joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003dc00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1003dd08
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003dd08
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1003dd08
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003c930
add esp, 0x10
cmp eax, 2
je 0x1003dc49
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1003dc3d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1003c930
add esp, 0x10
cmp eax, 4
jne 0x1003dc3d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1003dc78
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003c930
add esp, 0x10
cmp eax, 2
jne 0x1003dc3d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x1003dcd3
cmp eax, 0x8664
jne 0x1003dc3d
push 0x108
push ebx
push edi
push esi
call fcn.1003c930
add esp, 0x10
cmp eax, 0x108
jne 0x1003dc3d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.1003c930
add esp, 0x10
cmp eax, 0xf8
jne 0x1003dc3d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f536
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
loopne 0x42f5ad
pop ds
mov bl, 0xe4
loopne 0x42f55b
inc ecx
ret 0x9094
jae 0x42f507
lahf
inc eax
cmc
sub edi, dword [eax - 0x6c]
xchg edx, eax
sbb eax, dword [ebp + edi*2 + 0x6b]
adc eax, 0xb7e4627a
xor eax, 0xbf836198
in eax, dx
mov esi, 0x49f5f598

Function at 0x4bbeb9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33e0
cmp edx, dword [eax]
je 0x4bbedb
add eax, 8
inc ecx
cmp eax, 0x4c3470
jl 0x4bbecc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33e0]
jne 0x4bc009
mov eax, dword [0x4c8e10]
cmp eax, 1
je 0x4bbfe3
test eax, eax
jne 0x4bbf0c
cmp dword [0x4c330c], 1
je 0x4bbfe3
cmp edx, 0xfc
je 0x4bc009
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbf43
lea eax, [ebp - 0x1a4]
push 0x4c1690
push eax
call fcn.004bc8a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcd30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbf86
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcd30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c168c
push edi
call fcn.004bec00
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1670
push eax
call fcn.004bc8a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc8b0
lea eax, [ebp - 0xa0]
push 0x4c166c
push eax
call fcn.004bc8b0
push dword [esi + 0x4c33e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc8b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1644
push eax
call fcn.004beb74
add esp, 0x2c
pop edi
jmp 0x4bc009
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33e4]
push 0
push eax
push dword [esi]
call fcn.004bcd30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42dd70
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x437008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x2a7401c], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x2a73e60], eax
jne 0x42ddb1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401000
add esp, 0x404
ret

Function at 0x42dde0
Capabilities:
Get hostname

Disassembly:
sub esp, 0xc18
mov eax, dword [0x437008]
xor eax, esp
mov dword [esp + 0xc14], eax
push esi
xor esi, esi
cmp dword [esp + 0xc20], esi
mov dword [esp + 0xc], edx
jle 0x42decf
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
mov edi, dword [esp + 0x18]
jmp 0x42de20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 5
mov dword [esp + 0x1c], 0
call fcn.0042ddd0
mov eax, dword [esp + 0x1c]
add eax, 0x46
mov dword [esp + 0x10], eax
nop
sub dword [esp + 0x10], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0x14], eax
cmp dword [esp + 0xc2c], 0xf
mov cl, byte [esp + 0x14]
mov byte [edx + esi], cl
jne 0x42debe
push 0
push 0
call ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.gomomokukowumipusaxevu
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea ecx, [esp + 0x428]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push edi
push str.wowohasare
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x18]
inc esi
cmp esi, dword [esp + 0xc2c]
jl 0x42de20
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc20], 0x2d
pop esi
jne 0x42deee
mov dword [0x2a74150], 0xa62e7790
mov dword [0x2a74154], 0xffffffff
mov ecx, dword [esp + 0xc14]
xor ecx, esp
call fcn.00401000
add esp, 0xc18
ret

Function at 0x42df10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc04
mov eax, dword [0x437008]
xor eax, esp
mov dword [esp + 0xc00], eax
mov eax, dword [0x437fe0]
push esi
mov esi, dword [0x2a7401c]
push edi
mov edi, dword [0x2a73e64]
push eax
call fcn.0042dd70
add esp, 4
cmp dword [0x2a7401c], 0x2f
jne 0x42df4f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
mov edx, edi
call fcn.0042dde0
add esp, 4
cmp dword [0x2a7401c], 0x568
pop edi
pop esi
jne 0x42df89
push 0
push 0
lea ecx, [esp + 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.00401000
add esp, 0xc04
ret
Function at 0x5fcc60
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
jmp 0x5fce1d
push edi
or ebp, 0xffffffff
jmp 0x5fcc82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5fcc89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcc78
mov eax, 1
add ebx, ebx
jne 0x5fcc9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5fccac
jne 0x5fcccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcccb
dec eax
add ebx, ebx
jne 0x5fccb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5fcc90
add ebx, ebx
jne 0x5fccc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5fcd1d
xor ecx, ecx
sub eax, 3
jb 0x5fcce3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5fcd52
sar eax, 1
mov ebp, eax
jmp 0x5fccee
add ebx, ebx
jne 0x5fccee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fccbc
inc ecx
add ebx, ebx
jne 0x5fccfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fccbc
add ebx, ebx
jne 0x5fcd09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5fccfe
jne 0x5fcd1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5fccfe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5fcd3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5fcd2e
jmp 0x5fcc7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5fcd3c
add edi, ecx
jmp 0x5fcc7e
pop esi
mov edi, esi
mov ecx, 0x1090
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5fcd5a
cmp byte [edi], 0x12
jne 0x5fcd5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5fcd5f
lea edi, [esi + 0x1fa000]
mov eax, dword [edi]
or eax, eax
je 0x5fcdd7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1fe780]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1fe848]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5fcd8c
mov ecx, edi
jns 0x5fcdbb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1fe84c]
or eax, eax
je 0x5fcdd1
mov dword [ebx], eax
add ebx, 4
jmp 0x5fcda9
call dword [esi + 0x1fe85c]
mov ebp, dword [esi + 0x1fe850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5fce0b
sub esp, 0xffffff80
jmp 0x418ebe
nop
nop
nop
nop
push esi
mov ecx, 0x1b318
mov edx, 0x56404c21
mov ebx, dword [esi]
xor ebx, edx
mov dword [esi], ebx
add esi, 4
dec ecx
cmp ecx, 0
jne 0x5fce2c
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
lea edi, [esi - 0x18f000]
jmp 0x5fcc6c
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x14011bf0
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7e345115
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x1666ae0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1666aea
pushal
call 0x1666af0
pop ebp
sub ebp, 0x10
sub ebp, 0x1266ae0
jmp 0x1666b06
mov eax, 0x1266ae0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d3
mov edx, 0xd22368d1
xor byte [eax], dl
inc eax
dec ecx
jne 0x1666b1d
jmp 0x1666b30
pop edx
sbb al, 0x5a
pop eax
in eax, dx
rcl ecx, 1
rcl dword [eax + 0x10]
sub ecx, edx
rcl ecx, 1
rcr byte [ecx + ebp*2], cl
aad 0xd1
rcl ecx, 1
imul edi, ecx, 0xffffffd1
rcl ecx, 1
xor edx, edx
sbb dword [edx + 0x50], ebx
fst st(1)
rcl ecx, 1
rcl byte [esp + ebx*2], cl
mov ch, 0xf5
sub eax, 0x5cf5d558
mov ch, 0xf5
sub eax, 0xb9f5d558
cli
in al, dx
sar dword [ecx - 0x2ec71105], 1
sar ch, 1
cmc
mov ecx, 0x7f5e9b50
cmp esp, edx
rcl ecx, 1
sar dword [eax], 1
call ecx
rcl ecx, 1
pop esp
mov ch, 0xf5
sub eax, 0x85f5fd58
mov word [edx + 0x54], ds
invalid
Function at 0x4c5560
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x5154d8]
mov dword [ebp - 0x10], eax
mov eax, ebx
add eax, 0xffffe49e
mov dword [0x5154d8], eax
add ebx, 0xfffff04f
mov dword [0x5154dc], ebx
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov ebx, edi
mov eax, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edi
je 0x4c5661
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
add edx, 1
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x5154d8], 0x119d
mov edi, dword [ebp - 0x20]
mov bl, byte [edi + edx]
movzx edi, bl
mov dword [ebp - 0x30], ecx
mov ecx, edi
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov eax, ecx
cdq
idiv esi
mov dword [0x5154dc], 0x1477
mov ecx, dword [ebp - 0x20]
mov bh, byte [ecx + edx]
mov esi, dword [ebp - 0x34]
mov byte [ecx + esi], bh
mov byte [ecx + edx], bl
movzx ecx, byte [ecx + esi]
add ecx, edi
and ecx, 0xff
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov bl, byte [edi + esi]
mov esi, dword [ebp - 0x20]
xor bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov byte [ecx + esi], bl
mov dword [0x5154d8], 0x6f6
add esi, 1
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jne 0x4c55bc
mov dword [0x5154d8], 0x406
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c57d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.004c57d0]
mov dword [ebp - 4], eax
jmp 0x4c57fb
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x5154d8], 0xbb2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x4c57e1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x4c57e1
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
Function at 0x4c58c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x5154d8], 0x1e01
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, eax
mov bl, dl
mov edx, dword [ebp - 0x18]
mov byte [edx + eax], bl
add eax, 1
cmp eax, 0x100
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ecx
jne 0x4c58ea
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, ecx
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x2c], edx
mov edx, ecx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov eax, edi
cdq
mov edi, dword [ebp - 0x2c]
idiv edi
mov ecx, dword [0x5154d8]
add ecx, 0x1450
mov dword [0x5154d8], ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [esi + ecx]
mov ch, byte [esi + edx]
mov edi, dword [ebp - 0x28]
mov byte [esi + edi], ch
mov byte [esi + edx], cl
mov dword [0x5154dc], 0x11ee
add edi, 1
cmp edi, 0x100
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edi
jne 0x4c5910
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c5c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [0x5154d8], 0xaf7
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jmp 0x4c5ca7
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x40]
mov dword [esp + 8], ecx
call fcn.004c5680
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x3500
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x100800
mov ecx, dword [ebp - 0x3c]
add ecx, 0xc5e
mov dword [edx + 8], ecx
mov dword [0x5154d8], 0x1827
mov dword [edx + 0xc], 0x2010
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x34
mov edi, edx
add edi, esi
add edi, 0x10
imul esi, eax, 0x34
add edx, esi
add edx, 0xc
add eax, 1
mov esi, dword [edi]
movzx edx, word [edx]
xor edx, esi
add edx, ecx
cmp eax, 0xb5
mov ecx, edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], eax
jne 0x4c5ca7
lea eax, [0x511f0b]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call fcn.004c5e50
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.004c50d0
mov ecx, eax
mov dword [0x5154e0], eax
mov dword [ebp - 0x4c], ecx
mov eax, esp
mov ecx, dword [ebp - 0x40]
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
mov eax, dword [ebp - 0x4c]
call eax
sub esp, 0x10
xor ecx, ecx
mov dword [0x5154d8], 0x628
mov edx, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x34
mov edi, edx
add edi, esi
add edi, 0x10
mov esi, dword [edi]
imul edi, eax, 0x34
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x34
add edx, ebx
add edx, 0xc
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x3c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.004c5730
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0xb5
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
je 0x4c5c55
jmp 0x4c5d69
Function at 0x5dda76
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xc67122a2
and ebp, ecx
xor al, 0xe1
fdiv dword [eax]
loop 0x5dda95
push edx
sbb dword [edi], esp
mov dword [ecx], ebx
mov eax, dword [0x22a2bab9]
adc ch, dl
invalid
sbb dh, byte [edx]
mov ebp, 0xc28685a7
ret 0x2aaf
scasd eax, dword es:[edi]
sub dh, byte [edi - 0x3a19c5e9]
stosb byte es:[edi], al
scasd eax, dword es:[edi]
sbb dword [edi + 0x73757d19], edi
ffree st(6)
jno 0x5dda4b
mov byte [0x9afde422], al
jmp 0x5ddac1
jecxz 0x5ddb01
mov ebx, 0xb47130f5
jno 0x5dda7c
push ds
cmp dh, byte [ecx - 0x45]
mov byte [0xe6a322af], al
mov bl, 0x9f
out dx, eax
cmc
xor byte [eax + 0x3e], ah
cdq
and dh, byte [ecx - 0x45]
pop ss
mov bl, 0x9f
out dx, eax
cmc
xor dh, ah
cmc
mov edx, 0xa28ef2a7
xor ebp, edx
add byte [edx - 0x2acf8ede], ah
invalid
and ah, byte [eax + 0x3f]
and dh, byte es:[ecx - 0x45]
pop ds
pop ebp
jge 0x5ddac6
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x409f72
Capabilities:
Move file

Disassembly:
mov eax, 0x40bca7
call fcn.0040a890
sub esp, 0x14
push ebx
push esi
push edi
push ecx
mov eax, esp
xor ebx, ebx
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x10], ebx
call fcn.0040129d
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
call fcn.00401db0
mov dword [ebp - 4], 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 1
lea eax, [ebp - 0x1c]
pop edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call fcn.0040a684
mov byte [ebp - 4], 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x14]
mov esi, 0x40faa4
push eax
push esi
call fcn.00408c13
test al, al
je 0x40a019
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
mov byte [ebp - 4], 4
call fcn.00401228
cmp eax, ebx
jne 0x40a046
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040659c
mov byte [ebp - 4], 6
nop
nop
nop
nop
nop
nop
push 0x40f964
push 0x40f960
lea ecx, [ebp - 0x18]
call fcn.00406da0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x18]
call fcn.004062b4
push eax
lea ecx, [ebp - 0x14]
call fcn.004062b4
push eax
call dword [sym.imp.MSVCRT.dll_rename]
pop ecx
test eax, eax
pop ecx
jne 0x40a0b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040659c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
call fcn.00406565
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00406565
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00406565
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4016ff
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40174c
mov al, cl
cmp al, 0x61
jb 0x401727
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40174c
mov al, cl
cmp al, 0x61
jb 0x40173f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x401718
cmp edx, dword [esp + 0x18]
je 0x40175c
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x401711
xor eax, eax
jmp 0x40175f
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x401767
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40184e
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x401854
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4017b3
cmp al, 0x61
jb 0x4017ab
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40179e
cmp edx, dword [esp + 0x14]
je 0x4017c3
dec ecx
jne 0x401793
xor eax, eax
jmp 0x40184e
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40184e
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40184e
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x4017ff
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40180e
jmp 0x4017f6
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.004016ff
test eax, eax
je 0x40184e
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x401849
cmp al, 0x61
jb 0x401841
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401834
call fcn.00401767
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x40186c
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x40186c
sub edx, ecx
mov ecx, edx
jmp 0x4017c3
xor eax, eax
jmp 0x40184e