joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaaf960
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3c8000]
push edi
or ebp, 0xffffffff
jmp 0xaaf982
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xaaf989
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaf978
mov eax, 1
add ebx, ebx
jne 0xaaf99b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xaaf9ac
jne 0xaaf9cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaf9cb
dec eax
add ebx, ebx
jne 0xaaf9b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xaaf990
add ebx, ebx
jne 0xaaf9c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xaafa1d
xor ecx, ecx
sub eax, 3
jb 0xaaf9e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xaafa52
sar eax, 1
mov ebp, eax
jmp 0xaaf9ee
add ebx, ebx
jne 0xaaf9ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaf9bc
inc ecx
add ebx, ebx
jne 0xaaf9fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaaf9bc
add ebx, ebx
jne 0xaafa09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xaaf9fe
jne 0xaafa1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xaaf9fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xaafa3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xaafa2e
jmp 0xaaf97e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xaafa3c
add edi, ecx
jmp 0xaaf97e
pop esi
mov edi, esi
mov ecx, 0x3c00
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xaafa5a
cmp byte [edi], 0x1e
jne 0xaafa5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xaafa5f
lea edi, [esi + 0x6ac000]
mov eax, dword [edi]
or eax, eax
je 0xaafad7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x709fa0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x70a0b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xaafa8c
mov ecx, edi
jns 0xaafabb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x70a0bc]
or eax, eax
je 0xaafad1
mov dword [ebx], eax
add ebx, 4
jmp 0xaafaa9
call dword [esi + 0x70a0c4]
mov ebp, dword [esi + 0x70a0c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xaafb0b
sub esp, 0xffffff80
jmp 0x48cd14
Function at 0x4014c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0xa0000000
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4014eb
xor al, al
pop esi
pop ecx
ret
push 0
lea ecx, [esp + 8]
push ecx
push 0x200
push 0x40f4e0
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 4], 0x200
sete al
pop esi
pop ecx
ret

Function at 0x401d80
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push edi
xor eax, eax
mov ecx, 0x80
mov edi, ebx
rep stosd dword es:[edi], eax
mov al, byte [0x40f296]
test al, al
je 0x401dee
mov eax, dword [esp + 0x18]
mov ecx, 0x200
mul ecx
push esi
mov esi, dword [esp + 0x18]
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push eax
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edi, dword [esp + 0x20]
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, edi
shl ecx, 9
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 0xc]
test eax, eax
pop esi
jne 0x401e10
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebx
push edi
push edx
push eax
call fcn.00401710
add esp, 0x10
test eax, eax
jne 0x401e10
pop edi
pop ebx
add esp, 8
ret
mov eax, edi
pop edi
pop ebx
add esp, 8
ret

Function at 0x401e20
Capabilities:
Write file on windows

Disassembly:
mov al, byte [0x40f296]
sub esp, 8
test al, al
push edi
je 0x401e81
mov eax, dword [esp + 0x14]
mov ecx, 0x200
mul ecx
push esi
mov esi, dword [esp + 0x14]
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0
lea eax, [esp + 0xc]
push eax
mov ecx, edi
shl ecx, 9
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
test eax, eax
pop esi
jne 0x401ea6
xor eax, eax
pop edi
add esp, 8
ret
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
push edi
push ecx
push edx
call fcn.004017d0
add esp, 0x10
test eax, eax
jne 0x401ea6
pop edi
add esp, 8
ret
mov eax, edi
pop edi
add esp, 8
ret
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x53f74be7
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x780101fb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3ddb0825
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x68af3bf3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403bab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.0040381c
push eax
push esi
push dword [ebp + 8]
call fcn.004037d1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040381c
push eax
push esi
push dword [ebp + 8]
call fcn.004037d1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040381c
push eax
push esi
push dword [ebp + 8]
call fcn.004037d1
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040380c
jmp 0x88b2bd88

Function at 0x405a73
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x4083f8
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x4083e8
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405ac4
xor eax, eax
jmp 0x405aeb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405aeb
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x405ac0
call esi
pop esi
leave
ret 4

Function at 0x405b25
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x45e750], 0x44
push eax
xor eax, eax
push 0x45e750
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405b64
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x402634
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
call esi
cmp eax, 0xffffffff
je 0x402655
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
pop esi
jne 0x402682
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402682
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x402682
push 4
push eax
lea eax, [ebp - 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x402689
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
and dword [ebp - 4], 0
imul edx, edx, 0x9e3779b9
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
je 0x4026fe
mov esi, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, ecx
sub dword [ebp - 4], 0x61c88647
add ebx, eax
lea eax, [ebx + edi]
mov edi, eax
mov ebx, eax
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, eax
add ebx, ecx
cmp dword [ebp - 4], edx
lea ecx, [ebx + edi]
jne 0x4026ac
mov esi, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
leave
ret

Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
mov ecx, 0x55600863
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x1d7d125d
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x1d0da1c
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
jmp 0x1d0da26
pushal
call 0x1d0da2c
pop ebp
sub ebp, 0x10
sub ebp, 0x190da1c
jmp 0x1d0da42
mov eax, 0x190da1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x56881b92
xor byte [eax], dl
inc eax
dec ecx
jne 0x1d0da59
jmp 0x1d0da6c
sbb dword [edi + 0x19], ebx
sbb ebp, dword [esi + 0x13929292]
push ebx
push 0xffffffffffffff92
xchg edx, eax
xchg edx, eax
xchg ecx, eax
pop edi
sub dl, byte [esi + 0x28929292]
mov edx, 0x65929292
jo 0x1d0da1a
pop edx
sbb dword [ebx], edx
sahf
xchg edx, eax
xchg edx, eax
xchg edx, eax
xchg ecx, eax
push edi
ret 0xf61f
Function at 0x401a00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x401a5b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401a20
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x401a3c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004010c0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x401a7d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401aef
mov esi, dword [ebx]
cmp esi, ebx
je 0x401aef
test esi, esi
je 0x401aef
cmp word [esi + 0x24], 2
jbe 0x401ae9
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401ae9
cmp dword [esi + 0x18], 0
je 0x401ae9
test ebp, ebp
je 0x401aa5
cmp ebp, eax
jne 0x401ae9
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004010c0
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x401aca
cmp edx, dword [esi + 0x18]
jne 0x401ae9
cmp dword [esp + 0x14], eax
je 0x401afc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403f40
add esp, 8
test eax, eax
je 0x401afc
mov esi, dword [esi]
cmp esi, ebx
jne 0x401a83
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x401b90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x819208]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x401d3d
cmp dword [0x81920c], 0
jne 0x401d29
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00401b60
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401be0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41e0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x401bf0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41e0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401c25
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401b60
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401c84
sub edx, esi
sar edx, 1
je 0x401d3d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401ca0
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x401d3d
xor eax, eax
push ebx
test edx, edx
je 0x401cd8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401cd8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401cc1
xor eax, eax
test edx, edx
je 0x401cf2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x401cf2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401ce0
xor eax, eax
test edx, edx
je 0x401d0f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x401d0f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401d00
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x819208]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x403b20
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x819348
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403c49
cmp dword fs:[0xc0], eax
je 0x403b4b
mov dword [0x819344], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x81922c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x819230], eax
movzx edx, word [esi + 0xac]
mov dword [0x819234], edx
mov eax, dword [esi + 0xb0]
mov dword [0x819238], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x403bab
push 0x7f
push eax
push 0x81923c
call fcn.004010c0
mov edx, dword [0x819234]
add esp, 0xc
jmp 0x403bb3
xor eax, eax
mov word [0x81923c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x81933c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x81933e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x819340], ax
mov ecx, eax
mov byte [0x819342], 0
cmp byte [0x7ffe0268], 0
je 0x403bfa
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x819342], bl
cmp ebx, 1
pop ebx
jne 0x403c14
and ecx, 0xffef
mov word [0x819340], cx
test edx, edx
jne 0x403c49
call fcn.00403b20
cmp dword [0x81922c], 6
ja 0x403c49
jb 0x403c31
cmp dword [0x819230], 4
jae 0x403c49
call fcn.00403b20
cmp dword [0x81922c], 0xa
jae 0x403c49
mov dword [0x819234], 1
ret
Function at 0x404050
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40409b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40408b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x404071
jmp 0x404090
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4040eb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x4040b0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4040b0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4040cc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004010c0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40410d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x404180
mov esi, dword [ebx]
cmp esi, ebx
je 0x404180
test esi, esi
je 0x404180
cmp word [esi + 0x24], 2
jbe 0x40417a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40417a
cmp dword [esi + 0x18], 0
je 0x40417a
test ebp, ebp
je 0x404135
cmp ebp, eax
jne 0x40417a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004010c0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40415a
cmp eax, dword [esi + 0x18]
jne 0x40417a
cmp dword [esp + 0x10], 0
je 0x40418d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403f40
add esp, 8
test eax, eax
je 0x40418d
mov esi, dword [esi]
cmp esi, ebx
jne 0x404113
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret