joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc060
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x5d
push 0
push 0
dec ecx
jne 0x4bc068
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
lea eax, [ebp - 0x168]
mov edx, dword [0x408a8c]
call fcn.00405ea0
xor eax, eax
push ebp
push 0x4bc28d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x2ac]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043c5a0
mov eax, dword [ebp - 0x2ac]
mov edx, 0x4bc2a4
call fcn.00405810
je 0x4bc0cc
lea eax, [ebp - 4]
mov edx, 0x4bc2a4
call fcn.004056b4
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b0]
mov ecx, 0x4bc2b0
mov edx, dword [ebp - 4]
call fcn.00405700
mov eax, dword [ebp - 0x2b0]
call fcn.00405878
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
lea eax, [ebp - 0x2c0]
mov edx, ebx
mov cl, 4
call fcn.0041655c
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2d0]
call fcn.00417b58
lea edx, [ebp - 0x2d0]
pop eax
call fcn.00417b60
je 0x4bc217
jmp 0x4bc1fc
mov eax, dword [ebp - 0x2a8]
sub eax, 0x10
jne 0x4bc1c1
lea edx, [ebp - 0x2d4]
lea eax, [ebp - 0x27c]
call fcn.0040b1b4
mov eax, dword [ebp - 0x2d4]
mov edx, 0x4bc2bc
call fcn.00405810
je 0x4bc1fc
lea edx, [ebp - 0x2d8]
lea eax, [ebp - 0x27c]
call fcn.0040b1b4
mov eax, dword [ebp - 0x2d8]
mov edx, 0x4bc2c8
call fcn.00405810
je 0x4bc1fc
lea eax, [ebp - 0x2e0]
lea edx, [ebp - 0x27c]
mov ecx, 0x104
call fcn.00405658
mov ecx, dword [ebp - 0x2e0]
lea eax, [ebp - 0x2dc]
mov edx, dword [ebp - 4]
call fcn.00405700
mov eax, dword [ebp - 0x2dc]
call fcn.004bc060
jmp 0x4bc1fc
lea eax, [ebp - 0x2e8]
lea edx, [ebp - 0x27c]
mov ecx, 0x104
call fcn.00405658
mov ecx, dword [ebp - 0x2e8]
lea eax, [ebp - 0x2e4]
mov edx, dword [ebp - 4]
call fcn.00405700
mov eax, dword [ebp - 0x2e4]
call fcn.00405878
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x2a8]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4bc131
mov dword [ebp - 0x14c], ebx
lea eax, [ebp - 0x168]
call fcn.0040aac8
mov eax, dword [ebp - 4]
call fcn.0040af5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc294
lea eax, [ebp - 0x2e8]
mov edx, 6
call fcn.0040540c
lea eax, [ebp - 0x2d0]
mov edx, dword [0x401100]
mov ecx, 2
call fcn.00405fbc
lea eax, [ebp - 0x2b0]
mov edx, 2
call fcn.0040540c
lea eax, [ebp - 0x168]
mov edx, dword [0x408a8c]
call fcn.00405f70
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x4bc628
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x4bc6bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4bc6d4
mov edx, dword [ebp - 4]
call fcn.00405700
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.00405878
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a1a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc6c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040540c
ret

Function at 0x4bc7a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x4bc87e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4bc894
mov edx, dword [ebp - 4]
call fcn.00405700
mov eax, dword [ebp - 8]
call fcn.00405878
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4bc7ee.0
jmp dword [eax*4 + 0x4bc7f5]
mov eax, ebx
mov edx, 0x4bc8a0
call fcn.0040543c
jmp 0x4bc863
mov eax, ebx
mov edx, 0x4bc8b0
call fcn.0040543c
jmp 0x4bc863
mov eax, ebx
mov edx, 0x4bc8c0
call fcn.0040543c
jmp 0x4bc863
mov eax, ebx
mov edx, 0x4bc8d4
call fcn.0040543c
jmp 0x4bc863
mov eax, ebx
mov edx, 0x4bc8e4
call fcn.0040543c
jmp 0x4bc863
mov eax, ebx
mov edx, 0x4bc8f8
call fcn.0040543c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc885
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040540c
ret

Function at 0x4bcab0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x4bcb49
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4bcb60
mov edx, dword [ebp - 4]
call fcn.00405700
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.00405878
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, pe_nt_image_headers32
call fcn.00405658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcb50
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040540c
ret
Function at 0x4bf024
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x4bf165
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4bf135
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405878
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a7ac
test al, al
jne 0x4bf0a5
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403858
lea eax, [ebp - 0x1d0]
call fcn.004035f4
call fcn.004030d4
push dword [0x4cde08]
push 0x4bf17c
push dword [0x4cde0c]
push 0x4bf17c
push dword [0x4cde10]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.0040577c
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004b98d4
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405b98
call fcn.00403f50
call fcn.004030d4
lea eax, [ebp - 0x1d0]
call fcn.00403920
call fcn.004030d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf13f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf16c
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040540c
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x117fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x118b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01176e52
and dword [ebp - 0x14], 0
cmp dword [0x11cd558], 0
mov dword [ebp - 0x18], eax
jne 0x117fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x117fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x117fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x11cd558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x11cd55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x11cd560], eax
call edi
push eax
call esi
mov dword [0x11cd568], eax
test eax, eax
je 0x117fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x11cd564], eax
mov eax, dword [0x11cd564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x117fc78
cmp dword [0x11cd568], ecx
je 0x117fc78
push eax
call esi
push dword [0x11cd568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x117fc78
test ebx, ebx
je 0x117fc78
call edi
test eax, eax
je 0x117fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x117fc6f
test byte [ebp - 8], 1
jne 0x117fc78
or dword [ebp + 0x10], 0x200000
jmp 0x117fcab
mov eax, dword [0x11cd55c]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x117fcab
mov eax, dword [0x11cd560]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x11cd558]
call esi
test eax, eax
je 0x117fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x117fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.011713cb
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40bcaa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49f390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov word [ebp - 0x1c], 0x2f
mov word [ebp - 0x1a], 0x2f2f
mov word [ebp - 0x18], 0x2f22
mov word [ebp - 0x16], 0x3a
mov word [ebp - 0x14], 0x2a
mov word [ebp - 0x12], 0x3f
mov word [ebp - 0x10], 0x3c
mov word [ebp - 0xe], 0x3e
mov word [ebp - 0xc], 0x7c
mov word [ebp - 0xa], 0x2f74
mov word [ebp - 8], 0x22
xor esi, esi
movzx eax, word [ebp + esi*2 - 0x1c]
push eax
push edi
call fcn.0046014f
test eax, eax
pop ecx
pop ecx
jne 0x40bd26
inc esi
cmp esi, 0xb
jb 0x40bcff
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045ed6b
leave
ret
xor al, al
jmp 0x40bd19

Function at 0x41a405
Capabilities:
Hash data with crc32

Disassembly:
test edx, edx
push 0xfffffffffffffffe
pop eax
jbe 0x41a42b
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
test ecx, 0x43308e8
mov ch, 0
cwde
dec eax
add byte [ecx + 0x4a], al
jne 0x41a40e
pop edi
pop esi
ret

Function at 0x41a41a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
test edx, edx
push 0xfffffffffffffffe
pop eax
jbe 0x41a42b
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
test ecx, 0x43308e8
mov ch, 0
cwde
dec eax
add byte [ecx + 0x4a], al
jne 0x41a40e
pop edi
pop esi
ret

Function at 0x41a42c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
xor ecx, ecx
cmp dword [esp + 8], eax
jbe 0x41a457
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4a1568]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x41a436
ret

Function at 0x41a899
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.0041a405
mov ecx, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0xc], edx
mov esi, eax
jle 0x41a8cb
lea eax, [edx + esi]
and eax, 0x3ff
mov al, byte [eax + 0x4aa2e0]
xor byte [ecx], al
inc ecx
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x41a8b4
mov eax, esi
pop esi
pop ebp
ret

Function at 0x41a8db
Capabilities:
Encode data using xor

Disassembly:
push edi
lea edi, [ecx + esi]
and edi, 0x3ff
mov bl, byte [edi + 0x4aa2e0]
xor byte [eax], bl
inc eax
inc ecx
cmp ecx, edx
jl 0x41a8dc
pop edi
pop ebx
mov ecx, dword [esp + 4]
call fcn.0041a405
sub eax, esi
neg eax
sbb eax, eax
inc eax
ret
Function at 0x41c1e1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov edx, ebx
mov ecx, edi
call fcn.0041a405
mov dword [ebp - 4], eax
xor eax, eax
test ebx, ebx
jbe 0x41c21c
mov esi, dword [ebp + 0xc]
add esi, 0x523
mov ecx, esi
and ecx, 0x3ff
mov cl, byte [ecx + 0x489800]
xor byte [eax + edi], cl
inc eax
inc esi
cmp eax, ebx
jb 0x41c205
xor esi, esi
test ebx, ebx
jbe 0x41c249
xor edx, edx
push 7
pop ecx
mov eax, esi
div ecx
mov bl, byte [esi + edi]
inc edx
mov ecx, edx
and ecx, 0x80000007
jns 0x41c23e
dec ecx
or ecx, 0xfffffff8
inc ecx
rol bl, cl
mov byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 8]
jb 0x41c222
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x41c250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x41c282
push 7
xor edx, edx
pop ecx
mov eax, esi
div ecx
mov bl, byte [esi + edi]
sub ecx, edx
and ecx, 0x80000007
jns 0x41c277
dec ecx
or ecx, 0xfffffff8
inc ecx
rol bl, cl
mov byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x41c25c
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
jbe 0x41c2ab
mov ecx, dword [ebp + 0x10]
add ecx, 0x523
mov esi, ecx
and esi, 0x3ff
mov bl, byte [esi + 0x489800]
xor byte [eax + edi], bl
inc eax
inc ecx
cmp eax, edx
jb 0x41c294
mov ecx, edi
call fcn.0041a405
sub eax, dword [ebp + 8]
pop esi
neg eax
sbb eax, eax
inc eax
pop ebx
pop ebp
ret
Function at 0x42f218
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x482966
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x49f390]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 1
call fcn.004324b3
call dword [0x485208]
mov dword [esp + 0x10], eax
jmp 0x42f27d
xor esi, esi
mov ebx, dword [0x485208]
call ebx
sub eax, dword [esp + 0x10]
cmp eax, 0x3e8
jb 0x42f2a2
call ebx
cmp dword [ebp + 8], esi
mov dword [esp + 0x10], eax
je 0x42f2a2
mov ecx, edi
call fcn.0042fc88
mov eax, dword [edi + 0x108]
cmp eax, esi
mov ecx, dword [edi + 0x104]
je 0x42f328
cmp eax, 0xffffffff
je 0x42f328
cmp ecx, esi
push 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
pop eax
je 0x42f2cb
cmp ecx, 0xffffffff
jne 0x42f2ce
xor eax, eax
inc eax
push 1
push 0x64
push esi
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [0x48512c]
cmp eax, esi
je 0x42f328
cmp eax, 1
jne 0x42f27d
cmp dword [esp + 0x20], esi
je 0x42f2f8
push dword [esp + 0x20]
call fcn.0045ed66
pop ecx
cmp dword [esp + 0x30], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
je 0x42f314
push dword [esp + 0x30]
call fcn.0045ed66
pop ecx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [edi + 0x140]
push eax
call dword [0x485310]
lea esi, [edi + 0x114]
mov ebx, esi
lea eax, [esp + 0x2c]
call fcn.004323cd
call fcn.004325f0
lea esi, [edi + 0x124]
mov ebx, esi
lea eax, [esp + 0x1c]
call fcn.00433208
call fcn.0043334c
lea eax, [edi + 0x140]
push eax
call dword [0x485330]
lea eax, [esp + 0x2c]
call fcn.0043257b
mov esi, eax
test esi, esi
je 0x42f39b
ja 0x42f384
call fcn.0045fdd7
test esi, esi
jle 0x42f39b
mov ebx, dword [esp + 0x30]
mov edx, ebx
mov ecx, edi
call fcn.004316d2
add ebx, 0x68
dec esi
jne 0x42f38c
cmp dword [esp + 0x20], 0
je 0x42f27b
mov esi, dword [esp + 0x24]
sub esi, dword [esp + 0x20]
sar esi, 6
je 0x42f27b
test esi, esi
ja 0x42f3c2
call fcn.0045fdd7
test esi, esi
jle 0x42f27b
mov ebx, dword [esp + 0x20]
mov edx, ebx
mov ecx, edi
call fcn.0043134e
add ebx, 0x40
dec esi
jne 0x42f3cc
jmp 0x42f27b

Function at 0x4390ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 8]
mov edi, eax
call fcn.0043937d
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040dba4
mov eax, dword [ebp - 4]
pop ecx
xor edx, edx
pop ecx
mov ecx, 0x14b
div ecx
xor eax, eax
inc dl
cmp dword [ebp + 8], eax
jbe 0x43912f
mov cl, al
add cl, dl
xor byte [eax + edi], cl
inc eax
cmp eax, dword [ebp + 8]
jb 0x439122
pop edi
leave
ret
Function at 0x439132
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 4
push dword [ebp + 0xc]
mov edi, eax
lea eax, [ebp - 4]
push eax
call fcn.0040dbc9
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 0x14b
div ecx
add esp, 0xc
xor eax, eax
inc dl
cmp dword [ebp + 8], eax
jbe 0x43916c
mov cl, al
add cl, dl
xor byte [eax + edi], cl
inc eax
cmp eax, dword [ebp + 8]
jb 0x43915f
push dword [ebp + 8]
call fcn.0043937d
pop ecx
xor ecx, ecx
cmp dword [ebp - 4], eax
pop edi
sete cl
mov al, cl
leave
ret

Function at 0x43937d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor edx, edx
push 0xa
or bl, byte [ebx - 9]
or esi, 0xffffffff
xor ecx, ecx
mov edx, 0xff
test eax, eax
mov dword [ebp - 4], eax
jbe 0x4393ca
xor eax, eax

Function at 0x4393f5
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x40394a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40396d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40396d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x403977
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4039b9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403a1b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x403a16
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x403a01
test dl, dl
je 0x4039fd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x403a01
add ecx, 2
add eax, 2
test dl, dl
jne 0x4039e1
xor eax, eax
jmp 0x403a06
sbb eax, eax
or eax, 1
test eax, eax
je 0x403a27
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4039ce
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x403ac4
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x403ae6
mov eax, 0xfffffffd
jmp 0x403bb8
cmp dword [0x86d000], 0
je 0x403b91
cmp dword [0x86d004], 5
jl 0x403b14
cmp dword [0x86d004], 7
jg 0x403b14
mov eax, 1
jmp 0x403b19
mov eax, 0
test eax, eax
jne 0x403b32
cmp dword [0x86d004], 0xfffffffb
je 0x403b32
xor eax, eax
jmp 0x403b37
mov eax, 1
test eax, eax
je 0x403b63
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x403b4c
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x86d000], 0
jne 0x403bae
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x403bb8
mov esp, ebp
pop ebp
ret 4

Function at 0x410176
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x410229
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x427a83
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
jmp fcn.00d955b0
Function at 0x428174
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x428228
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00428104
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x428201
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428234
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x42824f
test ebp, ebp
je 0x42824f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x428257
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x428297
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4282f3
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4282ee
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4282d9
test dl, dl
je 0x4282d5
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4282d9
add ecx, 2
add eax, 2
test dl, dl
jne 0x4282b9
xor eax, eax
jmp 0x4282de
sbb eax, eax
or eax, 1
test eax, eax
je 0x4282fd
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4282a6
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x428314
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00428174
test eax, eax
jne 0x42832c
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.00428234
mov esi, eax
test esi, esi
jne 0x428362
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x42837c
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret