [ebx + 0x71], esi
or dword [ecx + ebx*2], esi
out 0x4e, al
xor dword [esi - 0x2f], esp
or ebp, dword [esp + eax*8 - 0x80]
iretd

Function at 0x4bb0ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3370
cmp edx, dword [eax]
je 0x4bb110
add eax, 8
inc ecx
cmp eax, 0x4c3400
jl 0x4bb101
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3370]
jne 0x4bb23e
mov eax, dword [0x4c7a28]
cmp eax, 1
je 0x4bb218
test eax, eax
jne 0x4bb141
cmp dword [0x4c32b0], 1
je 0x4bb218
cmp edx, 0xfc
je 0x4bb23e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb178
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb800
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bba30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb1bb
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bba30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf9f0
push edi
call fcn.004bd200
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb800
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb810
lea eax, [ebp - 0xa0]
push 0x4bf9d0
push eax
call fcn.004bb810
push dword [esi + 0x4c3374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb810
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd174
add esp, 0x2c
pop edi
jmp 0x4bb23e
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3374]
push 0
push eax
push dword [esi]
call fcn.004bba30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40a090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40a09f
pop dword [ebp - 0x10]
mov eax, 0x94c9a9a9
sub eax, 0x9489090a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x37294eea
add dword [ebp - 0x20], 0x1728f661
mov dword [ebp - 0x1c], 0x9950249f
add dword [ebp - 0x1c], 0x98e327a6
mov dword [ebp - 0x18], 0xe0e62374
add dword [ebp - 0x18], 0x6b6620ba
mov dword [ebp - 0x14], 0xba661744
sub dword [ebp - 0x14], 0xba661744
lea eax, [ebp - 0x20]
push eax
mov eax, 0x31135d91
sub eax, 0x30d22d01
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x6babc65c
sub dword [ebp - 0x20], 0xf7395d06
mov dword [ebp - 0x1c], 0x85113396
sub dword [ebp - 0x1c], 0x43a4d221
mov dword [ebp - 0x18], 0x5a292d8e
add dword [ebp - 0x18], 0x9463ede
mov dword [ebp - 0x14], 0xe50476ed
add dword [ebp - 0x14], 0x1afb8913
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3d402
push 0
call eax
mov ecx, 0x52bf
xor edx, edx
add edx, eax
mov edi, 0xe6bb891b
add edi, 0x198616e5
add edi, dword [ebp - 0x10]
mov esi, 0x4315399b
xor dword [ebp - 8], 0x1cd90e0
mov ebx, dword [edi]
xor dword [ebp - 8], 0xccb06f82
add ebx, esi
xor dword [ebp - 0xc], 0x79137278
mov dword [edx], ebx
sub dword [ebp - 4], edi
add edx, 0x4de4bef8
sub edx, 0x4de4bef4
add edi, 0xe20d2ae3
add edi, 0x1df2d521
loop 0x40a1b2
add eax, 0x13dcf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa38f1c70
add ecx, 0x5cb0e390
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x410280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41029c
mov dword [eax], ecx
jmp 0x41029e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410310
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x401ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x401ee9
xor ecx, ecx
jne 0x401ee9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401f30
mov eax, dword [ebp - 0xc]
jmp 0x401f8d
cmp dword [ebp - 4], 1
je 0x401f43
cmp dword [ebp - 4], 2
je 0x401f43
mov eax, 0xd
jmp 0x401f8d
cmp dword [ebp + 0xc], 0
je 0x401f81
cmp dword [ebp - 8], 0
je 0x401f79
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x401f70
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x401f77
mov eax, 0xd
jmp 0x401f8d
jmp 0x401f81
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402120
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401ba0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401e10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40218b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x224]
jmp 0x40221c
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4021f1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402120
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4021e8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x228]
jmp 0x40221c
mov dword [ebp - 4], pe_nt_image_headers32
jmp 0x402192
lea ecx, [ebp - 0x14]
call fcn.00401d40
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00401c80
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret 4
Function at 0x404a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [edi]
dec ebp
stosb byte es:[edi], al
daa
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004035e6
js 0x404b37
and dword [ecx*4 - 0x72b7b], ebx
call dword [eax - 0x18]
pop ss
jmp 0x404add
invalid
invalid

Function at 0x4055c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
jne 0x4055c9
jmp 0x404f88
cmp dword [ebp - 0x37c], 0
je 0x4055d7
jmp 0x40568c
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x405630
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x405635
jmp 0x404f88
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x40567c
lea eax, [ebp - 0x714]
push eax
call fcn.004035f6
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004035ab
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x405687
jmp 0x40568c
jmp 0x404f88
cmp dword [ebp - 0x37c], 0
jne 0x405736
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004037c2
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x405722
lea eax, [ebp - 0x714]
push eax
call fcn.004035f6
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.0040368b
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409b20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
push 0
push 0x80
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x409c16
mov dword [ebp - 0x18], 0x100000
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
jne 0x409bfd
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409bfd
cmp dword [ebp - 0x10], 0
jbe 0x409bfd
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x409bdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
jmp 0x409b83
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
jmp 0x409c1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40af80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x40afa3
mov eax, 0xd
jmp 0x40b04a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b045
call fcn.00409c30
test eax, eax
je 0x40afc6
xor eax, eax
jmp 0x40b04a
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea ecx, [ebp - 0x254]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40b045
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0xffffffff
je 0x40b022
mov edx, dword [ebp - 0x238]
cmp edx, dword [ebp + 0xc]
je 0x40b022
mov eax, 0x5b6
jmp 0x40b04a
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a500
add esp, 0xc
test eax, eax
je 0x40b03e
xor eax, eax
jmp 0x40b04a
mov eax, 0x3ee
jmp 0x40b04a
mov eax, 2
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3ed1199a
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4c5e4ef5
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx