joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409764
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409818
jmp 0x40980d
cmp dword [esi + 0x10], 0x1000
jne 0x4097f9
test byte [esi + 0x15], 1
jne 0x4097f9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4097b8
cmp eax, 2
je 0x4097b8
cmp eax, 0x10
je 0x4097b8
cmp eax, 0x20
jne 0x4097cd
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4097cd
mov bl, 1
xor ebp, ebp
jmp 0x4097de
mov eax, dword [esi]
add eax, ebp
call fcn.0040975c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4097d1
test bl, bl
je 0x4097f9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409818
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409790
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xe05000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xe0500a
jmp 0xe0700f
jmp fcn.00a68058
Function at 0x401c4c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c8b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c8b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c8b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c8b
cmp dword [ecx + 0x74], 0xe
jbe 0x401c8b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0xa3e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa3e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa3e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3e06a
add dl, dl
jne 0xa3e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3e0dc
xor eax, eax
add dl, dl
jne 0xa3e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3e17d
add dl, dl
jne 0xa3e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa3e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa3e075
mov eax, 1
add dl, dl
jne 0xa3e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3e0e1
sub eax, ebx
mov ebx, 1
jne 0xa3e128
mov ecx, 1
add dl, dl
jne 0xa3e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa3e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa3e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa3e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3e136
cmp eax, 0x7d00
jae 0xa3e16d
cmp eax, 0x500
jb 0xa3e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3e075
cmp eax, 0x7f
ja 0xa3e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa3e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa3e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40854c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4085e9
push ebx
push esi
call fcn.00408515
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040845e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408596
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4085e8
push edi
push eax
call fcn.0040914f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4085b6
call fcn.00405e61
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4085e7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040845e
add esp, 0x20
test eax, eax
jne 0x4085d5
push edi
call fcn.00405e61
jmp 0x4085dd
push ebx
call fcn.00405e61
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4098d2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411dc0
push 0x411db8
push str.FlsAlloc
push 0x1e
call fcn.00409793
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409906
push dword [ebp + 8]
mov ecx, esi
call dword [0x41011c]
call esi
jmp 0x40990c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409950
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411dd0
push 0x411dc8
push str.FlsGetValue
push 0x20
call fcn.00409793
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409987
push dword [ebp + 8]
mov ecx, esi
call dword [0x41011c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1002aee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ecx, ecx
push edi
mov dword [ebp - 4], ecx
lea edi, [ecx + 1]
mov esi, 2
lea edx, [esi + 1]
mov eax, 0xf0f0f0f1
mul edx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100e20ab]
xor al, byte [esi + 0x100e205e]
movzx ebx, al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100e20aa]
xor al, byte [edi + 0x100e205e]
add esi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100e20a9]
xor al, byte [ecx + 0x100e205e]
add edi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100e20a8]
xor al, byte [ecx + 0x100e205d]
add ecx, 4
movzx edx, al
add bx, dx
add word [ebp - 4], bx
cmp esi, 0x22
jb 0x1002aef4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 4]
mov edx, dword [0xd227b0]
mov esi, dword [0x1007b068]
shr ecx, 8
add cl, 0x1a
mov byte [0x104b1fc0], cl
lea ecx, [ebp - 4]
push ecx
sub al, 0xf
push 0x40
mov byte [0x104b1fc1], al
mov eax, dword [0xd227f8]
push 4
push 0xd227b0
mov dword [0x104b1fc8], edx
mov dword [0x104b1fc4], eax
call esi
lea edx, [ebp - 4]
push edx
mov dword [0xd227b0], 0x1002ac10
mov eax, dword [ebp - 4]
push eax
push 4
push 0xd227b0
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0xd227f8
call esi
lea edx, [ebp - 4]
push edx
mov dword [0xd227f8], 0x1002ac70
mov eax, dword [ebp - 4]
push eax
push 4
push 0xd227f8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004e5a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x100e14cc]
jns 0x1004e5ad
jmp fcn.1004e620
mov eax, dword [0x100e14c8]
mov ecx, dword [eax]
add eax, 4
mov dword [0x100e14c8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x1005e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b797c]
mov eax, str.DataLocalEffectTRSData.bmd
call fcn.10001140
test al, al
je 0x1005ea26
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalEffectTRSData.bmd
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005ea26
push 0
push edi
call dword [0x1007b044]
cmp eax, 0xa2b20
je 0x1005ea3c
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.100784a0
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xa2b20
lea esi, [ebx + 0x211bec]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005ea1f
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0xa2b20
jb 0x1005ea64
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.100784a0
mov esp, ebp
pop ebp
ret

Function at 0x1005eaa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b7980]
mov eax, str.DataLocalTooltipTRSData.bmd
call fcn.10001140
test al, al
je 0x1005eb16
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalTooltipTRSData.bmd
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005eb16
push 0
push edi
call dword [0x1007b044]
cmp eax, 0x103140
je 0x1005eb2c
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.100784a0
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x103140
lea esi, [ebx + 0x2b470c]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005eb0f
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0x103140
jb 0x1005eb54
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.100784a0
mov esp, ebp
pop ebp
ret
Function at 0x1005eb90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b7984]
mov eax, str.DataLocalMakeWorldTRSData.bmd
call fcn.10001140
test al, al
je 0x1005ec06
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalMakeWorldTRSData.bmd
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005ec06
push 0
push edi
call dword [0x1007b044]
cmp eax, 0x12c
je 0x1005ec1c
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.100784a0
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x12c
lea esi, [ebx + 0x3b784c]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005ebff
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0x12c
jb 0x1005ec44
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.100784a0
mov esp, ebp
pop ebp
ret

Function at 0x1005ec80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b7978]
mov eax, str.DataInterfaceonject0001.ozt
call fcn.10001140
test al, al
je 0x1005ecf6
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataInterfaceonject0001.ozt
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005ecf6
push 0
push edi
call dword [0x1007b044]
cmp eax, 0x211be8
je 0x1005ed0c
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.100784a0
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x211be8
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005ecef
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xda
mov byte [esi + eax], dl
inc eax
cmp eax, 0x211be8
jb 0x1005ed31
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.100784a0
mov esp, ebp
pop ebp
ret
Function at 0x10076e80
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10076e95
xor eax, eax
jmp 0x10076f0a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10076ec2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10076f05
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10076f03
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10076eff
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10076f03
xor eax, eax
jmp 0x10076f0a
jmp 0x10076eb9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1061f704
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1095d140
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp], edx
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0x1094b25d
jmp 0x10968576
jmp 0x1094b8ed
rdtsc
jmp 0x1094b8f4
jmp 0x1094b135
jmp 0x1094d02d
push edx
mov edx, esp
add edx, 4
push 0x24bbcd1b
mov dword [esp], eax
mov eax, 4
sub edx, eax
pop eax
xor edx, dword [esp]
xor dword [esp], edx
jmp 0x1094d051
xor edx, dword [esp]
pop esp
mov dword [esp], ebx
jmp 0x1094d05d
jmp 0x109546ae
jmp 0x1094d8d0
push esi
mov esi, esp
sub esp, 4
mov dword [esp], edi
mov edi, 4
add esi, edi
jmp 0x1094d8e8
mov edi, dword [esp]
add esp, 4
sub esi, 0x14
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
jmp 0x1094d94e
jmp 0x1094cf33
jmp 0x10954707
push 0x523bbc69
mov dword [esp], ecx
push edx
mov edx, 0x71555cb3
mov dword [esp + 4], edx
mov edx, dword [esp]
add esp, 4
mov dword [esp], ecx
jmp 0x109547d7
jmp 0x1096629a
push edx
push eax
push edi
mov edi, 0x51308e0e
mov eax, edi
mov edi, dword [esp]
add esp, 4
mov dword [esp + 4], eax
jmp 0x1095d1bc
pop eax
mov dword [esp], ebp
jmp 0x1095d256
jmp 0x1095e000
jmp 0x1095e066
sub esp, 4
push esp
pop dword [esp]
push esi
mov esi, 4
sub dword [esp + 4], 0x7fdf40ef
add dword [esp + 4], esi
add dword [esp + 4], 0x7fdf40ef
pop esi
pop ebp
jmp 0x1095e139
jmp 0x1094d83d
jmp 0x109662f7
push 0x15d25142
mov dword [esp], edi
push esi
mov esi, 0x7ec92f8c
mov dword [esp + 4], esi
pop esi
mov dword [esp], edx
jmp 0x109663c4
jmp 0x1094b7e1
jmp 0x1096861e
Function at 0x417698
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub al, 0xb
and al, 0x1b
add al, 0x5b
adc al, 0x3b
lodsb al, byte [esi]
invalid

Function at 0x417810
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417836
mov eax, dword [0x4b9aa0]
test eax, eax
je 0x41782c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4b9070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
add dh, bl
movsd dword es:[edi], dword [esi]
Function at 0x42671d
Capabilities:
Encode data using xor

Disassembly:
loope 0x426799
mov ecx, 0xb619301b
mov bh, 0xbe
add bh, bh
pop edx
jne 0x426721
xor byte [ecx], bl
mov dh, 0xb7
mov esi, 0x665aff02
jne 0x426721
mov byte [0x91b7fce8], al
out 0xce, eax
xor byte [ebp + ebp*2 + 0x21], 0x43
cmp eax, dword [ebx - 0x18]
in eax, dx
add dl, byte [ebp + 0x27bead09]
jle 0x42677d
jmp [ebx]
sar byte [edx + edx - 0x29], 1
and dword [edx - 0x74], ebp
and al, 0x3d
inc ecx
push esp
add byte [esi], 0xf7
stc
push esp
stosd dword es:[edi], eax
dec ebp
push 0xfffffffffffffff7
or eax, dword [ecx - 0x726a559b]
or edi, esi
aas
and dword [0x6f87470c], ebx
popfd
invalid
Function at 0x430f92
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00431185
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0043bcda
xor ebx, ebx
cmp eax, ebx
jne 0x431140
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00431185
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004389b9
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x48a2ae
add esp, 0x10
test eax, eax
jne 0x43105b
push esi
call fcn.0042e644
mov esi, eax
cmp esi, ebx
pop ecx
je 0x43105b
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x431046
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x43105b
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x431054
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0043d1ed
cmp byte [esp + 0x13], bl
je 0x43108b
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004311c2
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4310fb
push 0x14
call fcn.0048951b
cmp eax, ebx
pop ecx
je 0x4310b5
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4310b7
xor edi, edi
cmp edi, ebx
je 0x4310fb
push esi
push edi
call fcn.004306e8
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004307b0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004308d9
add esp, 0x18
call fcn.00431185
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0043b3a7
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x431112
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x431124
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x431167
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x431167
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004307b0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004308d9
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4385e8
Capabilities:
Encode data using xor

Disassembly:
push ecx
jnp 0x43858e
xor dl, byte [ecx - 0x47]
inc ebp
add dword [esi], ecx
cmpsd dword [esi], dword es:[edi]
pushal
inc eax
sub byte [edx + ebp*4 + 0x40], 0x32
or dword [ebx], esi
and dword [edi - 0x72], eax
ror byte [eax + eax*8 - 0x39eb4af3], 0x18
sar byte [ebx + ebx*8 - 0x7b9f29ef], 1
sbb byte [esi], ch
mov word [edi - 0x54], gs
jmp 0xd08623fd
aam 0x90
test esp, ecx
aas
pop ebp
sbb esi, ecx
mov ah, byte [ebx]
das
pop edx
int 0x57
push edi
jle 0x438547
inc ebx
hlt
sti
call 0xbe633e06
jecxz 0x438584
sub eax, 0x2db22a4a
jo 0x438591
lahf
adc dword [ebx + 0x72], 0xffffffab
xchg ebx, eax
popal
cmpsd dword [esi], dword es:[edi]
push es
sti
mov byte [edx - 0xbd51c5f], 0x43
mov dl, 0xee
aad 0x28
pushfd
cmpsb byte fs:[esi], byte es:[edi]
add eax, 0x258b434b
pop esp
mov ah, 0xf0
dec esp
push eax
jecxz 0x438639
add bh, byte [esi + 0x7c775ce2]
sub edx, ebx
mov esi, 0xbf622780
mov eax, dword [0x3013ed1a]
mov byte [0x78c4f952], al
inc esp
imul esp, dword [ebx + ecx*8 - 0x69f301cd], 0x63
arpl word [esi + 0x73f5f543], ax
xchg edx, eax
ljmp 0x4b48:0xa3175374

Function at 0x43b59d
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xb2
mov bl, 5
jecxz 0x43b615
invalid
adc dl, ah
pop edi
arpl word [ebp - 0x776b31c6], bx
imul ecx, dword [ecx - 0x559d9736], 0xffffffe7
mov ebp, 0x3eac6618
mov eax, 0x83625e6a
fsubp st(3)
mov byte [0xe20003db], al
sub byte [ecx], ah
in al, 0x4e
sti
sub dh, al
bound ebp, qword [ebx + ebp + 0x466cbad7]
mov cl, 0x64
in eax, dx
xor al, 0x42
sub eax, 0x4cfdad82
inc ebp
scasd eax, dword es:[edi]
or byte [esi + 0x2e], dh
neg bl
add al, 0xed
sub eax, 0xaa22198c
xor eax, dword [esi + 0x6e82e768]
sbb dh, byte [esi + 0x420adcf2]
sbb al, 0x6d
push esp
pop ds
arpl word [eax - 0x23], dx
inc eax
stosb byte es:[edi], al
or byte [edx + 0x38], al
push ebx
jge 0x43b63e
pop esp
mov edx, es
xchg esp, eax
pop edi
retf 0xf189