joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df2c6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9338
push 0x4e095c
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x35
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.004e0b50
add esp, 4
test eax, eax
je 0x4df30a
mov ecx, eax
call fcn.004e0600
mov dword [ebp - 0x1c], eax
jmp 0x4df311
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x24], eax
call fcn.004e0560
test eax, eax
je 0x4df352
cmp dword [ebp - 0x1c], 0
je 0x4df348
mov ecx, dword [ebp - 0x1c]
call fcn.004e0670
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004e0b60
add esp, 4
mov eax, 0x7895
jmp 0x4df485
wait
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.004dfcf0
mov ecx, dword [ebp - 0x1c]
call fcn.004df7f0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
call fcn.004dfb60
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x4df3b0
mov esi, eax
test esi, esi
je 0x4df39e
mov ecx, esi
call fcn.004e0670
push esi
call fcn.004e0b60
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x4df485
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x4df3cc
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004df5c0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x4df410
mov esi, eax
test esi, esi
je 0x4df401
mov ecx, esi
call fcn.004e0670
push esi
call fcn.004e0b60
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x4df485
cmp dword [ebp - 0x2c], 0
jne 0x4df41c
mov eax, dword ds:[0]
mov ecx, dword [ebp - 0x1c]
call fcn.004df9d0
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x7895
wait
jmp 0x4df454
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x4df468
mov dword [ebp - 0x20], 0x7895
cmp dword [ebp - 0x1c], 0
je 0x4df482
mov ecx, dword [ebp - 0x1c]
call fcn.004e0670
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004e0b60
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4df4a0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [ecx + 0xc], 0x45f479d7
mov dword [ecx], 0
mov esi, ecx
mov dword [ecx + 0x18], 0xf3cb3e57
mov dword [esi + 0x1c], 0x40092ee0
mov dword [esi + 8], 0x75bbf938
mov dword [esi + 0x10], 0xfd3371b0
mov dword [esi + 0x20], 0x8a4406c7
mov dword [esi + 0x24], 0x2cc8e4f
mov dword [esi + 0x28], 0xd12c3bc9
mov dword [esi + 0x30], 0xebcc478b
mov dword [esi + 0x34], 0x489225be
mov dword [esi + 0x38], 0xafda13f8
mov dword [esi + 0x10], 0x3f4cdc6c
mov dword [esi + 0x28], 0xea71e659
mov dword [esi + 8], 0x1d6efe4e
mov dword [esi + 0x30], 0x5a92a305
mov dword [esi + 0x34], 0x412b44f5
xor eax, eax
mov ecx, eax
inc eax
xor ecx, 0x3c2d1e0f
cmp eax, 0x1e
not ecx
mov dword [esi + eax*4 + 0x38], ecx
jl 0x4df51c
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x28]
mov edx, eax
or edx, edi
and eax, edi
and edx, dword [esi + 0x10]
or edx, eax
mov eax, ecx
shl eax, 5
shr ecx, 0x1b
or eax, ecx
add edx, eax
mov eax, edi
shr eax, 2
add edx, dword [esi + 0x24]
shl edi, 0x1e
add edx, 0x5a837999
or eax, edi
add dword [esi + 0x20], edx
mov dword [esi + 0x38], eax
call fcn.004df290
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 8]
xor ecx, dword [esi + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x20]
xor ecx, edi
mov edx, eax
shl edx, 5
shr eax, 0x1b
or edx, eax
mov eax, edi
shr eax, 2
add ecx, edx
shl edi, 0x1e
add ecx, dword [esi + 0x24]
add ecx, 0x5a837999
or eax, edi
pop edi
add dword [esi + 0x10], ecx
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
ret

Function at 0x4dfc00
Capabilities:
Resolve function by hash

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x1c]
push edi
push 0xec0e4e8e
call fcn.004df8b0
mov ecx, dword [esi + 0x14]
push edi
push 0xffd97fb
mov dword [ecx], eax
call fcn.004df8b0
mov ecx, dword [esi + 0x14]
push edi
push 0x7c0017a5
mov dword [ecx + 4], eax
call fcn.004df8b0
mov ecx, dword [esi + 0x14]
push edi
push 0x4dc9d5a0
mov dword [ecx + 8], eax
call fcn.004df8b0
mov ecx, dword [esi + 0x14]
push edi
push 0x753a4fc
mov dword [ecx + 0xc], eax
call fcn.004df8b0
mov edi, dword [0x4d8bd0]
mov ecx, 0x4d8bcc
lea edx, [esp + 8]
mov dword [0x4d8b90], eax
mov eax, dword [ecx]
push edx
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov cl, byte [ecx + 0xc]
mov dword [edx + 4], edi
mov dword [edx + 8], eax
mov byte [edx + 0xc], cl
mov ecx, esi
call fcn.004dfb10
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
mov dword [0x4d8b98], edx
call fcn.004df9b0
mov dword [esi], eax
test eax, eax
je 0x4dfcda
push eax
push 0xa84aeb81
call fcn.004df8b0
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
push eax
push 0xfcba95ab
call fcn.004df8b0
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
push edx
push 0x35e273e6
call fcn.004df8b0
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4e0696
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d93a0
push 0x4e095c
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.004e0b50
add esp, 4
test eax, eax
je 0x4e06e1
mov ecx, eax
call fcn.004e0600
mov dword [ebp - 0x1c], eax
jmp 0x4e06e8
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.004e0560
test eax, eax
je 0x4e0722
cmp dword [ebp - 0x1c], 0
je 0x4e0718
mov ecx, dword [ebp - 0x1c]
call fcn.004e0670
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004e0b60
add esp, 4
mov eax, 0x2a
jmp 0x4e084e
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.004dfb60
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x4e0751
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004dfcf0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x4e0794
mov esi, eax
test esi, esi
je 0x4e0782
mov ecx, esi
call fcn.004e0670
push esi
call fcn.004e0b60
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x4e084e
mov ecx, dword [ebp - 0x20]
call fcn.004dffa0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0x4e07dc
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x4e07d6
mov esi, eax
test esi, esi
je 0x4e07c7
mov ecx, esi
call fcn.004e0670
push esi
call fcn.004e0b60
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x4e084e
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004df700
mov ecx, dword [ebp - 0x20]
call fcn.004e0100
xor dword [ebp - 0x24], eax
wait
jmp 0x4e081d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x4e083e
mov ecx, dword [ebp - 0x1c]
call fcn.004e0670
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004e0b60
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x4e084b
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e1210
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov eax, ecx
push edi
sub eax, 0x80
je 0x4e123f
sub eax, 0x40
je 0x4e1238
sub eax, 0x40
je 0x4e1231
pop edi
mov eax, 0xfffffffe
pop ebp
ret
mov edi, 8
jmp 0x4e1244
mov edi, 6
jmp 0x4e1244
mov edi, 4
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0x4e124e
mov eax, ecx
sub eax, 0x80
je 0x4e1275
sub eax, 0x40
je 0x4e126e
sub eax, 0x40
je 0x4e1267
pop edi
mov eax, 0xfffffffd
pop ebp
ret
mov ebp, 0xe
jmp 0x4e127a
mov ebp, 0xc
jmp 0x4e127a
mov ebp, 0xa
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call fcn.004e1310
add esp, 0xc
cmp ebp, 1
jle 0x4e12d7
lea eax, [ebp - 1]
add ebx, 0x20
mov dword [esp + 0x1c], eax
push edi
push 0x4d8e78
push esi
call fcn.004e13f0
push edi
push 0
push esi
call fcn.004e1360
push edi
push esi
call fcn.004e1430
push edi
push ebx
push esi
call fcn.004e1310
mov eax, dword [esp + 0x48]
add esp, 0x2c
add ebx, 0x20
dec eax
mov dword [esp + 0x1c], eax
jne 0x4e129e
mov ebx, dword [esp + 0x20]
push edi
push 0x4d8e78
push esi
call fcn.004e13f0
push edi
push 0
push esi
call fcn.004e1360
shl ebp, 5
add ebp, ebx
push edi
push ebp
push esi
call fcn.004e1310
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x4e1310
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0x4e1343
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0x4e133a
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x4e132c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4

Function at 0x408810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
mov ebx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x30], ebx
push esi
push edi
test ebx, ebx
je 0x446545
invalid
Function at 0x41fe61
Capabilities:
Enumerate pe sections

Disassembly:
call 0x45cd4322
or byte [esi - 0x75], dl
dec eax
cmp al, 3
add ecx, eax
invalid
mov bh, 0x41

Function at 0x4213b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0x8b95587b
pop ebp
adc byte [ebx - 0x177ca93d], cl
add byte [edi], cl
test byte [edx], cl
sldt word [eax]
sub eax, 1
je 0x4222bf
sub eax, 1
je 0x4222a5
sub eax, 1
je 0x334e2279
leave
push ebp
or al, 0x83
call 0x3cc622e8
push cs
ror byte [edi], 0x84
jne 0x4213f5
push edi
cmp ebx, 0x20
jb 0x42170e
add byte [eax], al
mov eax, dword [esi]
add esi, ebx
add edx, ebx
cmp ebx, 0x1f
ja 0x4219c2
jmp dword [ebx*4 + 0x4222b8]
xor ecx, ecx
mov eax, ecx
pop edi
jmp 0x4222cf
xor ecx, ecx
test edx, edx
jmp 0x42224f
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
movzx edx, byte [ecx]
movzx eax, byte [esi]
sub edx, eax
jne 0x422295
movzx ecx, byte [ecx + 1]
movzx eax, byte [esi + 1]
jmp 0x422263
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
jmp 0x422263

Function at 0x4213f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, dword [edx]
je 0x42144b
movzx edi, al
movzx eax, byte [edx]
sub edi, eax
jne 0x42141f
movzx edi, byte [esi + 1]
movzx eax, byte [edx + 1]
sub edi, eax
jne 0x42141f
movzx edi, byte [esi + 2]
movzx eax, byte [edx + 2]
sub edi, eax
je 0x42142f
xor ecx, ecx
test edi, edi
setg cl
lea ecx, [ecx*2 - 0x161701]
jmp 0x42144d
movzx ecx, byte [esi + 3]
movzx eax, byte [edx + 3]
sub ecx, eax
je 0x42144d
xor eax, eax
test ecx, ecx
setg al
lea ecx, [eax*2 - 0x161701]
jmp 0x42144d
xor ecx, ecx
test ecx, ecx
jne 0x4619c4
pop esi
ret
adc byte [ebx], al
add ch, byte [eax + eax + 0x21445c7]
add al, byte [eax]
invalid
Function at 0x4720ab
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x4720ce
push 0
call fcn.0042e54d
pop ecx
mov ecx, eax
call 0x5147206b
mov dword [0x4d06e0], 0x458b0270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7f33fffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x458b0634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x4720e3
mov eax, dword [esi]
mov dword [ebp - 4], 0x87018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7f33fffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x47211d
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7f33fffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret
Function at 0x47c13f
Capabilities:
Encode data using xor

Disassembly:
inc esp
mov esi, ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x47c12a
mov ecx, edi
call 0xff48bfd4
push 0x7e8310e0
push edi
call 0x3bbfe58
mov ecx, dword [ecx + 0x6a]
or al, 0x56
push 0xc
push esi
call 0x3bbfe58
mov ecx, dword [ecx + 0x5f]
mov eax, esi
mov eax, dword [eax]
add al, 0x8b
inc ebp
or byte [ebx - 0xe74a9ad], cl
push edi
xor edi, edi
mov ebx, edi
mov ecx, dword [esi + 9]
call fcn.00407d55
push esi
add al, 0x8b
add cl, byte [ebp + 0x58030452]
add al, 0xf9
dec dword [ebp + 0x4d8bf344]
or byte [ebx - 0x18], dl
test eax, 0x5756ec4d
mov ecx, dword [ebx + 0x84d89df]
cmp dword [esi + 8], edi
jbe 0x47c19c
push ecx
push edi
push dword [eax]
add al, 0x98
push dword [eax + 8]
xor al, 0xf9
inc dword [edi + ecx]
push eax
call 0x4420eab
cmp bh, al
inc eax
add bh, cl
dec dword [ebp + 0x430084d]
cwde
add edi, dword [eax + 4]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x47c173
pop edi
mov ebx, dword [ebx + 0x5d]
add byte [ebx + ecx*4], al
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi], edi
clc
inc edi
pop cx
and dword [eax + ebx - 0x73], 0x4c
mov dword [esi], edi
push edi
push edi
push 1
push edi
call dword [0x147d80d0]
add byte [edi], cl
mov dword [esi], eax
pop edi
setne al
pop esi
mov edi, 0xfffe83f0
je 0x47c152
jge 0x47c1e0
mov edx, dword [esi - 0x75]
int1
je 0x47c1ea
add byte [ebp + 0x89075c0], al
call 0x7cc7c2de
jmp 0xc772d60e
cmovbe edx, dword [ebx + edx*2 - 0x18]
add byte [edi], cl
test dl, cl
fist dword [ebx + 0x53]
mov dword [ebp + 0xc], eax
push dword [edi + 0x70]
movzx eax, word [edi + 0x78]
push dword [edi + 0x30]
push dword [edi + 0x20]
push eax
push dword [edi + 0x10]
cmp dword [esi + 4], esi
call dword [0x4c8dc7a8]
mov dword [esi], eax
cmp byte [ebx], dh
fild dword [eax + 0x1518088b]
mov ah, 0xfa
call [ecx - 0x7d]
pop eax
stc
inc dword [ebx - 0x74e3b977]
xchg ah, dl
adc eax, 0x2444fff9
adc al, 0x56
push eax
call dword [0x458be6d4]
add byte [edx + 3], ch
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x380555d7
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x42d45a5e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4017e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4099f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x40e0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test esi, esi
je 0x40184d
test esi, 0xffff0000
jne 0x401851
movzx esi, si
push esi
call fcn.00401080
add esp, 4
test eax, eax
je 0x401870
push eax
mov eax, esi
lea edi, [ebp - 0x10]
call fcn.00402500
jmp 0x401870
xor eax, eax
jmp 0x401865
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401856
sub eax, edx
sar eax, 1
push esi
mov edi, eax
lea ebx, [ebp - 0x10]
call fcn.004022b0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 1
call fcn.004015a0
add esp, 4
test al, al
je 0x401896
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
jmp 0x4018ba
mov esi, dword [ebp - 0x10]
push 0
push 0
push 0x40c28c
push esi
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x11af3aa
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
cmc
imul edx, edx, 0xa
cmc
pushfd
call fcn.00b0107a
mov eax, dword [0xe7a7834a]
and al, 0x27
xchg ecx, eax
inc esp
mov eax, dword [0x5a2d4d9d]
sti
push edx
insb byte es:[edi], dx
or eax, 0x57c9cf4d
imul esp
or byte [eax - 0x46a37ec9], bl
imul eax, dword [edi], 0xded6b8a1
stc
invalid
sub al, 0x30
pushfd
cmp al, 9
push dword [esp]
jmp 0xc2f1a7
pushfd
lea esp, [esp + 0x30]
jnp 0xbe0953
je 0x11afb98
bsr si, si
mov esi, dword [eax + 0x3c]
sub dx, bp
neg dl
bts dx, 1
movzx dx, cl
add esi, eax
sal dx, 0xa
lea edx, [ebx*8 - 0x5fccbe04]
bswap dx
sbb dx, 0xc0be
mov edx, dword [esi + 0x78]
pushfd
test edx, edx
jmp 0xb083e2
pushal
lea esp, [esp + 0x44]
jbe 0x11aecde
xor cx, ax
bts di, bp
mov edi, dword [edx + 0x24]
or bx, si
add edi, eax
pushfd
sbb ch, 0xe3
mov ebx, dword [edx + 0x20]
and ch, 0x4c
call fcn.011b197d
pushal
lea esp, [esp + 0x24]
je 0x11afb98
pushfd
sub ch, 0
add edx, eax
clc
mov ecx, dword [esi + 0x7c]
bt si, bx
pushal
sub esp, 0xffffffdc
jne 0xc05e4d
add ecx, edx
pushfd
cmc
sub esp, 0xfffffffc
jb 0xbd8248
clc
mov dword [ebp - 0x10], ecx
push 0x20611176
test bl, 0xe
clc
pushal
mov ecx, dword [ebp + 0xc]
stc
clc
mov word [esp], dx
stc
cmp ecx, 0xffff
jmp 0xb01b93
lea esp, [esp + 0x40]
je 0xbd58b2
pushal
jmp 0xb00554
pushfd
pushal
pushal
lea esp, [esp + 0x44]
je 0x11afb98
movzx si, dl
or esi, 0x9576d891
mov esi, dword [eax + 0x3c]
ror edx, cl
lea edx, [ebp*8 - 0x1abb1bc9]
or dl, 0xaf
add esi, eax
test ch, 0xc8
rcl dl, cl
bswap edx
rcr dh, cl
mov edx, dword [esi + 0x78]
pushfd
test edx, edx
pushal
pushfd
push dword [esp + 4]
lea esp, [esp + 0x2c]
je 0x11afb98
cmc
sub cx, bx
rol cx, 1
movsx cx, dl
add edx, eax
dec ch
mov ecx, dword [esi + 0x7c]
cmp dl, 0x9c
call fcn.00b01270
push 0xb0377872
lea ecx, [esp + 0x5a48cbb7]
dec di
mov ch, ch
mov edi, edx
lea esp, [esp + 4]
call 0xc2ed45
jmp 0xbd49d3
cmc
pushfd
stc
stc
add ecx, edx
cmc
cmp edx, esp
cmp al, al
call fcn.011b1b7b
cmc
pushal
mov ebx, eax
mov byte [esp], ch
cmp byte [edi], 0x23
pushal
lea esp, [esp + 0x40]
jne 0xbd58c9
lahf
xor edx, edx
ror ax, cl
dec ah
mov eax, edx
pushal
cmc
pushal
sal al, 5
add edi, 1
or al, ch
xor al, 0x99
clc
cmc
mov al, byte [edi]
mov byte [esp], 0
stc
mov byte [esp], 0x8b
test al, al
mov word [esp], 0x51e9
jmp 0xbd2976
push dword [esp + 0xc]
lea esp, [esp + 0x2c]
ja 0xbda1fd
bt ax, si
cmc
jmp 0xaff2f4
sub esp, 0x14
sbb al, 0x94
push esi
rol ax, cl
bsf ax, sp
dec al
push edi
bsr eax, edi
push ebx
daa
inc ax
push edx
cmp bh, 0xaf
push esi
add ah, 0x54
mov eax, dword [ebp + 8]
pushfd
bt ecx, 5
cmp ah, 0x28
pushal
test eax, eax
push 0xda86fcc1
jmp 0xb00c77