joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ff0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [str.QQ.exe]
mov edx, dword [0x407560]
mov ecx, dword [0x40755c]
push ebx
push esi
mov dword [ebp - 8], edx
mov edx, dword [0x40756c]
mov dword [ebp - 0x10], eax
mov ax, word [0x407564]
mov dword [ebp - 0xc], ecx
mov ecx, dword [str.TIM.exe]
push 0x228
mov dword [ebp - 0x1c], edx
xor ebx, ebx
mov word [ebp - 4], ax
mov eax, dword [0x407570]
mov dword [ebp - 0x20], ecx
mov ecx, dword [0x407574]
lea edx, [ebp - 0x248]
push ebx
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push 2
mov dword [ebp - 0x24c], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40408f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x4040a0
lea ecx, [ebp - 0x228]
lea eax, [ebp - 0x10]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4040d6
test dx, dx
je 0x4040d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4040d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4040b0
xor eax, eax
jmp 0x4040db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404139
lea ecx, [ebp - 0x228]
lea eax, [ebp - 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40410e
test dx, dx
je 0x40410a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40410e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4040e8
xor eax, eax
jmp 0x404113
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404139
lea ecx, [ebp - 0x24c]
push ecx
push esi
call edi
test eax, eax
jne 0x4040a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x244]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404150
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push esi
push edi
push eax
push 4
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0x1c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x40419e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Thread32Next]
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x10], ecx
je 0x4041c8
lea edx, [ebp - 0x1c]
push edx
push esi
call ebx
test eax, eax
jne 0x4041a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404d60
Capabilities:
Terminate process

Disassembly:
push esi
push 0
push str.5B3838F5_0C81_46D9_A4C0_6EA28CA3E942
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x404d82
call fcn.00403f00
test eax, eax
jne 0x404da8
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00403ff0
mov esi, eax
test esi, esi
je 0x404dad
push esi
call fcn.00404150
add esp, 4
test eax, eax
je 0x404dad
push eax
push esi
call fcn.004041e0
add esp, 8
xor eax, eax
pop esi
ret
call fcn.00404960
xor eax, eax
pop esi
ret
Function at 0x406398
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a028]
jne 0x4063a2
repz ret
jmp fcn.004068b4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4f1ce0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa3000]
mov dword [edi + 0xa90c4], 0x87e930d8
push edi
or ebp, 0xffffffff
jmp 0x4f1d0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f1d11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f1d00
mov eax, 1
add ebx, ebx
jne 0x4f1d23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f1d34
jne 0x4f1d53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f1d53
dec eax
add ebx, ebx
jne 0x4f1d40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f1d18
add ebx, ebx
jne 0x4f1d4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f1da5
xor ecx, ecx
sub eax, 3
jb 0x4f1d6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4f1dda
sar eax, 1
mov ebp, eax
jmp 0x4f1d76
add ebx, ebx
jne 0x4f1d76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f1d44
inc ecx
add ebx, ebx
jne 0x4f1d84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f1d44
add ebx, ebx
jne 0x4f1d91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f1d86
jne 0x4f1da2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f1d86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f1dc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f1db6
jmp 0x4f1d06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f1dc4
add edi, ecx
jmp 0x4f1d06
pop esi
mov edi, esi
mov ecx, 0x4b84
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4f1de2
cmp byte [edi], 0x21
jne 0x4f1de2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4f1de7
lea edi, [esi + 0xee000]
mov eax, dword [edi]
or eax, eax
je 0x4f1e56
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf5344]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf5420]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4f1e14
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf5424]
or eax, eax
je 0x4f1e50
mov dword [ebx], eax
add ebx, 4
jmp 0x4f1e31
call dword [esi + 0xf542c]
mov ebp, dword [esi + 0xf5428]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4f1e8a
sub esp, 0xffffff80
jmp fcn.004a97a0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402c4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [0x4054e8]
mov ecx, edx
mov eax, dword [edx]
inc ecx
inc ecx
inc ecx
inc ecx
mov edi, dword [ecx]
mov ecx, eax
mov eax, dword [edi]
add edi, 4
mov esi, edi
mov ebx, esi
add edi, eax
mov edx, edi
dec edx
sub ecx, eax
dec ecx
dec ecx
dec ecx
dec ecx
lea eax, [0x4054e8]
mov dword [eax], ecx
inc eax
inc eax
inc eax
inc eax
mov dword [eax], edi
push ecx
mov ch, byte [edi]
mov al, byte [0x4053c3]
jmp 0x402c90
add al, byte [esi]
xor al, ch
mov byte [edi], al
mov eax, edx
cmp esi, eax
jne 0x402c9f
mov esi, ebx
dec esi
inc esi
pop ecx
inc edi
dec ecx
jne 0x402c83
jmp 0x402cab
mov edi, esi
push 0x39
push 0x4054e8
push 0x111
push dword [0x4054c4]
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, dword [0x4054e8]
mov edi, dword [0x4054ec]
mov esi, dword [0x4054dc]
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402cd7
mov esi, dword [0x4053be]
mov ecx, dword [0x4053ba]
push ecx
add ecx, esi
mov dword [0x4054a8], ecx
pop ecx
mov eax, dword [esi]
inc esi
inc esi
nop
inc esi
inc esi
mov edi, dword [0x4054dc]
mov ebx, esi
add ebx, eax
mov dword [0x4054a4], ebx
mov edx, esi
add esi, eax
mov ecx, 0
movzx eax, byte [edx]
inc eax
cmp edx, ebx
jae 0x402d7e
cmp eax, ecx
jae 0x402d23
ret
sub eax, ecx
mov ecx, eax
test ecx, ecx
je 0x402d34
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402d2b
inc edx
mov al, byte [edx]
inc edx
movzx ecx, byte [edx]
test ecx, ecx
je 0x402d47
push ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x402d40
pop ecx
inc edx
movzx eax, byte [edx]
inc cl
cmp cl, 0
jne 0x402d68
inc al
cmp al, 0
jne 0x402d60
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x402d64
mov al, 0
dec al
dec cl
jmp 0x402d7a
dec cl
inc al
cmp al, 0
jne 0x402d78
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x402d7a
dec al
jmp 0x402d1a
mov ecx, dword [0x4054a8]
sub ecx, esi
test ecx, ecx
je 0x402d93
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402d8a
mov edi, dword [0x4054dc]
mov dword [0x4054dc], edi
ret

Function at 0x40894b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
add ebx, 0x7fc16dd5
call fcn.00408975
add edi, ebx
dec ebx
xor dword [edx], ecx
inc edx
sub edi, edi
sub ebx, 0xcd61405
cmp edx, eax
jne fcn.0040894b
mov edi, 0x68951635
and ebx, edi
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x53ad4e20
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..tls
mov ebx, 0x42cd70
nop
mov ecx, 0x362811ba
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403f96
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov edx, ecx
pop esi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
dec esi
jne 0x403f9e
mov dword [ecx*4 + 0x409400], edx
inc ecx
cmp ecx, 0x100
jb 0x403f99
mov edx, 0x400
mov ecx, dword [edx + section..data]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x409400]
mov dword [edx + 0x409400], ecx
add edx, 4
cmp edx, 0x2000
jb 0x403fc6
mov eax, 0x40401c
mov esi, 0x4040b9
mov dword [0x40b408], eax
mov dword [0x40b400], eax
mov dword [0x40b404], esi
call fcn.00405722
mov ecx, dword [0x40b400]
test eax, eax
cmove ecx, esi
mov dword [0x40b400], ecx
pop esi
ret

Function at 0x404c98
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x404caa
xor eax, eax
jmp 0x404cf1
and dword [edi], 0
mov ecx, 0x400000
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push 0
push eax
cmp esi, ecx
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x404cf5
test ecx, ecx
je 0x404cee
mov ecx, 0x400000
test esi, esi
jne 0x404cb6
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x404d79
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x404d8b
xor eax, eax
jmp 0x404dd2
and dword [edi], 0
mov ecx, 0x400000
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push 0
push eax
cmp esi, ecx
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x404dd6
test ecx, ecx
je 0x404dcf
mov ecx, 0xec8b5500
jne 0x404ddd
jge 0x404ddc
adc byte [ebx + 0x3e183d9], cl
movsb byte es:[edi], byte [esi]
Function at 0x405722
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00404e67
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404e1c
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00404e67
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404e1c
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00404e57
and esi, ebx
xor ebx, esi
invalid
movsd dword es:[edi], dword [esi]
int3

Function at 0x405963
Capabilities:
Contain obfuscated stackstrings

Disassembly:
das
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
invalid
invalid
invalid
stc
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40c080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40c08f
pop dword [ebp - 0xc]
mov eax, 0xacad50c5
sub eax, 0xac6c9036
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xcedb58f3
add dword [ebp - 0x1c], 0x7f76ec58
mov dword [ebp - 0x18], 0x5cba23dd
sub dword [ebp - 0x18], 0x2a86d798
mov dword [ebp - 0x14], 0xf913b881
add dword [ebp - 0x14], 0x53388bad
mov dword [ebp - 0x10], 0xd3ff5b9c
add dword [ebp - 0x10], 0x2c00a464
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xffe33a91
sub eax, 0xffa1ea21
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x16c1b11b
add dword [ebp - 0x1c], 0x5db0b83b
mov dword [ebp - 0x18], 0x267693a
add dword [ebp - 0x18], 0x3f04f83b
mov dword [ebp - 0x14], 0xc144ec78
add dword [ebp - 0x14], 0xa22a7ff4
mov dword [ebp - 0x10], 0xc5b4e5b0
add dword [ebp - 0x10], 0x3a4b1a50
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xe4128418
sub eax, 0xe3d133a0
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d7e7
push 0
call eax
mov ecx, 0x5238
mov esi, eax
mov edi, 0x426400
add edi, dword [ebp - 0xc]
mov ebx, 0x16ac71a6
sub ebx, 0x962e8336
add dword [ebp - 8], 0x6aeba65d
mov edx, dword [edi]
xor dword [ebp - 4], 0x5abca395
xor edx, ebx
mov dword [esi], edx
sub dword [ebp - 8], 0xd12aaa20
add esi, 0x31464d5b
sub esi, 0x31464d57
add edi, 0xf31d449
sub edi, 0xf31d445
loop 0x40c1a5
add eax, 0xd9ca9231
sub eax, 0xd9c9567e
mov ebx, eax
add eax, 5
mov ecx, 0x3fa81328
sub ecx, 0x3f681328
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x3b11440
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
mov dword [ebp + eax*4 - 0x400], eax
inc eax
cmp eax, 0x100
jb 0x3b11450
mov ebx, 2
lea ecx, [ebp - 0x3fc]
lea ebx, [ebx]
xor edx, edx
lea eax, [ebx - 2]
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
add ecx, 0x10
movzx esi, byte [edx + eax]
add esi, dword [ecx - 0x14]
mov al, byte [ecx - 0x14]
add esi, edi
movzx eax, al
and esi, 0xff
mov edx, dword [ebp + esi*4 - 0x400]
mov dword [ecx - 0x14], edx
mov dword [ebp + esi*4 - 0x400], eax
xor edx, edx
lea eax, [ebx - 1]
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
movzx edi, byte [edx + eax]
add edi, dword [ecx - 0x10]
mov al, byte [ecx - 0x10]
add edi, esi
movzx eax, al
and edi, 0xff
mov edx, dword [ebp + edi*4 - 0x400]
mov dword [ecx - 0x10], edx
mov dword [ebp + edi*4 - 0x400], eax
xor edx, edx
mov eax, ebx
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
movzx esi, byte [edx + eax]
add esi, dword [ecx - 0xc]
mov al, byte [ecx - 0xc]
add esi, edi
movzx eax, al
and esi, 0xff
mov edx, dword [ebp + esi*4 - 0x400]
mov dword [ecx - 0xc], edx
mov dword [ebp + esi*4 - 0x400], eax
xor edx, edx
lea eax, [ebx + 1]
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
add ebx, 4
movzx edi, byte [edx + eax]
add edi, dword [ecx - 8]
mov al, byte [ecx - 8]
add edi, esi
and edi, 0xff
mov edx, dword [ebp + edi*4 - 0x400]
mov dword [ecx - 8], edx
movzx eax, al
lea edx, [ebx - 2]
mov dword [ebp + edi*4 - 0x400], eax
cmp edx, 0x100
jb 0x3b11470
mov eax, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
xor esi, esi
cmp dword [ebp + 0x10], ecx
jbe 0x3b115b7
jmp 0x3b11560
inc edx
and edx, 0xff
mov edi, dword [ebp + edx*4 - 0x400]
mov bl, byte [ebp + edx*4 - 0x400]
add edi, esi
and edi, 0xff
mov esi, edi
mov edi, dword [ebp + esi*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], edi
movzx edi, bl
mov dword [ebp + esi*4 - 0x400], edi
mov ebx, dword [ebp + edx*4 - 0x400]
add ebx, edi
and ebx, 0xff
movzx ebx, byte [ebp + ebx*4 - 0x400]
xor byte [ecx + eax], bl
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x3b11560
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3b11c50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x3b27138]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x3b11c7e
push 0x3b21410
push 0x3b213f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.03b13750
cmp eax, ebx
je 0x3b11cd0
mov cl, byte [ebp + 0x14]
xor edx, edx
test cl, cl
setne dl
push ebx
movzx ecx, cl
push 0x80
add edx, 2
push edx
mov edx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xc0000004
push 2
add ecx, 0x40000000
push ecx
push edx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x3b11cdf
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov bl, al
jmp 0x3b11cd3
mov esi, dword [ebp - 4]
cmp esi, 0xffffffff
je 0x3b11cdf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3b11cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x3b11e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jbe 0x3b11e91
push esi
mov esi, dword [ebp + 8]
push edi
movzx edi, byte [ecx + esi]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + section..data]
inc ecx
cmp ecx, edx
jb 0x3b11e74
pop edi
pop esi
not eax
pop ebp
ret