joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4291f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x429272
test ebx, ebx
je 0x429272
mov eax, dword [edi + 0x3c]
xor esi, esi
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
add ecx, edi
mov dword [ebp - 0x10], ecx
add edx, edi
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x429272
mov eax, dword [edx + esi*4]
mov ecx, ebx
add eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x429260
test dl, dl
je 0x42925c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x429260
add eax, 2
add ecx, 2
test dl, dl
jne 0x429240
xor eax, eax
jmp 0x429265
sbb eax, eax
or eax, 1
test eax, eax
je 0x42927b
mov edx, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jb 0x429232
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x24], eax
mov ebx, dword [eax]
mov dword [ebp - 0x18], ebx
cmp ebx, eax
je 0x42947d
mov dword [ebp - 8], 0x57004a
nop
push 4
call fcn.0040c737
mov edi, dword [ebx + 0x20]
add esp, 4
xor ebx, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
nop
lea ecx, [ebp - 8]
xor esi, esi
call fcn.004076b0
mov ecx, eax
mov ax, word [edi]
cmp ax, word [ecx]
je 0x4293c8
lea ecx, [ebp - 8]
inc esi
call fcn.004076b0
mov ecx, eax
mov ax, word [edi + esi*2]
cmp ax, word [ecx]
jne 0x4293b4
dec esi
cmp ebx, esi
jae 0x42946c
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + edi]
push eax
call fcn.0042d4a0
mov ecx, dword [ebp - 4]
mov esi, eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
push eax
call fcn.0042d4a0
cmp esi, eax
jne 0x42944e
inc dword [ebp - 4]
lea ecx, [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x10], 0x57004a
call fcn.004076b0
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
cmp ax, word [ecx]
je 0x429437
mov edi, dword [ebp - 0xc]
nop dword [eax + eax]
lea ecx, [ebp - 0x10]
inc esi
call fcn.004076b0
mov ecx, eax
mov ax, word [edi + esi*2]
cmp ax, word [ecx]
jne 0x429420
mov edi, dword [ebp - 0x20]
lea eax, [esi - 1]
cmp dword [ebp - 4], eax
je 0x429486
mov eax, dword [ebp - 0x14]
inc ebx
add eax, 2
mov dword [ebp - 0x14], eax
jmp 0x4293a0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 4], 0
mov ebx, eax
mov dword [ebp - 0x1c], eax
add eax, eax
inc ebx
add eax, 2
mov dword [ebp - 0x14], eax
jmp 0x4293a0
mov ebx, dword [ebp - 0x18]
mov ebx, dword [ebx]
mov dword [ebp - 0x18], ebx
cmp ebx, dword [ebp - 0x24]
jne 0x429380
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
pop edi
pop esi
mov dword [eax], ebx
mov eax, dword [ebp - 0x18]
pop ebx
mov eax, dword [eax + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x42bc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x43ee38]
lea ecx, [ebp - 0x18]
push edi
mov dword [ebp - 0x18], 0x3f0019
mov dword [ebp - 0x14], 0x10022
mov dword [ebp - 0x10], 0x5c001c
mov dword [ebp - 0xc], 0x61004b
mov dword [ebp - 8], 0x2b000a
mov dword [ebp - 4], 0x42001b
call fcn.00409e80
push eax
call esi
mov esi, dword [0x43ee38]
lea ecx, [ebp - 0x18]
mov dword [0x43ee28], eax
mov dword [ebp - 0x18], 0x3e001d
mov dword [ebp - 0x14], 0x40029
mov dword [ebp - 0x10], 0xa001e
mov dword [ebp - 0xc], 0x61000d
mov dword [ebp - 8], 0x2b000a
mov dword [ebp - 4], 0x42001b
call fcn.00409e80
push eax
call esi
movaps xmm0, xmmword [0x439f50]
lea ecx, [ebp - 0x14]
mov dword [0x43ee30], eax
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x333d
mov byte [ebp - 2], 0x4a
call fcn.0040a850
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1223f19
mov dword [ebp - 0xc], 0x2a012a1c
mov dword [ebp - 8], 0x2703320d
mov word [ebp - 4], 0x711c
call fcn.0040a140
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x8333903
mov dword [ebp - 0xc], 0x3b1c0102
mov dword [ebp - 8], 0x2c123721
mov word [ebp - 4], 0x710a
call fcn.0040a140
mov ecx, dword [0x43ee30]
mov edx, eax
call fcn.004291f0
movaps xmm0, xmmword [0x43a070]
lea ecx, [ebp - 0x14]
mov dword [0x43edfc], eax
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x4b
call fcn.0040a7e0
mov ecx, dword [0x43ee30]
mov edx, eax
call fcn.004291f0
movaps xmm0, xmmword [0x439fc0]
lea ecx, [ebp - 0x14]
mov dword [0x43ee00], eax
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0x6b2f082f
call fcn.00409d00
mov ecx, dword [0x43ee30]
mov edx, eax
call fcn.004291f0
movaps xmm0, xmmword [0x439f80]
lea ecx, [ebp - 0x14]
mov dword [0x43edf8], eax
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0x4b
call fcn.0040a7e0
mov ecx, dword [0x43ee30]
mov edx, eax
call fcn.004291f0
movaps xmm0, xmmword [0x43a040]
lea ecx, [ebp - 0x18]
mov dword [0x43edf4], eax
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x2a240b22
mov byte [ebp - 4], 0x72
call fcn.0040a200
movaps xmm0, xmmword [0x439ff0]
lea ecx, [ebp - 0x14]
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x2525
mov byte [ebp - 2], 0x4a
call fcn.0040a850
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d0b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edi
test edi, edi
je 0x42d0f7
lea ecx, [esp + 0xc]
mov word [esp + 0xc], 0x5707
call fcn.00401f30
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x42d0f7
lea ecx, [esp + 0xc]
mov word [esp + 0xc], 0x5710
call fcn.00401f30
mov cl, byte [edi + 1]
cmp cl, byte [eax]
je 0x42d0ff
push 0
call dword [0x43ee18]
mov esi, dword [edi + 0x3c]
mov eax, dword [0x43ee04]
push 0x40
push 0x3000
push dword [esi + edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
jne 0x42d129
or eax, 0xffffffff
or edx, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov eax, ebx
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [esi + edi + 0x54]
test edx, edx
je 0x42d151
mov esi, edi
mov ecx, ebx
sub esi, ebx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x42d143
mov ecx, dword [ebx + 0x3c]
mov eax, 0x20b
lea esi, [ecx + ebx]
mov dword [esp + 0xc], ecx
movzx edx, word [esi + 6]
mov dword [esp + 0x14], esi
cmp word [esi + 0x18], ax
jne 0x42d1ce
xor eax, eax
xor ecx, ecx
mov dword [esp + 0xc], eax
cmp cx, dx
jae 0x42d244
nop
movzx eax, ax
xor edx, edx
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
mov esi, dword [ecx + 0x10c]
mov eax, dword [ecx + 0x104]
add esi, edi
mov edi, dword [ecx + 0x108]
add eax, ebx
test edi, edi
je 0x42d1b5
sub esi, eax
mov cl, byte [esi + eax]
lea eax, [eax + 1]
inc edx
mov byte [eax - 1], cl
cmp edx, edi
jb 0x42d1a7
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
inc eax
mov edi, dword [esp + 0x18]
mov dword [esp + 0xc], eax
cmp ax, word [esi + 6]
jb 0x42d180
jmp 0x42d244
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
cmp ax, dx
jae 0x42d244
nop dword [eax]
movzx eax, ax
xor edx, edx
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
mov esi, dword [eax + ebx + 0x10c]
mov ecx, dword [eax + ebx + 0x104]
add esi, edi
mov edi, dword [eax + ebx + 0x108]
add ecx, ebx
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
test edi, edi
je 0x42d229
sub esi, ecx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
inc edx
mov byte [ecx - 1], al
cmp edx, edi
jb 0x42d212
mov ecx, dword [ebx + 0x3c]
mov dword [esp + 0xc], ecx
jmp 0x42d22d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc eax
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
cmp ax, word [esi + 6]
jb 0x42d1e0
mov ecx, ebx
call fcn.00429940
mov ecx, ebx
call fcn.0042c1d0
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x42d269
lea ecx, [eax + ebx]
mov edx, ebx
call fcn.0042d530
mov eax, dword [esi + 0x28]
pop edi
add eax, ebx
xor edx, edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ac90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x241c
call fcn.004e88a0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov byte [esp + 0x17], dl
push edi
push dword [0x521758]
lea ebp, [esp + 0x430]
push str.__s_s
mov eax, ebp
push 0x800
push eax
call fcn.004af740
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
add esp, 0x14
lea ecx, [esi + 1]
cmp ecx, 0x800
jg 0x45acff
lea eax, [esp + 0x42a]
push eax
call ebx
cmp eax, 0xffffffff
je 0x45acff
mov dword [esp + esi*2 + 0x428], 0x22
mov esi, dword [0x521758]
jmp 0x45adc6
xor esi, esi
lea eax, [esp + 0x18]
push esi
push ecx
push eax
push str.InstallDir
mov edx, str.SOFTWAREAutoHotkey
call fcn.004b0c60
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x45ad48
test esi, esi
jne 0x45ad48
mov esi, 0x100
lea eax, [esp + 0x18]
push esi
push ecx
push eax
push str.InstallDir
mov edx, str.SOFTWAREAutoHotkey
call fcn.004b0c60
mov edx, eax
add esp, 0x10
test edx, edx
je 0x45ad20
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [esp + ecx + 0x18]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x21e], ax
test ax, ax
jne 0x45ad50
test edx, edx
je 0x45ae6e
push edi
lea eax, [esp + 0x224]
push eax
push str.__s_s
lea eax, [esp + 0x434]
push 0x800
push eax
call fcn.004af740
mov esi, eax
add esp, 0x14
lea ecx, [esi + 1]
cmp ecx, 0x800
jg 0x45ae6e
lea eax, [esp + 0x42a]
push eax
call ebx
cmp eax, 0xffffffff
je 0x45ae6e
mov dword [esp + esi*2 + 0x428], 0x22
lea esi, [esp + 0x220]
cmp byte [esp + 0x17], 0
je 0x45ae3f
push str.AutoHotkey.exe
push esi
push str.__s_s
lea eax, [esp + 0x1434]
push 0x800
push eax
call fcn.004af740
mov ebx, eax
add esp, 0x14
lea ecx, [ebx + 1]
cmp ecx, 0x800
jg 0x45ae28
lea eax, [esp + 0x142a]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45ae28
mov dword [esp + ebx*2 + 0x1428], 0x22
lea ebp, [esp + 0x1428]
lea eax, [esp + 0x428]
jmp 0x45ae44
cmp esi, dword [0x521758]
jne 0x45ae3f
mov ebp, dword [0x521754]
lea eax, [esp + 0x428]
jmp 0x45ae44
mov eax, 0x4f03e8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push ebp
mov ecx, 0x520c68
call fcn.0044ec20
test eax, eax
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x241c
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x241c
ret
Function at 0x417f50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x417f6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417f71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f60
mov eax, 1
add ebx, ebx
jne 0x417f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417f78
jne 0x417f94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f78
xor ecx, ecx
sub eax, 3
jb 0x417fa8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41801a
mov ebp, eax
add ebx, ebx
jne 0x417fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417fc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417fe4
inc ecx
add ebx, ebx
jne 0x417fd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417fc5
jne 0x417fe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417fc5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418004
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417ff5
jmp 0x417f66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418004
add edi, ecx
jmp 0x417f66
pop esi
mov edi, esi
mov ecx, 0x5f3c
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x41803f
cmp byte [edi], 3
jne 0x418024
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x418022
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x418090
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418045
mov ecx, edi
jns 0x418074
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1807c]
or eax, eax
je 0x41808a
mov dword [ebx], eax
add ebx, 4
jmp 0x418062
call dword [esi + 0x1808c]
mov ebp, dword [esi + 0x18080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4180c4
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x423ea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x423ecd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x423ecd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x419632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419628
mov eax, 1
add ebx, ebx
jne 0x41964b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419640
jne 0x41965c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419640
xor ecx, ecx
sub eax, 3
jb 0x419670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4196e2
mov ebp, eax
add ebx, ebx
jne 0x41967b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4196ac
inc ecx
add ebx, ebx
jne 0x419698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41968d
jne 0x4196a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41968d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4196cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4196bd
jmp 0x41962e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4196cc
add edi, ecx
jmp 0x41962e
pop esi
mov edi, esi
mov ecx, 0x5ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4196ea
cmp byte [edi], 0
jne 0x4196ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4196ef
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41975e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1924c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41971c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19250]
or eax, eax
je 0x419758
mov dword [ebx], eax
add ebx, 4
jmp 0x419739
call dword [esi + 0x19254]
popal
jmp 0x40e274
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x401351
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.0040e493
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0040e493
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], esp
mov eax, 0
call fcn.0040e48d
cmp dword [ebp - 0x1c], esp
je 0x4013eb
push 0x19
push 0x40160f1
push 6
call fcn.0040e487
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 4]
push 0
push 0x1f0fff
mov eax, 1
call fcn.0040e48d
cmp dword [ebp - 0x1c], esp
je 0x401424
push 0x46
push 0x40160f1
push 6
call fcn.0040e487
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
push dword [ebp - 8]
mov eax, 2
call fcn.0040e48d
cmp dword [ebp - 0x1c], esp
je 0x40145c
push 0x73
push 0x40160f1
push 6
call fcn.0040e487
add esp, 0xc
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x10]
push str.SeDebugPrivilege
push 0
mov eax, 3
call fcn.0040e48d
cmp dword [ebp - 0x1c], esp
je 0x401492
push 0x9d
push 0x40160f1
push 6
call fcn.0040e487
add esp, 0xc
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
push 0
push 0
push 0
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 4
call fcn.0040e48d
cmp dword [ebp - 0x1c], esp
je 0x40152b
push 0x1ad
push 0x40160f1
push 6
call fcn.0040e487
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
mov eax, 5
call fcn.0040e48d
cmp dword [ebp - 0x1c], esp
je 0x40155a
push 0x1ed
push 0x40160f1
push 6
call fcn.0040e487
add esp, 0xc
mov eax, dword [ebp - 0x18]
jmp 0x401562
push eax
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0040e481
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0040e481
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x406308
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x406312
add dword [esp], 5
retf

Function at 0x4064d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4064da
add dword [esp], 5
retf
Function at 0x406565
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4065e5
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4065e5
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4065e5
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4065e5
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x4065d6
test bl, bl
je 0x4065e9
dec eax
mov eax, edx
jmp 0x4065c2
inc ebp
test al, al
je 0x4065e9
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x4065bd
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x4065a9
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4065e3
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x406636
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x406640
add dword [esp], 5
retf

Function at 0x4067cd
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4067d7
add dword [esp], 5
retf
Function at 0x40d0ff
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40d14c
mov al, cl
cmp al, 0x61
jb 0x40d127
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40d14c
mov al, cl
cmp al, 0x61
jb 0x40d13f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40d118
cmp edx, dword [esp + 0x18]
je 0x40d15c
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40d111
xor eax, eax
jmp 0x40d15f
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40d167
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40d24e
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40d254
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40d1b3
cmp al, 0x61
jb 0x40d1ab
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40d19e
cmp edx, dword [esp + 0x14]
je 0x40d1c3
dec ecx
jne 0x40d193
xor eax, eax
jmp 0x40d24e
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40d24e
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40d24e
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40d1ff
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40d20e
jmp 0x40d1f6
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.0040d0ff
test eax, eax
je 0x40d24e
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40d249
cmp al, 0x61
jb 0x40d241
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40d234
call fcn.0040d167
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x40d26c
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x40d26c
sub edx, ecx
mov ecx, edx
jmp 0x40d1c3
xor eax, eax
jmp 0x40d24e