joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459210
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c4fb
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x38]
xor eax, eax
mov dword [ebp - 4], 1
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x45926d
mov esi, dword [esi]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x810]
push esi
push 0x400
push ecx
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x498014
push eax
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
cmp word [ebp - 0x810], ax
jne 0x4592c0
xor ecx, ecx
jmp 0x4592df
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4592d0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00406190
cmp dword [ebp - 0x818], 0
setne bl
cmp dword [ebp - 0x814], 8
jb 0x459313
push dword [ebp - 0x828]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
je 0x4593a0
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
cmp word [ebp - 0x810], ax
jne 0x459345
xor ecx, ecx
jmp 0x45935f
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459350
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00406190
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x4b8120
call fcn.0042c490
cmp dword [ebp - 0x814], 8
jb 0x4593ae
push dword [ebp - 0x828]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x4593ae
lea eax, [ebp + 0x20]
mov ecx, 0x4b8120
push eax
call fcn.00433f50
cmp dword [ebp + 0x1c], 8
jb 0x4593bf
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x4593e4
push dword [ebp + 0x20]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret
Function at 0x45c470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x79c], 0
je 0x45c4df
cmp dword [ebp + 8], 0x100
jne 0x45c4cf
cmp word [ebp + 0xc], 0xd
jne 0x45c4cf
cmp byte [esi + 0x7a2], 0
je 0x45c4ae
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x45c4cf
cmp byte [esi + 0x7a3], 0
jne 0x45c4cf
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x45c4c8
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.00443310
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x79c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x4734a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d46b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push eax
mov dword [edi + 0x10], esi
call fcn.00472ae0
mov ecx, esi
call fcn.00478090
mov ecx, dword [edi + 0x10]
mov esi, eax
or esi, 0x40000080
call fcn.00460a60
test al, 1
je 0x473502
or esi, 1
jmp 0x473509
test al, 2
je 0x473509
or esi, 2
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.004736e0
test al, al
je 0x47351a
or esi, 0x20
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov ecx, ebx
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ebx]
push esi
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043ef60
push eax
mov ecx, edi
call fcn.00445a90
mov ecx, dword [edi + 0x10]
call fcn.0044c730
cmp eax, 0xffffffff
je 0x473569
mov ecx, dword [edi + 0x10]
push eax
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043e8f0
test eax, eax
jne 0x47357a
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043e810
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
push 0
call fcn.004730b0
push eax
push 0xc5
push dword [edi + 4]
call esi
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.004736e0
test al, al
je 0x4735c4
push 0
mov ecx, ebx
call fcn.004730e0
movzx eax, ax
push eax
push 0xcc
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004047e0
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0043b260
push 0
push 0
push 0xb9
push dword [edi + 4]
call esi
push 0
push 3
push 0xd3
mov ecx, edi
call fcn.00445ee0
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [edi + 0x10]
push 0
call fcn.004736f0
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push 0xcf
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0x10]
call fcn.004736d0
push dword [edi + 4]
test al, al
je 0x47368d
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
mov ecx, 1
cmove eax, ecx
push eax
push 0
jmp 0x473695
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
push eax
push 0xb1
push dword [edi + 4]
call esi
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 4
Function at 0x473700
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00447020
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x473791
lea eax, [ebp - 0x14]
push eax
call fcn.00472ae0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x473767
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4737b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x47383b
cmp dword [esi + 0x10], 0
je 0x47383b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00486520
mov ebx, esp
test ebx, ebx
je 0x47383b
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.0043b300
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.00443310
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043f6a0
test al, al
je 0x47383b
mov ecx, dword [esi + 0x10]
call fcn.00446ef0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x474370
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.004497b0
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x474409
lea eax, [ebp - 0x14]
push eax
call fcn.00472ae0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4743df
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0x14

Function at 0x476fe0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d46b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [eax + 0x7f8], 0
cmp dword [edi + 4], 0
jne 0x47708d
lea eax, [ebp - 0xa4]
push eax
call fcn.00476b30
mov ecx, dword [edi + 0x10]
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043ef60
push eax
mov ecx, edi
call fcn.00445a90
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.0044c730
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043ea90
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0043bbb0
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.0043b260
test bl, bl
je 0x4770d1
mov eax, dword [edi + 0x10]
add eax, 0x7e8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, 0x7e8
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 4
Function at 0x477120
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00447020
mov ecx, dword [esi + 0x800]
test ecx, ecx
je 0x4771b1
lea eax, [ebp - 0x14]
push eax
call fcn.00476b30
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x477187
mov ecx, dword [esi + 0x800]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x800]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4772c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b5320]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.004497b0
mov ecx, dword [esi + 0x800]
test ecx, ecx
je 0x477359
lea eax, [ebp - 0x14]
push eax
call fcn.00476b30
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x47732f
mov ecx, dword [esi + 0x800]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x800]
push 0
call fcn.004519b0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00485d3c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x47ad10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.0043ef80
mov edi, eax
add esp, 8
test edi, edi
jne 0x47adb4
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x47ada9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x47ada9
push eax
mov dword [ebp + 8], edi
call sub.MSVCR120.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov edi, eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp dword [ebp + 8], eax
je 0x47ada5
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x47adb7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, ebx
call fcn.0047ade0
push edi
mov esi, eax
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x482840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x482867
cmp eax, edi
jge 0x48285f
push esi
call fcn.0047e6b0
add esp, 4
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x482890
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x482873
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x4828ac
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x48289d
xor dl, dl
jmp 0x4828a2
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x482893
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4828e1
pop edi
pop esi
mov dword [ebp + 8], str.zlib_corrupt
pop ebp
jmp fcn.0047e5c0
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4828f9
pop edi
pop esi
mov dword [ebp + 8], str.read_past_buffer
pop ebp
jmp fcn.0047e5c0
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x482917
push edi
push ecx
push esi
call fcn.00485ac0
add esp, 0xc
test eax, eax
jne 0x482917
pop edi
pop esi
pop ebp
ret
push edi
push dword [esi]
push dword [esi + 0x10]
call sub.MSVCR120.dll_memcpy
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x40275991
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4e864ad0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6acc1fc7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x8784e44
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx