joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4700bd
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004653a0
mov eax, dword [0x4a2190]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0046c61b
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x4701f0
push 2
push esi
push dword [ebp + 8]
call fcn.0046c61b
add esp, 0xc
cmp eax, ebx
je 0x4701f0
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x470190
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004643f0
push 0x8000
push dword [ebp + 8]
call fcn.00466c90
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x470146
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.00469dce
add esp, 0xc
cmp eax, 0xffffffff
je 0x470166
sub edi, eax
test edi, edi
jg 0x47013e
jmp 0x47017e
call fcn.00467256
cmp dword [eax], 5
jne 0x47017b
call fcn.0046724d
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.00466c90
pop ecx
pop ecx
jmp 0x4701d8
jge 0x4701d8
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046c61b
push dword [ebp + 8]
call fcn.0046c39c
add esp, 0x10
push eax
call dword [sym.imp.No_such_device_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x4701d8
call fcn.0046724d
mov dword [eax], 0xd
call fcn.00467256
mov edi, eax
call dword [sym.imp.No_such_device_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0046c61b
add esp, 0xc
mov eax, esi
pop edi
jmp 0x4701f2
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00464bee
leave
ret
Function at 0x4719b3
Capabilities:
Get common file path

Disassembly:
push 0x120
push 0x49cff8
call fcn.0046824c
mov eax, dword [0x4a2190]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
and dword [ebp - 0x128], 0
mov eax, edi
push eax
push 0x105
call dword [sym.imp.No_such_device_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, 0x104
jle 0x471a57
and dword [ebp - 4], 0
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.004653a0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x130], edi
jmp 0x471a44
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x471a57
push edi
inc esi
push esi
call dword [sym.imp.No_such_device_GetCurrentDirectoryA]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x471a72
cmp byte [edi + 1], 0x3a
jne 0x471a72
movzx eax, byte [edi]
push eax
call fcn.0046803a
pop ecx
mov ebx, eax
sub ebx, 0x40
cmp dword [ebp - 0x128], 0
je 0x471a82
push edi
call fcn.00464557
pop ecx
mov eax, ebx
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0x1c]
call fcn.00464bee
call fcn.00468287
ret

Function at 0x471bc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x471bee
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.No_such_device_GetDriveTypeA]
test eax, eax
je 0x471bf3
cmp eax, 1
je 0x471bf3
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x471bf7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4a2190]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x471c6f
push ebx
call fcn.00471bc0
test eax, eax
pop ecx
jne 0x471c3e
call fcn.00467256
mov dword [eax], 0xf
call fcn.0046724d
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.00464bee
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.No_such_device_GetFullPathNameA]
jmp 0x471c81
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.No_such_device_GetCurrentDirectoryA]
test eax, eax
je 0x471c31
inc eax
cmp eax, 0x104
ja 0x471c31
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x471cb9
cmp eax, dword [ebp + 0x10]
jg 0x471c9c
mov eax, dword [ebp + 0x10]
push eax
call fcn.004646c7
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x471cce
call fcn.0046724d
mov dword [eax], 0xc
jmp 0x471c31
cmp eax, dword [ebp + 0x10]
jle 0x471cce
call fcn.0046724d
mov dword [eax], 0x22
jmp 0x471c31
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.00464e40
pop ecx
pop ecx
jmp 0x471c33
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3e5f5bc4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x7fb567a8
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10006110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000611f
pop dword [ebp - 0x14]
mov eax, 0x1000611f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x16feac22
add dword [ebp - 0x24], 0x37539929
mov dword [ebp - 0x20], 0x4f6a4fd5
add dword [ebp - 0x20], 0xe2c8fc70
mov dword [ebp - 0x1c], 0xabbf4485
add dword [ebp - 0x1c], 0xa08cffa9
mov dword [ebp - 0x18], 0xa60fcbc9
sub dword [ebp - 0x18], 0xa60fcbc9
lea eax, [ebp - 0x24]
push eax
mov eax, 0xf2b81b89
add eax, 0x1d4904b7
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xb8581f47
sub dword [ebp - 0x24], 0x43e5b5f1
mov dword [ebp - 0x20], 0xdb713e1b
add dword [ebp - 0x20], 0x65fb235a
mov dword [ebp - 0x1c], 0xbc97f0db
sub dword [ebp - 0x1c], 0x5928846f
mov dword [ebp - 0x18], 0xf87f5dc4
add dword [ebp - 0x18], 0x780a23c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3b8b5
push 0
call eax
mov ecx, 0x5f8ea2c7
sub ecx, 0x5f8e5378
xor edi, edi
add edi, eax
mov edx, 0xebfb4c45
sub edx, 0xdbf99c45
add edx, dword [ebp - 0x14]
mov esi, 0x625b36a6
add esi, 0xcc70bca8
sub dword [ebp - 0x10], ecx
mov ebx, dword [edx]
xor dword [ebp - 8], 0xf6f4d193
xor ebx, esi
sub dword [ebp - 0xc], 0xfcd3170b
mov dword [edi], ebx
add dword [ebp - 0xc], 0x2b967d9d
add edi, 4
add edx, 4
loop 0x10006239
add eax, 0x1300f
xor ebx, ebx
add ebx, eax
add eax, 0x2f997163
sub eax, 0x2f99715e
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401500
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x10], 0x697061
mov dword [ebp - 0x16], 0x73726946
mov word [ebp - 0x12], 0x74
lea eax, [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x58], sym.__Z6MyWinPP6HWND__jjl_16
mov dword [ebp - 0x44], 0
mov dword [esp + 4], 0x7f01
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], 0
mov dword [esp], 1
mov eax, dword [sym.imp.GDI32.dll_GetStockObject]
call eax
sub esp, 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x5c], 3
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_RegisterClassA]
call eax
sub esp, 4
test ax, ax
sete al
test al, al
je 0x4015a7
mov eax, 0
jmp 0x40168d
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xff0000
lea eax, [ebp - 0x16]
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_UpdateWindow]
call eax
sub esp, 4
jmp 0x401659
lea eax, [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
call eax
sub esp, 4
lea eax, [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DispatchMessageA]
call eax
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetMessageA]
call eax
sub esp, 0x10
test eax, eax
setne al
test al, al
jne 0x401639
mov eax, dword [ebp - 0x2c]
leave
ret 0x10

Function at 0x401b50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable
Function at 0x401bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405470]
test esi, esi
jle 0x401c9d
mov edi, dword [0x405474]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401be4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401c96
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401bd0
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401cda
lea ebx, [esi + esi*2]
mov esi, dword [0x405474]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405474]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401cba
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401c8f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401c8f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405474]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401ca4
add dword [0x405470], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401bee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405474]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]

Function at 0x4021a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405808
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405800]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4021f5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021ee
test esi, esi
je 0x4021ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021d0
mov dword [esp], 0x405808
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402410
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402448
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40243e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40244a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402430
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40111e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x401159
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x401140
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x401151
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40115b
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401136
xor eax, eax
pop edi
pop esi
ret

Function at 0x40119c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.004010de
push edi
sbb dword [esi], ebx
dec ebp
push esi
push ebx
call fcn.0040111e
pop ecx
test eax, eax
pop ecx
Function at 0x401ea0
Capabilities:
Terminate process

Disassembly:
or byte [ebx + 0x40c0c815], cl
add byte [eax + 0x51], dl
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, esp
adc al, 0x89
inc ebp
or al, ch
dec ecx
dec ebx
add byte [eax], al
jae 0x401e59
or eax, dword [ecx]
mov ebx, 0x7048a415
add byte [ebx + 0x14468bd8], cl
test eax, eax
mov esi, dword [edx + 0x75]
inc eax
mov ecx, dword [esi + 4]
push 0x63
push 0
push ecx
call fcn.00404270
mov word [esi + 0x8b9], ds
mov dword [ecx - 0x1f], esp
or byte [eax], al
add bh, al
inc esi
sbb byte [eax], al
add bl, ch
add byte [ebx + 0x4135ec15], cl
add byte [ebx + 0x60d11456], bh
add al, byte [ecx]
test eax, eax
je 0x401f3a
inc eax
leave
sub dword [ecx], eax
mov esi, edx
add ecx, eax
mov dword [esp + edx - 0x15], ebx
sub eax, 0x8388e8b
add byte [eax], al
mov eax, dword [0x40d0b1]
mov ebx, ebx
push cs
fisttp dword [esi]
rol byte [eax + 0x47], 1
add esi, dword [esi]
stosb byte es:[edi], al
xchg byte [0x136c0015], ch
ret 0xf83b
orps xmm3, xmmword [eax]
or ebx, dword [0x192830]
mov eax, dword [esi + 4]
lea esp, [esi + 0x51230308]
push edx
push eax
mov ecx, 0x6b6d
add eax, eax
je 0x401f8a
cmp dword [ecx + 0x3d2e9f0b], 0x68
std
or al, byte [eax]
je 0x401f8a
cmp eax, 0x740afcd9
je 0x401f8a
test eax, 0x9850fd57
je 0x401f8a
cmp eax, 0xd97e1b
je 0x401f8a
stc
mov eax, dword [0x74000afc]
or edi, dword [0xd02bc]
lcall 0x8bfd, 0xcd85
sar byte [esi - 0x75], 0x1d
mov al, byte [0x8b004102]
cmp eax, 0x4102a4
mov eax, eax
jle 0x401f19
sbb eax, 0x4102a0
mov edi, dword [0x4102a4]
cmpsb byte [esi], byte es:[edi]
fadd dword [ebx + 0x1dac00d7]
fld dword [edx]
add eax, 0xa43d8900
add al, byte [ecx]
mov edx, dword [esi + 0x18]
mov esi, esp
adc al, 3
shr byte [ebx], 1
enter 0x563e, 0x18
mov dword [esi + 0x14], ecx
jne 0x3f35ac
mov dword [esi + 8], 3
call fcn.00406aad
mov dword [0x1ddb9b], eax
mov dword [0x410ba4], edx
mov edx, dword [esi + 4]
ljmp 0x8b00

Function at 0x404270
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx + 0x83c8b], cl
add byte [ebx + 0x410ba015], cl
add dh, bl
xchg ebx, eax
xchg esi, eax
or byte [eax + ebx*4], ch
mov eax, dword [0x41cca4]
push ebx
pop ds
xor dword [eax + ecx], 0x51
xor al, 8
push ecx
add byte [0xff50dc0c], ah
adc dword [edi + 0x7a], 0xffffffe0
pop esi
pop ebx
popal
in eax, 0x5d
adc dl, byte [eax + 0x5388a190]
inc ecx
add byte [esi - 0x53], dl
xor eax, sym.imp.MSVCRT.dll_printf
test eax, eax
jne 0x40428b
push 0x4083d8
push 0x5ad8eab4
call esi
xor ebp, dword [eax + 0x2f]
inc eax
add bh, bh
salc
push str.Licensed_to_The_Apache_Software_Foundation__http:__www.apache.org__n
call esi
push 0x40d4d2
call esi
sbb dword [esp + edx - 0x33973c5d], 0xffffffea
inc eax
add byte [eax], bh
salc
push 0x40ac96
or eax, 0x40d444
test al, 0xc8
rcr dword [esi + 0x7dd6ff00], cl
mov al, byte [0xffbc40e9]
salc
push 0x407528
call esi
push str.__p__n_p__n
cdq
salc
add dword [edi], 0x1c
pop esi
ret
Function at 0x4016e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
and dword [esi + 0x30], 0
push edi
call fcn.004015ad
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov ebx, dword [edi]
jmp 0x40172c
push 0xa
push 0xa
push 0xc8f204
push 0x3114b604
call fcn.00401dd2
add esp, 0xc
push eax
push dword [ebx + 0x30]
call fcn.0040161c
add esp, 0xc
test eax, eax
je 0x401735
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x401704
jmp 0x4017c7
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4017c7
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + ebx + 0x78]
and dword [esp + 0xc], 0
add edi, ebx
mov eax, dword [edi + 0x1c]
add eax, ebx
push ebp
mov ebp, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x24]
add eax, ebx
add ebp, ebx
cmp dword [edi + 0x18], 0
mov dword [esp + 0x18], eax
jbe 0x4017c3
mov eax, dword [esp + 0x10]
mov eax, dword [ebp + eax*4]
push 0x16
add eax, ebx
push 0xc8f1ec
push 0x40704011
mov dword [esp + 0x20], eax
call fcn.00401d84
push eax
push dword [esp + 0x24]
call fcn.00401648
add esp, 0x14
test eax, eax
je 0x4017ab
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 0x18]
jb 0x40176c
jmp 0x4017c3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
add eax, ebx
mov dword [esi + 4], eax
mov dword [esi + 0x30], ebx
pop ebp
cmp dword [esi + 0x30], 0
je 0x40192e
push 0xa
push 0xc8f1e0
push 0x29a1a909
call fcn.00401d84
add esp, 0xc
push eax
push esi
mov ecx, esi
call fcn.004016be
push 0xc
push 0xc8f1d0
push 0x13cbcee9
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 8]
push eax
mov ecx, esi
call fcn.004016be
push 0x18
push 0xc8f1b4
push 0x17ce53be
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0xc]
push eax
mov ecx, esi
call fcn.004016be
push 0xf
push 0xc8f1a4
push 0x26b30b69
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x10]
push eax
mov ecx, esi
call fcn.004016be
push 0x12
push 0xc8f190
push 0x3d924530
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x14]
push eax
mov ecx, esi
call fcn.004016be
push 7
push 0xc8f188
push 0x2236409a
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x18]
push eax
mov ecx, esi
call fcn.004016be
push 0x14
push 0xc8f170
push 0x149ccd04
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x1c]
push eax
mov ecx, esi
call fcn.004016be
push 0x11
push 0xc8f15c
push 0x673ebfe9
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x20]
push eax
mov ecx, esi
call fcn.004016be
push 0x11
push 0xc8f148
push 0x68d29b96
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x24]
push eax
mov ecx, esi
call fcn.004016be
push 0x16
push 0xc8f130
push 0x7db65c79
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x28]
push eax
mov ecx, esi
call fcn.004016be
push 0x13
push 0xc8f11c
push 0x65fa79df
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x2c]
push eax
mov ecx, esi
call fcn.004016be
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x401937
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, section..data
mov ecx, 0x66c
mov esi, 0x2bf727
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
shr edx, 0xc
xor byte [eax], dl
inc eax
dec esi
jne 0x401947
pop esi
ret

Function at 0x401aa3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x401aea
push 7
push str..custom
push edi
call fcn.0040161c
add esp, 0xc
test eax, eax
je 0x401af1
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x401ac7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.00401e30
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x401960
mov dword [ebp - 0x14], 0x40196b
call fcn.0040379c
add esp, 0x28
test eax, eax
je 0x401b51
push dword [ebp - 4]
call fcn.00401e47
pop ecx
jmp 0x401aea
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x401aec

Function at 0x401d84
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x401dc3
push edi
mov edi, dword [esp + 0x14]
sub edi, 0xf4f730
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0xf4f730]
inc esi
mov byte [esi + 0xf4f72f], al
cmp esi, ebx
jb 0x401d9f
pop edi
pop esi
mov byte [ebx + 0xf4f730], 0
mov eax, 0xf4f730
pop ebx
ret

Function at 0x401dd2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x401e10
mov eax, dword [esp + 0x10]
sub eax, 0xf4f730
push ebx
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov ebx, edx
shr ebx, 0xc
xor bl, byte [eax + esi + 0xf4f730]
inc esi
mov byte [esi + 0xf4f72f], bl
cmp esi, edi
jb 0x401dec
pop ebx
mov byte [edi + 0xf4f730], 0
mov byte [edi + 0xf4f731], 0
pop edi
mov eax, 0xf4f730
pop esi
ret
Function at 0x401eec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401f05
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x401f28
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401f2d
inc edi
cmp edi, dword [ebp - 4]
jb 0x401f1f
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x402025
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x401f84
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x401f58
cmp cl, 0xff
jne 0x401faf
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x401fbd
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x401fc4
dec ecx
shl edx, cl
and edx, 7
je 0x401f49
movzx ecx, byte [edx + 0xc8f280]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0xc8f278], 0
mov cl, byte [ebx + 4]
je 0x401fac
test cl, cl
je 0x401fac
cmp cl, 0xff
jne 0x401f49
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401f1a
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x401ff8
movzx esi, byte [edx + 0xc8f280]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x401fe3
cmp al, 0xff
jne 0x401ff5
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x401f76
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401f1a
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret