joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10075ed4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10075f2d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10075ed4
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10075ee3
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1047bb86
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10075f34
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1005cdaa
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10075fd3
add edi, 4
add eax, 2
dec ecx
jne 0x10075f19
call 0x10075f80
loope 0x10075f76
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10075fd0
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10075fe1
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10075f94
cmp eax, ecx
ja 0x10075f94
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1007601e
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10076014
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1005d289
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10075ee3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10075f2d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10075ed4
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10075ee3
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1047bb86
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10075f34
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1005cdaa
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10075fd3
add edi, 4
add eax, 2
dec ecx
jne 0x10075f19
call 0x10075f80
loope 0x10075f76
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10075fd0
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10075fe1
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10075f94
cmp eax, ecx
ja 0x10075f94
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1007601e
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10076014
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1005d289
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x29f60978
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
mov ecx, 0x584e7c99
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6bde08c1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x680b0c9e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401206
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.Mig1
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4030c0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x401325
push 1
push dword [0x4030c0]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Gendalf
push str.Mig1
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x4030c8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4030c8]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401325
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401308
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x40618f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d3c], 0
push esi
jne 0x4061c6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061a0
mov dword [ecx*4 + 0x426d38], eax
inc ecx
cmp ecx, 0x100
jl 0x40619b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4061f7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d38]
xor eax, esi
inc ecx
dec edx
jne 0x4061d9
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4036b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push eax
mov dword [ebp - 0xc], esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, eax
cmp ecx, 0x1000
jb 0x4036d6
sub esp, 0xffc
sub ecx, 0x1000
push eax
jmp 0x4036bf
sub esp, ecx
and esp, 0xfffffffc
mov edi, esp
push edi
mov esi, dword [ebp + 8]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x403709
push 0x10
push eax
call fcn.004030e0
cmp eax, 0x10
sete al
jmp 0x40370b
xor al, al
mov esp, dword [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebp
ret 8

Function at 0x404020
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00408f80
push eax
call sub.KERNEL32.DLL_SuspendThread
cmp eax, 0xffffffff
setne al
pop ebp
ret 4

Function at 0x404f60
Capabilities:
Accept command line arguments

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x414f3c], eax
push 0x404a20
call fcn.00411390
sub esp, 0xfffffffc
push 0x404f8b
xor eax, eax
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4113a0
add esp, 0xfffffff4
call sub.KERNEL32.DLL_GetCommandLineA
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push eax
call fcn.004115a0
mov eax, dword [esp + 4]
test eax, eax
jle 0x4113f3
push 0x104
lea ecx, [esp + 4]
push ecx
call fcn.00411460
mov eax, dword [esp]
test eax, eax
je 0x4113f3
push 0x104
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov eax, dword [esp]
cmp ecx, 0
jbe 0x4113f3
mov ecx, dword [esp + 8]
mov dword [ecx], eax
push 1
call sub.KERNEL32.DLL_SetErrorMode
push fcn.00411640
call sub.KERNEL32.DLL_SetUnhandledExceptionFilter
call fcn.00411830
mov dword [0x451cb4], 0
mov dword [0x451cb0], 0
call fcn.00411870
and eax, 0xffff
cmp eax, 2
je 0x41143c
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call fcn.0040bb50
pop eax
jmp 0x411444
push 0xffffffffffffffff
call fcn.0040bb50
pop eax
push dword [esp + 8]
push dword [esp + 8]
call dword [0x462ed0]
call fcn.00408980
sub esp, 0xffffffec
ret
Function at 0x4066d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
push eax
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
setl byte [esp]
mov dword [ecx + 0x110], 0x100
mov dword [ecx + 0x114], 0x100
test byte [ecx + 0xc], 0x80
jne 0x406704
mov dword [ecx + 4], 1
mov eax, 0x100
sub eax, dword [ecx + 4]
jg 0x406715
mov dword [ecx + 4], 0xff
cmp ebx, 0x80000000
je 0x40679b
mov al, byte [esp]
test al, al
je 0x40672d
mov edx, ebx
sar edx, 0x1f
xor ebx, edx
sub ebx, edx
test ebx, ebx
jne 0x406740
mov edx, dword [ecx + 4]
test edx, edx
jle 0x4067b0
jmp 0x406740
xor ebx, ebx
test esp, esp
mov eax, ebx
mov edx, ebx
sar edx, 0x1f
idiv dword [0x41504c]
mov eax, edx
sar eax, 0x1f
and eax, 0xa
add edx, eax
mov eax, edx
sar eax, 0x1f
xor edx, eax
sub edx, eax
mov eax, dword [ecx + 0x114]
dec eax
mov dword [ecx + 0x114], eax
add edx, 0x30
mov byte [ecx + eax + 0xe], dl
mov esi, ebx
sar esi, 0x1f
xor ebx, esi
mov eax, ebx
mul dword [0x415050]
shr edx, 2
mov ebx, edx
xor ebx, esi
mov eax, dword [ecx + 4]
dec eax
mov dword [ecx + 4], eax
test ebx, ebx
jne 0x406740
test eax, eax
jg 0x40673c
jmp 0x4067b0
push 0xb
push str.2147483648
lea eax, [esp + 0x1c]
push eax
call fcn.00406650
mov ecx, dword [esp + 0x18]
mov ax, word [ecx + 0xc]
test al, 4
je 0x4067fd
test al, 0x40
je 0x4067fd
mov edx, dword [ecx + 0x110]
sub edx, dword [ecx]
jge 0x4067c8
xor edx, edx
test al, 0x12
jne 0x4067d3
mov al, byte [esp]
test al, al
je 0x4067d4
inc edx
cmp dword [ecx + 0x114], edx
jle 0x4067fd
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x114]
mov byte [ecx + eax + 0xe], 0x30
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x114], edx
jg 0x4067dc
mov ax, word [ecx + 0xc]
test al, 0x10
je 0x406830
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov dl, byte [esp]
test dl, dl
je 0x406823
mov ebx, dword [ecx + 0x114]
mov byte [ebx + ecx + 0xe], 0x2d
jmp 0x40687b
mov ebx, dword [ecx + 0x114]
mov byte [ebx + ecx + 0xe], 0x20
jmp 0x40687b
test al, 2
je 0x40685f
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov al, byte [esp]
test al, al
je 0x406852
mov edx, dword [ecx + 0x114]
mov byte [edx + ecx + 0xe], 0x2d
jmp 0x40687b
mov edx, dword [ecx + 0x114]
mov byte [edx + ecx + 0xe], 0x2b
jmp 0x40687b
mov al, byte [esp]
test al, al
je 0x40687b
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x114]
mov byte [ecx + edx + 0xe], 0x2d
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x406890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov al, byte [esp + 0x30]
mov dx, word [ecx + 0xc]
test dl, 0x20
je 0x4068d5
mov dword [esp], 0x33323130
mov dword [esp + 4], 0x37363534
mov dword [esp + 8], 0x42413938
mov dword [esp + 0xc], 0x46454443
mov byte [esp + 0x10], 0
jmp 0x4068f9
mov dword [esp], 0x33323130
mov dword [esp + 4], 0x37363534
mov dword [esp + 8], 0x62613938
mov dword [esp + 0xc], 0x66656463
mov byte [esp + 0x10], 0
mov dword [ecx + 0x110], 0x100
mov dword [ecx + 0x114], 0x100
test dl, 8
je 0x406926
test al, al
je 0x406926
mov dword [ecx + 0x114], 0xff
mov byte [ecx + 0x10d], al
test dl, 0x80
jne 0x406932
mov dword [ecx + 4], 1
mov eax, dword [ecx + 0x114]
mov edx, eax
sub edx, dword [ecx + 4]
jg 0x406943
dec eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 4]
test eax, eax
jg 0x406950
test ebx, ebx
je 0x406981
test esp, esp
mov eax, dword [ecx + 0x114]
lea edi, [eax - 1]
mov dword [ecx + 0x114], edi
mov eax, ebx
xor edx, edx
div esi
mov al, byte [esp + edx]
mov byte [ecx + edi + 0xe], al
mov eax, ebx
xor edx, edx
div esi
mov ebx, eax
mov edx, dword [ecx + 4]
dec edx
mov dword [ecx + 4], edx
jg 0x406950
test ebx, ebx
jne 0x406950
mov ax, word [ecx + 0xc]
test al, 4
je 0x4069be
test al, 0x40
je 0x4069be
mov eax, dword [ecx + 0x110]
sub eax, dword [ecx]
jge 0x406999
xor eax, eax
cmp dword [ecx + 0x114], eax
jle 0x4069be
cmp esp, 0
mov edx, dword [ecx + 0x114]
dec edx
mov dword [ecx + 0x114], edx
mov byte [ecx + edx + 0xe], 0x30
cmp dword [ecx + 0x114], eax
jg 0x4069a4
sub esp, 0xffffffec
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x40b730
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffa8
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
push edi
call fcn.0040b880
mov ebx, eax
push esi
call fcn.0040b880
lea ebx, [ebx + eax + 4]
push ebx
call fcn.0040c200
mov edx, eax
pop ecx
test edx, edx
jne 0x40b76d
push 0x12
mov dword [esp + 4], edx
call fcn.0040cb30
mov edx, dword [esp + 4]
pop eax
push esi
push edi
push edx
mov dword [esp + 0xc], edx
call fcn.0040b8a0
mov edx, dword [esp]
push 0xfffffffffffffff6
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x44], 0x100
mov word [esp + 0x4a], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetStdHandle
mov dword [esp + 0x4c], eax
mov edx, dword [esp]
push 0xfffffffffffffff5
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetStdHandle
mov dword [esp + 0x50], eax
mov edx, dword [esp]
push 0xfffffffffffffff4
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetStdHandle
mov dword [esp + 0x54], eax
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
lea esi, [esp + 0x18]
push esi
push 0
push 0
push 0
push 1
push 0
push 0
push edx
push edi
mov dword [esp + 0x28], edx
call sub.KERNEL32.DLL_CreateProcessA
mov edx, dword [esp]
test eax, eax
je 0x40b861
push ebx
push edx
call fcn.0040c1a0
push 0xffffffffffffffff
push dword [esp + 0x10]
call sub.KERNEL32.DLL_WaitForSingleObject
sub esp, 0xfffffff8
cmp eax, 0xffffffff
je 0x40b85a
push dword [esp + 0x74]
push dword [esp + 8]
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x40b85a
push dword [esp + 8]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
je 0x40b85a
push dword [esp + 4]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
je 0x40b85a
xor eax, eax
jmp 0x40b870
call sub.KERNEL32.DLL_GetLastError
jmp 0x40b870
push ebx
push edx
call fcn.0040c1a0
call sub.KERNEL32.DLL_GetLastError
sub esp, 0xfffffff8
sub esp, 0xffffffa8
pop edi
pop esi
pop ebx
ret

Function at 0x40b990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
ret

Function at 0x40ba70
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [eax]
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
sete al
and eax, 1
ret

Function at 0x40ba90
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [0x448fe0]
mov edx, dword [0x4493e4]
test edi, edi
je 0x40baf5
cmp ecx, 0xffffffff
je 0x40bac6
push 0
lea ebx, [esp + 0x14]
push ebx
push edi
push eax
push ecx
call sub.KERNEL32.DLL_WriteFile
mov edx, dword [0x4493e4]
jmp 0x40baf5
cmp edi, 0
jbe 0x40baf5
cmp edx, 0x3ff
jae 0x40baf5
xor ecx, ecx
jmp 0x40bae0
cmp edx, 0x3ff
jae 0x40baf5
mov dword [0x4493e4], edx
mov bl, byte [eax + ecx]
mov byte [edx + 0x448fe4], bl
inc edx
inc ecx
cmp ecx, edi
jb 0x40bad8
mov dword [0x4493e4], edx
pop edi
pop ebx
ret
Function at 0x40bcb0
Capabilities:
Check if file exists

Disassembly:
push edi
add esp, 0xfffffff4
mov edi, dword [esp + 0x1c]
lea eax, [esp]
push eax
call fcn.0040bf10
test edi, 1
je 0x40bcd0
mov eax, 0x80000000
jmp 0x40bcd2
xor eax, eax
test edi, 2
je 0x40bcdf
or eax, 0x40000000
test edi, 4
je 0x40bcee
mov ecx, 2
jmp 0x40bcf3
mov ecx, 3
push 0
push dword [esp + 0xc]
push ecx
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push dword [esp + 0x30]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x40bd1b
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
xor al, al
jmp 0x40bd63
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x40bd61
cmp eax, 3
je 0x40bd5d
cmp eax, 4
je 0x40bd59
cmp eax, 5
je 0x40bd55
cmp eax, 0x20
je 0x40bd51
cmp eax, 0x21
je 0x40bd4d
cmp eax, 0x80
je 0x40bd49
mov al, 0xe
jmp 0x40bd63
mov al, 8
jmp 0x40bd63
mov al, 5
jmp 0x40bd63
mov al, 5
jmp 0x40bd63
mov al, 5
jmp 0x40bd63
mov al, 3
jmp 0x40bd63
mov al, 7
jmp 0x40bd63
mov al, 7
sub esp, 0xfffffff4
pop edi
ret

Function at 0x411870
Capabilities:
Parse pe header

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x411887
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x411894
xor ax, ax
jmp 0x4118a5
movzx ecx, word [eax + 0x14]
test ecx, ecx
je 0x4118a2
mov ax, word [eax + 0x5c]
jmp 0x4118a5
xor ax, ax
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x541d459d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x70eb2a8a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
popal
nop
nop
nop
nop
nop
jmp 0x401219