joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4726f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x472734
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x584f3c
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x57ec17
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4727da
cmp edi, dword [esi + 0x7c]
jge 0x4727da
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0048707e
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048707e
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584f3c
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584f3c
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x47272c
jmp 0x4726fc
call fcn.0048b2a5
int3

Function at 0x49a0f4
Capabilities:
Encode data using base64

Disassembly:
mov ch, 0xc6
xor esi, edx
mov al, byte [0x556c091]
pop edi
sal dword [ebp - 7], cl
mov dl, 0x70
pushal
fisttp dword [ebp + ebx*8 + 0x778dfa53]
mov edx, 0x6d5b0d86
sbb byte [ebx], bh
or cl, byte [esi]
adc eax, 0x6db0f4a7
invalid
Function at 0x49f56e
Capabilities:
Encode data using xor

Disassembly:
out dx, al
xor eax, 0xd29cfb18
or dword [edx + 0x6c], edx
or esi, eax
retf 0xc7b9
js 0x49f597
js 0x49f5ae
xchg esi, eax
push ebx
test eax, 0x1bd68e78
jns 0x49f57f
add eax, 0xc8b75a1b
mov bh, 0xc8
push 0xffffffffffffffdd
ror ch, 1
sbb eax, 0x30ed2b61
pop edi
inc esp
pop ds
wait
xlatb
mov eax, 0x5c1dc25f
add byte [eax - 0xa], al
in eax, dx
sbb byte [edi + edi*4 + 0x2366d22], ah
out dx, eax
cmp byte [eax + 0x13], ch
xchg ebx, eax
in eax, dx
cmpsb byte [esi], byte es:[edi]
mov ch, byte [esi + 0x35e3a792]
cmpsd dword [esi], dword es:[edi]
jecxz 0x49f5e6
stosb byte es:[edi], al
sbb byte [ebx - 0x36], 0x32
cmp ah, 0xad
xchg ebp, eax
mov cs, word [edi + 0x5a489e03]
or ah, byte [ebx - 0x1fb1a80f]
jecxz 0x49f548
sub dword [edx + 0x72], eax
cmp dword [eax - 0x5d834e0b], 0xffffffee
in eax, dx
jno 0x49f605
cmp eax, 0xc91cdb80
and eax, 0x77a246b7
invalid
and esp, dword [esi]
fmulp st(6)
loop 0x49f570
dec ebx
invalid
insd dword es:[edi], dx
jbe 0x49f675
jbe 0x49f602
xchg esp, eax
push eax
ror dword es:[ebp + 0x72c8c0bf], cl
invalid
pop esp
adc dword [edi - 0x78], ecx
jo 0x49f608
bound ebx, qword [edi + 0x1131c226]
inc edx
sbb byte [ebx - 0x1d], dh
lock xor dword [ebx + edx*2], ecx
xor eax, 0x75691f68
mov ss, ebx
lahf
jg 0x49f67d
stosd dword es:[edi], eax
inc edx
hlt
xor al, 0x18
push esp
ja 0x49f6bc
dec eax
xor byte [ecx + ebx], cl
jle 0x49f645
sbb dword [esi - 0x3b], edi
dec edi
xchg ebx, eax
scasb al, byte es:[edi]
mov edi, 0x92122add
jl 0x49f690
or byte [edx + 0x42], 0x95
add al, 2
mov eax, 0xbd165c76
push ds
lds esi, [ebx + 0x5ddc5303]
jb 0x49f6f8
push ebx
xchg ebp, eax
cmp byte [eax], dl
adc dh, ah
lea esp, [esi]
imul esi, dword [esi], 0x20d38add
dec ebp
rol ebx, cl
sub ch, byte es:[ebx]
pop esp
not al
mov dword [0x4a1f8660], eax
pop ss
jns 0x49f653
xchg esi, eax
jg 0x49f6bc
push es
or ch, byte [ecx + 0x73]
xor bl, byte [ecx - 0x50]
xlatb
push 0x70e984e5
sahf
push eax
invalid
iretd

Function at 0x4abd86
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x311d15f5
call [eax]
xor ah, cl
xor al, 0xee
bound esi, qword [eax + 0x13]
xchg esp, eax
lea edx, [ebx + 0x35ce3d4e]
adc dword [edx], edx
lodsb al, byte [esi]
pop edi
sbb eax, 0xd054c923
xor dword [0xf5c5e37d], ebx
pop ds
cmp eax, 0x37c90d5a
mov bh, 0x75
cwde
add cl, byte [ecx - 0x65]
stc
out 0x73, al
adc bl, dl
xor cl, byte [esi + 0x3d]
dec edi
fdiv qword [ebp + 0x3399d436]
mov bh, 0x52
nop
and bl, byte [eax - 0x5d746bd]
jae 0x4abdb2
lds ecx, [ebx]
adc al, byte [esi + 0x2951779b]
bound ebx, qword cs:[0x80fea3eb]
inc edi
sub byte [edi + 0x56], dh
xor ebp, eax
mov eax, dword [0x4cb17629]
out dx, eax
add ah, byte [ebx + 0x480b152]
mov dword [0x235d80e4], eax
xlatb
fisub word [ecx]
retf
Function at 0x4acd8c
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x2f
aas
fisubr word cs:[esi - 0x5f6e5e7f]
mov al, 0xa3
shl byte [0x26172435], cl
cmp dword [ecx], ebp
fldcw word [eax - 0x53625545]
mov esp, 0x3e2fdfaf
push ds
das
push ds
adc dword [ecx], esi
and al, dl
mov dword [0xa994a5b3], eax
mov ebx, 0x3a2adaaa
sub eax, 0x2c3c2d1d
cmp al, 0x2c
fsubr qword [esi + edi*4 - 0x4e6e5e52]
mov eax, dword [0x233320d1]
adc ah, byte [edx]
xor eax, 0xb4a5d525
movsb byte es:[edi], byte [esi]
xchg esp, eax
cmpsb byte [esi], byte es:[edi]
mov eax, 0x3a2adaa8
sub eax, 0x21012f1c
fisubr dword [edx]
cmp ch, byte [0x21012f1c]
shl dword [ecx - 0x5f6f5f4f], 1
mov bl, 0xa3
shl dword [ebx], cl
xor esp, dword [edi + edx]
sub dword [eax], edi
sub al, bl
test al, 0xbb
lodsb al, byte [esi]
lahf
xchg ecx, eax
mov cl, 0xa0
shl dword [ebx], cl
xor esp, dword [edx]
adc al, 0x27
aaa
daa
salc
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xbdad9aaa
lodsb al, byte [esi]
fsubr qword [edi]
aas
adc dword [ecx], esp
and dword [eax], esi
salc
stosb byte es:[edi], al
mov edx, 0xe2122
scasb al, byte es:[edi]
outsd dx, dword [esi]
jle 0x4acda9
lahf
scasb al, byte es:[edi]
mov edi, 0x7d6d9c8d
or al, 0x1d
sub al, 0x3d
or ebx, dword [edx]
imul edi, dword [ebx - 0x76], 0xffffff9b
test eax, 0x689988b8
jns 0x4ace3a
push ss
aaa
push es
adc al, 0x65
jne 0x4acdbe
cmp dword [esi], 0xffffffaf
scasd eax, dword es:[edi]
mov edi, 0x7f6e9f8e
or eax, 0xd3c2d1c
sbb al, 0x6d
jl 0x4acdd8
popfd
lodsb al, byte [esi]
mov ebp, 0x7d6c9d8c
or al, 0x1d
sub al, 0x3a
or ebx, dword [edx]
imul edi, dword [edx - 0x75], 0xffffff9a
stosd dword es:[edi], eax
mov ebx, 0x7b6a9b8a
or bl, byte [eax]
sub dword [eax], edi
or dword [eax], ebx
imul edi, dword [eax - 0x78], 0x87b9a899
xchg esi, eax
ja 0x4ace77
adc esp, dword [edx]
xor byte [edi - 0x738391e2], bl
push ds
outsb dx, byte [esi]
jl 0x4ace07
wait
test eax, 0x649786b6
jno 0x4acec2
push ds
cmp al, 0xd
sbb eax, 0x9b8a7a6b
or ebx, dword [eax]
sub dword [ecx], edi
add al, 0x12
Function at 0x4b740a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd628
push 0x4b7294
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c4d30], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c4d2c], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c4d28], ecx
shr eax, 0x10
mov dword [0x4c4d24], eax
push 1
call fcn.004b8483
pop ecx
test eax, eax
jne 0x4b73d7
push 0x1c
call fcn.004b7499
pop ecx
call fcn.004b8240
test eax, eax
jne 0x4b73e8
push 0x10
call fcn.004b7499
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004b8084
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c53f4], eax
call fcn.004b7f52
mov dword [0x4c4d14], eax
call fcn.004b7d05
add byte [eax], al
call fcn.004b7c4c
call fcn.004b795c
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b7bf4
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b7437
movzx eax, word [ebp - 0x2c]
jmp 0x4b743a
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
invalid
xor al, 5

Function at 0x4b7a17
Capabilities:
Terminate process

Disassembly:
add byte [eax + eax - 0x18], cl
inc ebx
add byte [eax], al
add byte [ecx + 0x59], bl
push 0x4c0020
push 0x4c001c
call fcn.004b7a62
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b7a3e
call fcn.004b7a59
pop edi
ret
push dword [esp + 8]
mov dword [0x4c4d60], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4b8519
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0398
cmp edx, dword [eax]
je 0x4b853b
add eax, 8
inc ecx
cmp eax, 0x4c0428
jl 0x4b852c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0398]
jne 0x4b8669
mov eax, dword [0x4c4d1c]
cmp eax, 1
je 0x4b8643
test eax, eax
jne 0x4b856c
cmp dword [0x4c02c0], 1
je 0x4b8643
cmp edx, 0xfc
je 0x4b8669
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b85a3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b8f00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9390
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b85e6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9390
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bd98c
push edi
call fcn.004bb260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b8f00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b8f10
lea eax, [ebp - 0xa0]
push 0x4bd96c
push eax
call fcn.004b8f10
push dword [esi + 0x4c039c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b8f10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bb1d4
add esp, 0x2c
pop edi
jmp 0x4b8669
lea eax, [ebp + 8]
lea esi, [esi + 0x4c039c]
push 0
push eax
push dword [esi]
call fcn.004b9390
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3dbc6e67
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x791d1d0c
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x669f1e49
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6f22304d
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4080ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x423b78]
mov esi, dword [ebp + 8]
call fcn.00408082
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00403787
add esp, 0x10
xor esi, esi
call fcn.00408068
movzx ecx, byte [ebp + esi - 0x10]
xor eax, ecx
mov byte [ebp + esi - 0x10], al
movzx eax, al
push eax
call fcn.00408142
inc esi
pop ecx
cmp esi, 0xc
jl 0x4080ea
cmp dword [0x423b74], 0
movzx ecx, byte [ebp - 5]
pop esi
je 0x408129
movzx eax, byte [0x426c67]
cmp cx, ax
je 0x408132
or eax, 0xffffffff
jmp 0x408134
movzx eax, byte [0x426c6d]
jmp 0x40811f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408980
mov esp, ebp
pop ebp
ret

Function at 0x408142
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x426350]
mov eax, ecx
xor eax, dword [esp + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4263a0]
movzx eax, cl
add eax, dword [0x426354]
imul eax, eax, 0x8088405
mov dword [0x426350], ecx
mov ecx, dword [0x426358]
inc eax
mov dword [0x426354], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4263a0]
mov dword [0x426358], ecx
ret

Function at 0x54846e
Capabilities:
Encode data using xor

Disassembly:
call fcn.00549414
call fcn.00542c4a
stosd dword es:[edi], eax
xor al, byte [ecx + 0x37]
daa
ror byte [edx + edi*2], 1
cmp al, 0xd5
invalid
Function at 0x9dccd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9dcd1c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9dcce2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9dcd80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9dcdd2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9dcdd8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f52c5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f4f85

Function at 0x9fa0bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f9f3e

Function at 0x9ff670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9ff69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9ff69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3603377c
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x79a42007
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401611
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.0040f707
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401370
push 0x5c
mov ecx, edi
call fcn.00401526
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x4012e3
push edi
push edi
mov dword [0x4197a4], esi
mov dword [0x4197ac], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp dword [0x4197ec], 2
mov dword [0x4197a8], eax
je 0x40166e
call fcn.0040851f
push 0xffffffffffffffff
push dword [0x4197a8]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [0x4197ac]
cmp eax, edi
mov dword [0x419880], edi
je 0x4016bd
cmp eax, 1
je 0x4016b1
cmp eax, 2
je 0x4016ad
cmp eax, 3
je 0x4016a9
cmp eax, 0x67
jle 0x4016a4
cmp eax, 0x6a
jle 0x401721
push eax
push 0x14
jmp 0x4016f4
push 0x12
jmp 0x4016b3
push 0x13
jmp 0x4016b3
push 0x11
push edi
call fcn.00408dbf
pop ecx
pop ecx
jmp 0x401721
cmp dword [0x419888], edi
jne 0x401721
lea eax, [ebp + 8]
push eax
push dword [0x4197a8]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x4016e4
cmp ecx, edi
jne 0x4016e4
xor eax, eax
jmp 0x401726
mov eax, 0x80070000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x4016f7
push ecx
push 0x21
push edi
jmp 0x401719
and ecx, 0xffff
cmp ecx, 0xe
jne 0x40170b
cmp dword [0x4197f0], 0xffffffff
je 0x401721
push ecx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.00408dbf
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x401d49
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x401d84
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x401d6b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x401d7c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x401d86
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401d61
xor eax, eax
pop edi
pop esi
ret

Function at 0x402131
Capabilities:
Contain obfuscated stackstrings

Disassembly:
salc
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00401d19
push eax
push esi
push dword [ebp + 8]
call fcn.00401cce
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00401d09
Function at 0x4023a0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4023bd
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4023b8
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4023a2
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4023aa
cmp edx, ebx
jne 0x4024f8
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
or byte [edx - 0x3f], dh
add eax, dword [eax + 4]
jmp 0x402366
mov dword [ebp + 0xc], ebx
jmp 0x4023c8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4023e0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4023fe
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40245c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x402443
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40244c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x402456
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402438
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4023c2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4024a9
dec eax
je 0x4024a0
sub eax, 3
je 0x402497
mov dword [ebp - 4], 0x40
jmp 0x4024c6
mov dword [ebp - 4], 4
jmp 0x4024ac
mov dword [ebp - 4], 0x20
jmp 0x4024ac
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4024f8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x402478
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00401d09
daa
sbb al, 0xb8
xor al, 0xff
jne 0x402503
push 1
push esi
call edi
mov eax, esi
jmp 0x402504
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret