joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7ecd0e33
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x218667c2
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x24d5376e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x3d6c1a6d
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401090
Capabilities:
Hide graphical window

Disassembly:
mov ebp, esp
push esi
lea eax, [0x4032cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp + 4]
mov dword [0x403183], eax
xor eax, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x4010bd
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403183]
mov dword [ebp - 0x48], eax
mov eax, 0x402353
mov dword [ebp - 0x54], eax
mov ecx, str.secondclass
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x403183]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403328], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403328]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x40117b
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x40116d
mov esp, ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x8495e4a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x691f4bf7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401080
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ddd0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x414004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], ecx
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
add esi, eax
xor ecx, ecx
mov eax, dword [edx]
mov dword [ebp - 0x18], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jge 0x401293
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
cmp dword [esi + 0x10], 0
push 0
jne 0x4011e3
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov edi, dword [edi + 0x38]
test edi, edi
jle 0x40125b
push 0
call dword [0x45b3b0]
push str.VirtualAlloc
push dword [0x45b3b4]
call ebx
push 0
mov ebx, eax
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x14]
push 4
push 0x1000
push edi
push eax
call ebx
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.00402da0
add esp, 0xc
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
inc ecx
mov edx, dword [ebp + 8]
add esi, 0x28
mov edi, dword [ebp - 0x20]
jmp 0x4010f6
call dword [0x45b3b0]
push str.VirtualAlloc
push dword [0x45b3b4]
call ebx
push 0
mov edi, eax
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x14]
push 4
push 0x1000
push dword [esi + 0x10]
push eax
call edi
push dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edi, eax
add ecx, dword [ebp - 0x1c]
push ecx
push edi
call fcn.0040bd20
add esp, 0xc
mov dword [esi + 8], edi
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
inc ecx
mov edi, dword [ebp - 0x20]
add esi, 0x28
jmp 0x4010f6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4013a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40de10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x414004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0
mov edx, dword [ebx]
movzx eax, word [edx + 0x14]
lea esi, [edx + 0x18]
add esi, eax
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 0x18], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jge 0x40157d
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov ecx, dword [esi + 0x24]
mov eax, ecx
mov edx, ecx
shr eax, 0x1d
shr edx, 0x1e
mov edi, ecx
and eax, 1
shr edi, 0x1f
and edx, 1
test ecx, 0x2000000
je 0x401489
push 0
call dword [0x45b3b0]
push str.VirtualFree
push dword [0x45b3b4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov edi, eax
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0x4000
push dword [esi + 0x10]
push dword [esi + 8]
call edi
mov ecx, dword [ebp - 0x18]
inc ecx
add esi, 0x28
jmp 0x4013ec
lea eax, [edx + eax*2]
lea eax, [edi + eax*2]
mov edi, dword [eax*4 + 0x4129c0]
test ecx, 0x4000000
je 0x4014a4
or edi, 0x200
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4014e5
push eax
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov eax, dword [esi + 0x24]
test al, 0x40
je 0x4014d8
mov eax, dword [ebx]
mov eax, dword [eax + 0x20]
jmp 0x4014e1
test al, al
jns 0x40154b
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x40154b
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push str.VirtualProtect
push dword [0x45b3b4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov ebx, eax
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [esi + 0x10]
push dword [esi + 8]
call ebx
test eax, eax
jne 0x401548
push eax
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
inc ecx
add esi, 0x28
jmp 0x4013ec
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
push 0
mov dword [ebp - 4], esi
call dword [0x45b3b0]
push 0
call dword [0x45b3b0]
movzx eax, byte [ebp + 8]
xor edx, edx
mov ecx, 0x5f
div ecx
mov ebx, edx
add bl, 0x58
test esi, esi
je 0x401ea6
push esi
xor esi, esi
pop esi
push 0
call dword [0x45b3b0]
mov al, byte [edi]
lea edi, [edi + 1]
xor al, bl
add al, bl
mov byte [edi - 1], al
push eax
xor eax, eax
pop eax
sub dword [ebp - 4], 1
jne 0x401e84
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x414004]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401f95
movsd xmm0, qword [0x4129e8]
call fcn.00401040
jmp 0x401ff3
mov dword [ebp - 0x14], 0
push 0x40000000
call fcn.0040399d
add esp, 4
mov dword [ebp - 0x14], eax
push 0x40000000
push 0x41
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402da0
add esp, 0xc
push 0xa
call dword [0x45b3b0]
mov edx, dword [ebp - 0x14]
push edx
call fcn.00403998
add esp, 4
mov ecx, str.fuckyou
call fcn.00401eb0
mov eax, 1
test eax, eax
je 0x401ff3
push 0x2710
call dword [0x45b3b0]
jmp 0x401fdd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402005
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000bb20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.1000bb20]
mov dword [0x1001fe1c], 0x21bc
mov dword [ebp - 4], eax
jmp 0x1000bb5e
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x1000bb87
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
jmp 0x1000bb7f
mov dword [ebp - 8], 0
jmp 0x1000bb87
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1000bb43
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
je 0x1000bb3b
jmp 0x1000bb43
mov al, 1
test al, 1
jne 0x1000bb5e
jmp 0x1000bb55
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret

Function at 0x1000bb90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1001fe18]
add eax, 0x1043
mov dword [0x1001fe18], eax
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x1001fe18]
sub eax, 0x732
mov dword [0x1001fe18], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
mov dword [0x1001fe1c], 0xea
mov dword [ebp - 4], 0
jmp 0x1000bc02
jmp 0x1000bc28
jmp 0x1000bcf4
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
jmp 0x1000bbf7
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jge 0x1000bc28
mov dword [0x1001fe18], 0x191d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x1000bbe6
jmp 0x1000bbf5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + eax*2 - 0x1a]
cmp eax, 0x6c
jne 0x1000bcfc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x1000bcfa
mov dword [0x1001fe18], 0x17db
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x1000bcf8
mov eax, dword [0x1001fe18]
sub eax, 0x22f3
mov dword [0x1001fe1c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x1000bcf6
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x1000bcf4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x1000bbe8
mov dword [0x1001fe18], 0xfe8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x1000bcef
mov dword [0x1001fe1c], 0xb05
mov dword [ebp - 0xc], 1
jmp 0x1000bbed
jmp 0x1000bbe8
jmp 0x1000bcf6
jmp 0x1000bcf8
jmp 0x1000bcfa
jmp 0x1000bcfc
mov dword [ebp - 0xc], 0
jmp 0x1000bbed
Function at 0x4017ef
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov ebx, eax
test eax, eax
je 0x40180a
mov edx, dword [0x404050]
add edx, edx
jmp 0x401810
mov edx, dword [0x404050]
mov eax, 0x404054
call fcn.00401720
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x4031fd
push edx
sub edi, fcn.004029a7
push edi
xor eax, eax
push fcn.004029a7
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401865
mov eax, fcn.004029a7
mov ebx, esi
mov edx, edi
call fcn.00401720
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.004020e5
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x64646271
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
mov ecx, 0x1b93dcd
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x1053dc9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
not bl
xchg ebx, ebx
push edx
xchg bx, dx
cwd
push ebp
cdq
setl dh
pushfd
cmovo ebp, ecx
btr ebx, 0x97
bts ebx, eax
push eax
push esi
lahf
rdtsc
or ebp, ebx
push ecx
rdtsc
bts bp, cx
push edi
bsf ebx, ecx
neg ebp
mov edx, 0
mov ebx, 0x65a60144
push edx
btc edi, 0x59
mov esi, dword [esp + 0x28]
cbw
mov ax, 0x48dc
neg esi
dec esi
neg esi
neg bx
inc bx
sub ax, cx
xor esi, 0x6e303a65
movsx ebp, cx
add esi, edx
not ebp
mov ebp, esp
cdq
xor di, 0x3649
adc bl, 0xf
sub esp, 0xc0
mov ebx, esi
rdtsc
btc eax, 0xc0
mov eax, 0
clc
sub ebx, eax
rol edi, 0x12
sbb dh, 0xb9
lea edi, [0x1053dd26]
bts dx, di
lea esi, [esi - 4]
cdq
jmp 0x105ac99a
jmp edi
mov edx, dword [esi]
cmp al, bl
xor edx, ebx
not edx
jmp 0x1060b091
dec edx
clc
stc
ror edx, 1
test cx, si
xor edx, 0xbee020c
cmp edi, esi
xor ebx, edx
test edi, ebx
add edi, edx
jmp 0x10591629
Function at 0x40145e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
and eax, eax
je 0x401484
cmp dword [ebp - 4], 0
jne 0x40148b
sub eax, eax
pop esi
leave
ret 0xc
mov eax, dword [ebp - 4]
add esi, eax
sub dword [ebp + 0x10], eax
jne 0x401468
mov eax, 1
pop esi
leave
ret 0xc

Function at 0x401963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
push dword [ebp + 8]
pop ebx
mov al, byte [ebx]
mov byte [ebp - 3], al
mov al, byte [ebx + 1]
mov byte [ebp - 4], al
mov edi, ebx
inc edi
inc edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x10]
jecxz 0x4019ce
inc byte [ebp - 3]
movzx eax, byte [ebp - 3]
movzx edx, byte [eax + edi]
mov byte [ebp - 1], dl
add byte [ebp - 4], dl
movzx eax, byte [ebp - 4]
mov dl, byte [eax + edi]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 3]
mov byte [eax + edi], dl
movzx eax, byte [ebp - 4]
mov dl, byte [ebp - 1]
mov byte [eax + edi], dl
mov dl, byte [ebp - 1]
add dl, byte [ebp - 2]
mov dl, byte [edx + edi]
mov eax, dword [ebp - 8]
xor byte [eax + esi], dl
inc dword [ebp - 8]
loop 0x40198e
mov al, byte [ebp - 3]
mov byte [ebx], al
mov al, byte [ebp - 4]
mov byte [ebx + 1], al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x401b81
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
mov eax, dword [ebp + 0x14]
and eax, eax
je 0x401b95
mov dword [eax], 0
sub edi, edi
cmp dword [ebp + 0x18], 1
jne 0x401ba4
mov edx, 0x200
jmp 0x401bb3
cmp dword [ebp + 0x18], 2
jne 0x401bb1
mov edx, 0x100
jmp 0x401bb3
sub edx, edx
or edx, 0x20019
lea eax, [ebp - 4]
push eax
push edx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x401c3e
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
jne 0x401c36
cmp dword [ebp - 8], 0
je 0x401c36
cmp dword [ebp - 0xc], 1
jne 0x401bfc
cmp dword [ebp - 8], 1
je 0x401c36
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.00401888
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
je 0x401c2a
push edi
call fcn.00401871
sub edi, edi
jmp 0x401c36
mov eax, dword [ebp + 0x14]
and eax, eax
je 0x401c36
push dword [ebp - 8]
pop dword [eax]
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
and eax, eax
jne 0x401c60
cmp dword [ebp + 0x18], 2
jae 0x401c60
mov eax, dword [ebp + 0x18]
inc eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b81
pop edi
leave
ret 0x14
Function at 0x401cba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
not eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x401ce5
mov edx, eax
shr edx, 8
xor al, byte [edi]
and eax, 0xff
mov eax, dword [eax*4 + 0x419bf0]
xor eax, edx
inc edi
loop 0x401ccd
not eax
pop edi
leave
ret 0xc

Function at 0x401e73
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, eax
je 0x401e82
cmp byte [eax], 0
jne 0x401e8b
mov eax, 0
leave
ret 4
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401ea5
test eax, 0x10
setne al
movzx eax, al
jmp 0x401eaa
mov eax, 0
leave
ret 4

Function at 0x401eae
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
and eax, eax
je 0x401eee
push eax
push eax
call fcn.00401888
mov dword [ebp - 4], eax
pop eax
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
and eax, eax
jne 0x401eeb
push dword [ebp - 4]
call fcn.00401871
sub eax, eax
jmp 0x401eee
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x401ef2
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push 0x10
push ebx
call fcn.0040189f
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebx], eax
inc eax
je 0x401f7a
dec eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebx]
call sub.kernel32.dll_CreateFileMappingA
and eax, eax
je 0x401f6d
mov dword [ebx + 4], eax
push 0
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx + 8], eax
and eax, eax
jne 0x401f6b
push dword [ebx + 4]
call sub.kernel32.dll_CloseHandle
push dword [ebx]
call sub.kernel32.dll_CloseHandle
mov dword [ebx], 0xffffffff
jmp 0x401f7a
push dword [ebx]
call sub.kernel32.dll_CloseHandle
mov dword [ebx], 0xffffffff
sub eax, eax
cmp dword [ebx + 8], eax
setne al
pop ebx
leave
ret 8