joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51af660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sal byte [esi + eax - 1], cl
test dword [edi + edi*8 - 1], esi
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.051af37b
loope 0x51af666
invalid
inc esi
xchg esp, eax
lea eax, [ebp - 0x40]
push eax
call fcn.051af38b
push eax
push esi
push dword [ebp + 8]
call fcn.051af340
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.051af37b
paddsw mm3, qword [eax]
call 0x8e033c73
pop ebp
call 0xee787f3c
mov byte [ebp - 0x16], 0x40
Function at 0x51b5560
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
push 1
mov esi, ecx
mov ecx, dword [esi + 0x2c]
push str.FT_H
push 0
call fcn.05003d00
mov edi, eax
test edi, edi
jne 0x51b558b
push str.InitLocalPart__:_can_not_get_DLStructDef_of_FT_H_from_primitiveDbHandle_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esi + 0x2c]
push str.header.ref_count
push str.FT_H
call fcn.05003fa0
mov dword [esi + 8], eax
test eax, eax
jne 0x51b55b4
push str.InitLocalPart__:_can_not_get_header.ref_count_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esi + 0x2c]
push str.header.msg_len
push str.FT_H
call fcn.05003fa0
mov dword [esi + 0xc], eax
test eax, eax
jne 0x51b55dd
push str.InitLocalPart__:_can_not_get_header.msg_len_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esi + 0x2c]
push str.token
push edi
call fcn.05003f20
mov dword [esi + 0x10], eax
test eax, eax
jne 0x51b5602
push str.InitLocalPart__:_can_not_get_token_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esi + 0x2c]
push 0x5398a90
push edi
call fcn.05003f20
mov dword [esi + 0x14], eax
test eax, eax
jne 0x51b5627
push str.InitLocalPart__:_can_not_get_id_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
ret
pop edi
mov al, 1
pop esi
ret

Function at 0x51b8f78
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
push edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], edx
mov edi, dword [ecx]
push eax
mov eax, dword [edi]
push edx
call eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
mov edx, dword [edx]
push eax
mov eax, dword [esi + 8]
push eax
call edx
push str._META__CMetaDhlFrameCommModule::SetMetaHandle__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
ret 8

Function at 0x51bc808
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
push edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], edx
mov edi, dword [ecx]
push eax
mov eax, dword [edi]
push edx
call eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
mov edx, dword [edx]
push eax
mov eax, dword [esi + 8]
push eax
call edx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
push edx
mov edx, dword [esi + 8]
push edx
call eax
push str._META__CMetaTstFrameCommModule::SetMetaHandle__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
ret 8
Function at 0x51be3d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi]
cmp byte [ecx + 0x30], 0
lea eax, [ecx + 0x30]
jne 0x51be409
test ecx, ecx
je 0x51be405
mov eax, dword [ecx + 0x130]
push str.DumpFileWriter::OnDumpBegin
push 0x6fd
push str..MemoryDumpMemoryDumpMain.cpp
push str._MemoryDump__File___s__Line___d__Function___s:__Error__share_data__dump_file_path_is_empty_n
push eax
call fcn.051be010
add esp, 0x14
xor al, al
pop esi
ret
push ebp
push 0x529bc0c
lea ebp, [esi + 4]
push eax
push ebp
mov dword [ebp], 0
call dword [sym.imp.MSVCR90.dll_fopen_s]
add esp, 0xc
cmp dword [ebp], 0
jne 0x51be458
mov esi, dword [esi]
test esi, esi
je 0x51be453
mov ecx, dword [esi + 0x130]
push str.DumpFileWriter::OnDumpBegin
push 0x706
push str..MemoryDumpMemoryDumpMain.cpp
push str._MemoryDump__File___s__Line___d__Function___s:__Error__dump_file_handle__NULL_n
push ecx
call fcn.051be010
add esp, 0x14
pop ebp
xor al, al
pop esi
ret
lea ecx, [esi + 8]
push ebx
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x51be462
sub eax, edi
mov ebx, eax
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x51be472
sub eax, edi
mov edi, eax
mov eax, dword [ebp]
push eax
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_fwrite]
push 1
push ecx
call ebx
add esp, 0x10
cmp eax, edi
je 0x51be4a6
mov esi, dword [esi]
test esi, esi
je 0x51be4e8
push str.DumpFileWriter::OnDumpBegin
push 0x70c
jmp 0x51be4cf
mov eax, dword [ebp]
push eax
push 4
lea ecx, [esi + 0x108]
push 1
push ecx
call ebx
add esp, 0x10
cmp eax, 4
je 0x51be4ef
mov esi, dword [esi]
test esi, esi
je 0x51be4e8
push str.DumpFileWriter::OnDumpBegin
push 0x712
mov edx, dword [esi + 0x130]
push str..MemoryDumpMemoryDumpMain.cpp
push str._MemoryDump__File___s__Line___d__Function___s:__Error__fwrite_fail_n
push edx
call fcn.051be010
add esp, 0x14
pop edi
pop ebx
pop ebp
xor al, al
pop esi
ret
mov eax, dword [ebp]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 4
pop edi
pop ebx
pop ebp
mov al, 1
pop esi
ret
Function at 0x51be700
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x51be739
mov esi, dword [esi]
test esi, esi
je 0x51be733
mov eax, dword [esi + 0x130]
push str.DumpFileWriter::WriteFileSize
push 0x741
push str..MemoryDumpMemoryDumpMain.cpp
push str._MemoryDump__File___s__Line___d__Function___s:__Error__dump_file_handle__NULL_n
push eax
call fcn.051be010
add esp, 0x14
xor al, al
pop esi
ret 4
push eax
push 4
lea ecx, [esp + 0x10]
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 4
je 0x51be780
mov esi, dword [esi]
test esi, esi
je 0x51be733
mov edx, dword [esi + 0x130]
push str.DumpFileWriter::WriteFileSize
push 0x747
push str..MemoryDumpMemoryDumpMain.cpp
push str._MemoryDump__File___s__Line___d__Function___s:__Error__fwrite_fail_n
push edx
call fcn.051be010
add esp, 0x14
xor al, al
pop esi
ret 4
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 4
mov al, 1
pop esi
ret 4

Function at 0x51be7a0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x51be7d9
mov esi, dword [esi]
test esi, esi
je 0x51be7d3
mov eax, dword [esi + 0x130]
push str.DumpFileWriter::WriteContent
push 0x754
push str..MemoryDumpMemoryDumpMain.cpp
push str._MemoryDump__File___s__Line___d__Function___s:__Error__dump_file_handle__NULL_n
push eax
call fcn.051be010
add esp, 0x14
xor al, al
pop esi
ret 8
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, edi
pop edi
je 0x51be824
mov esi, dword [esi]
test esi, esi
je 0x51be7d3
mov edx, dword [esi + 0x130]
push str.DumpFileWriter::WriteContent
push 0x75a
push str..MemoryDumpMemoryDumpMain.cpp
push str._MemoryDump__File___s__Line___d__Function___s:__Error__fwrite_fail_n
push edx
call fcn.051be010
add esp, 0x14
xor al, al
pop esi
ret 8
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 4
mov al, 1
pop esi
ret 8
Function at 0x406802
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x406811
pop dword [ebp - 0x30]
mov eax, 0x547becdc
sub eax, 0x543b84cb
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x1f26db6a
add dword [ebp - 0x40], 0x2f2b69e1
mov dword [ebp - 0x3c], 0x6cb2e1c0
sub dword [ebp - 0x3c], 0x3a7f957b
mov dword [ebp - 0x38], 0x89ddc537
add dword [ebp - 0x38], 0xc26e7ef7
mov dword [ebp - 0x34], 0x29bc258f
add dword [ebp - 0x34], 0xd643da71
lea eax, [ebp - 0x40]
push eax
mov eax, 0x5d35b14d
sub eax, 0x5cf4d051
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x6c91bdd1
sub dword [ebp - 0x40], 0xf81f547b
mov dword [ebp - 0x3c], 0x81433803
add dword [ebp - 0x3c], 0xc0292972
mov dword [ebp - 0x38], 0xa582ee45
add dword [ebp - 0x38], 0xbdec7e27
mov dword [ebp - 0x34], 0xccdbda37
add dword [ebp - 0x34], 0x332425c9
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xfcd15f5c
add eax, 0x36f812c
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3d5f2
push 0
call eax
mov ecx, 0x5ead
mov ebx, eax
mov esi, 0x402d1da5
add esi, 0xc014d25b
add esi, dword [ebp - 0x30]
mov edi, 0x8aec05f7
add edi, 0x989f39a5
add dword [ebp - 0x14], 0x5fcfb93
mov edx, dword [esi]
sub dword [ebp - 0x18], 0x2aae1a43
add edx, edi
xor dword [ebp - 0x1c], esi
mov dword [ebx], edx
mov dword [ebp - 0xc], 0x761fb30b
add ebx, 0xd660d674
add ebx, 0x299f2990
add esi, 0x5b1f9492
add esi, 0xa4e06b72
loop 0x40692d
add eax, 0x8d002c2d
add eax, 0x7301415a
mov ebx, eax
add eax, 0xff9bdce8
add eax, 0x64231d
mov ecx, 0xfbb6dffc
sub ecx, 0xfb76dffc
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x406b16
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x40d6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x110]
lea eax, [ebp]
mov edi, dword [ebp + 0x114]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406bb4
cmp eax, ebx
jae 0x406bb4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004060ea
pop ecx
pop ecx
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
jmp 0x406ba7
push esi
lea ecx, [edi + 0x18]
call fcn.00403db8
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x406b9b
lea ecx, [ebp - 0x18]
call fcn.0040422a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.0040baa8
add ebp, 0x108
leave
ret
Function at 0x1000783d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x10041c30
call fcn.10009a30
mov dword [ebp - 0x30], edx
mov ebx, ecx
xor esi, esi
test ebx, ebx
jne 0x1000785d
push esi
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10007874
push 0xc1
jmp 0x10007985
mov edi, dword [ebx + 0x3c]
cmp dword [edi + ebx], 0x4550
je 0x1000788a
push 0xbf
jmp 0x10007985
cmp word [edi + ebx + 0x14], si
je 0x10007980
mov edi, dword [edi + ebx + 0x78]
lea eax, [edi + ebx]
neg edi
sbb edi, edi
and edi, eax
mov dword [ebp - 0x28], edi
je 0x10007980
mov ecx, dword [edi + 0x1c]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x34], ecx
mov edx, dword [edi + 0x20]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x24], edx
mov eax, esi
mov dword [ebp - 0x1c], esi
cmp eax, dword [edi + 0x14]
jae 0x10007957
test ecx, ecx
je 0x100078f4
mov edx, dword [ecx + eax*4]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
jmp 0x100078f6
mov edx, esi
mov ecx, esi
mov eax, esi
mov dword [ebp - 0x20], esi
cmp eax, dword [edi + 0x18]
jae 0x10007927
mov edi, dword [ebp - 0x24]
movzx eax, word [edi + eax*2]
cmp eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
jne 0x1000794e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000794a
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x10]
add eax, dword [ebp - 0x1c]
push edx
push ecx
push eax
push dword [ebp - 0x30]
mov eax, 0x10006382
call eax
test eax, eax
je 0x10007957
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
jmp 0x100078dd
mov ecx, esi
jmp 0x10007927
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x100078fd
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x10007994
push 0xc0
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10011397
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100113a6
pop dword [ebp - 0x40]
mov eax, 0x100113a6
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x4497a
push 0
mov eax, 0x5d7d4519
add eax, 0xb285eb3b
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4ac3
mov edi, eax
mov ebx, 0xa7699f5b
add ebx, 0x689b16a5
add ebx, dword [ebp - 0x40]
mov edx, 0x35d1f9f0
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0x8746cebc
add esi, edx
sub dword [ebp - 0x14], 0x753acc9a
mov dword [edi], esi
xor dword [ebp - 0x20], 0xda87745b
add edi, 0x33c005e3
add edi, 0xcc3ffa21
add ebx, 4
loop 0x100113f4
add eax, 0xca529054
sub eax, 0xca517275
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401271
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
push ecx
pop esi
sub ecx, ecx
mov edx, dword [esi + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
add edx, esi
mov dword [eax], ecx
mov eax, 0x14c
push edi
push ecx
pop edi
cmp word [edx + 4], ax
jne 0x4013b8
push ebx
mov ebx, dword [edx + 0x88]
mov dword [ebp - 0x14], ebx
or ebx, ebx
je 0x4013b7
cmp dword [edx + 0x8c], ecx
je 0x4013b7
movzx eax, word [edx + 0x14]
add eax, 0x18
add eax, edx
movzx edx, word [edx + 6]
or edx, edx
je 0x4013b7
cmp dword [eax + 0xc], ebx
je 0x4012e2
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x4012d0
jmp 0x4013b7
mov edx, dword [eax + 0x14]
add edx, esi
push 0
movzx ecx, word [edx + 0xe]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ecx
pop ebx
je 0x4013b7
xor eax, eax
mov esi, dword [edx + eax*8 + 0x14]
and esi, 0x7fffffff
add esi, edx
push 0
movzx ecx, word [esi + 0xe]
movzx eax, word [esi + 0xc]
add ecx, eax
mov dword [ebp - 0x18], ecx
pop ecx
mov dword [ebp - 0xc], ecx
je 0x4013aa
xor eax, eax
cmp word [esi + eax*8 + 0x10], 0x65
jne 0x40139a
mov ecx, dword [esi + eax*8 + 0x14]
and ecx, 0x7fffffff
add ecx, edx
mov dword [ebp - 8], 0
movzx eax, word [ecx + 0xe]
mov dword [ebp - 4], eax
movzx eax, word [ecx + 0xc]
add dword [ebp - 4], eax
je 0x401393
sub eax, eax
mov edx, 0x409
cmp word [ecx + eax*8 + 0x10], dx
mov edx, dword [ebp - 0x10]
je 0x401376
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
movzx eax, ax
cmp eax, dword [ebp - 4]
jb 0x401356
jmp 0x401393
mov ecx, dword [ecx + eax*8 + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx + edx]
sub eax, dword [ebp - 0x14]
add eax, edx
mov dword [edi], eax
mov eax, dword [ecx + edx + 4]
mov ecx, dword [ebp + 0x10]
sub edi, edi
mov dword [ecx], eax
inc edi
or edi, edi
jne 0x4013b7
mov ecx, dword [ebp - 0xc]
inc ecx
movzx eax, cx
mov dword [ebp - 0xc], ecx
cmp eax, dword [ebp - 0x18]
jb 0x401329
or edi, edi
jne 0x4013b7
inc ebx
movzx eax, bx
cmp eax, dword [ebp - 0x1c]
jb 0x401302
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x4013f3
mov al, byte [ebp + 0xc]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [ebp + 8]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x4013d6
jmp 0x4013f6
mov eax, dword [ebp + 8]
test edi, edi
je 0x401400
xor byte [esi], al
inc esi
dec edi
jne 0x4013fa
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0x4394c8
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047950e
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x397139ce
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1c8a3590
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401c66
pop dword [ebp - 0x44]
mov eax, 0x84b86c1a
add eax, 0x7b87b04c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x980e0376
sub dword [ebp - 0x54], 0x49bbbe2b
mov dword [ebp - 0x50], 0xdee5b04f
sub dword [ebp - 0x50], 0xacb2640a
mov dword [ebp - 0x4c], 0x7aabb303
sub dword [ebp - 0x4c], 0x2e5f6ed5
mov dword [ebp - 0x48], 0xf6a0c55a
add dword [ebp - 0x48], 0x95f3aa6
lea eax, [ebp - 0x54]
push eax
mov eax, 0x2eff6766
sub eax, 0x2ebf3712
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x89c6329f
add dword [ebp - 0x54], 0xeaac36b7
mov dword [ebp - 0x50], 0xc441f3b3
sub dword [ebp - 0x50], 0x82d5923e
mov dword [ebp - 0x4c], 0xe7f757ae
sub dword [ebp - 0x4c], 0x8487eb42
mov dword [ebp - 0x48], 0xce075547
add dword [ebp - 0x48], 0x31f8aab9
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xf9cf8052
sub eax, 0xf98f5026
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37806
push 0
call eax
mov ecx, 0xfecb7eb6
add ecx, 0x134cd5f
mov ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x44]
mov edi, 0x702efb1e
mov dword [ebp - 0x38], 0x2b6ef0cb
mov edx, dword [esi]
sub edx, edi
xor dword [ebp - 0x14], 0xb7518996
mov dword [ebx], edx
sub dword [ebp - 0x30], 0x96a5de43
add ebx, 0x72e9ad5a
sub ebx, 0x72e9ad56
add esi, 0xcf95bdde
sub esi, 0xcf95bdda
loop 0x401d7c
add eax, 0x98212b4d
sub eax, 0x98200826
xor ebx, ebx
add ebx, eax
add eax, 0xd29b2dc7
add eax, 0x2d64d23e
mov ecx, 0x58c56172
add ecx, 0xa77a9e8e
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x415224
Capabilities:
Encode data using xor

Disassembly:
cdq
in al, dx
mov ah, 0xc0
xor eax, dword ss:[ebp + 0x42]
add al, 0x84
inc ebx
xlatb
xor ah, byte [esi + 0x6c4cb221]
push cs
invalid
wait
xor eax, dword [esi + edx*4 + 0x21]
fld dword [ebp - 0x40]
sahf
inc ecx
mov al, 0xf0
dec esi
mov esi, 0xd87a5808
jp 0x4151b7
cmp eax, 0xe41a2c88
and edx, esp
adc ecx, eax
shr byte [esi + 0x39], 0
test al, 0x32
sbb al, 0xc9
inc edi
test eax, 0xdd5a08da
inc esi
pop esi
aaa
push edi
fmul dword [ebp - 0x64]
xor cl, byte ss:[ecx - 0x39]
test al, 0x5d
push esi
sub eax, 0x2d8c2e2
fidivr dword [edi]
inc ecx
sbb byte [esi + edx + 0x72de5688], 0x11
pushfd
push ss
mov byte [esi - 0x22], dl
jb 0x415225
xor byte [edx + 0x352b1f0b], al
jno 0x4151cd
push cs
push 0x9e86201e
dec esp
loopne 0x4151dd
invalid
mov eax, 0x4438ec
push eax
in al, dx
cmp byte [eax + eax + 0x50], al
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x4152a4
arpl word [edx + esi], si
adc eax, 0x31ae91a0
ficom dword [ecx + 0x6060ff6c]
add ah, ah
add dword [eax - 0x60], 0xffffffa1
loope 0x41528c
sub eax, dword [ecx - 0x73]
add byte [edi - 0x2efda8fc], ch
adc ah, byte [ebx - 0x37]
mov word [ebx - 0x48], cs
and eax, 0x97492f32
adc dword [edx + 0x4d], ebp
push eax
dec edi
mov dword [ebp - 0x56da9f3c], esp
xchg edx, eax
and dword [esi + 0x5b244ae4], edx
loop 0x4152ae
adc bh, byte [eax + 0x49]
mov ecx, 0xf40c8f60
jecxz 0x41520d
jle 0x415292
xor al, 0xa1
xlatb
inc esi
inc esi
add cl, al
bound ebp, qword [ecx + eax]
sub al, 1
xchg esi, eax
enter 0x4b9, 0x5b
ret 0x12f3
and eax, 0x58c48046
sub ch, cl
xchg esp, eax
inc esp
lodsd eax, dword [esi]
les edx, [ebp + 0x62]
les edx, [edx]
pop edi
leave
pop eax
dec ebx
lcall 0xc996, 0xe12e7225
mov esp, 0x836c5d84
adc bh, byte [ebp + 0x22]
and eax, 0x9501108a
pushal
dec edx
les edx, [ebp - 0x7e]
sub dl, byte [edx]
arpl word [ecx], cx
scasb al, byte es:[edi]
dec ebx
mov esi, 0xb928d325
xchg edi, eax
mov al, byte [0x26c508b2]
mov dword [edi - 0x4cdaad3c], esp
adc dl, byte [ebx - 0x6a]
sbb byte [ebx + 0x76], cl
pop esp
mov dl, 0x2d
cdq
jbe 0x415296
lodsb al, byte [esi]
bound edx, qword [ecx]
add byte [eax + 0x43ecccb5], 0xac
arpl word [esi - 0x20], sp
movsd dword es:[edi], dword [esi]
push ebp
mov bl, 0x6f
mov al, byte [0x8fa62eca]
rcl byte [eax - 0x59d0852], cl
jp 0x415332
adc al, 0xda
push ebp
or ch, byte [ecx + 0x6d460a3c]
add edi, dword [ebp - 0x74adcb67]
pop edx
ja 0x415372
lahf
jle 0x415328
adc ebp, dword [edx + 3]
push 3
xchg ebx, eax
rcl dword [edi + 0x36eb2509], cl
sub al, 0x1e
push ds
push esp
sal byte [edx], cl
outsb dx, byte [esi]
pop ebp
and al, 0x61
push es
test eax, 0x8aa5e7d
shr byte [ebp + edi*4 + 0x22], 1
cmp ebx, dword [ecx - 0xd5d791f]
adc dword es:[ebp + 1], ebx
in al, dx
pop ecx
xor byte [ebp - 0x2f], dh
mov al, 0x80
invalid
or dword [edi + esi*2], 0xdb27cfca
hlt