joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe807a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3d0000]
mov dword [edi + 0x584b0c], 0x4e4e4d4d
push edi
jmp 0xe807ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xe807d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe807c0
mov eax, 1
add ebx, ebx
jne 0xe807e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xe807f4
jne 0xe80813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe80813
dec eax
add ebx, ebx
jne 0xe80800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xe807d8
add ebx, ebx
jne 0xe8080f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xe80865
xor ecx, ecx
sub eax, 3
jb 0xe8082b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xe8089a
sar eax, 1
mov ebp, eax
jmp 0xe80836
add ebx, ebx
jne 0xe80836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe80804
inc ecx
add ebx, ebx
jne 0xe80844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe80804
add ebx, ebx
jne 0xe80851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xe80846
jne 0xe80862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe80846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xe80884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xe80876
jmp 0xe807c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xe80884
add edi, ecx
jmp 0xe807c6
pop esi
mov edi, esi
mov ecx, 0x10efb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xe808a2
cmp byte [edi], 0x3a
jne 0xe808a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xe808a7
lea edi, [esi + 0xa49000]
mov eax, dword [edi]
or eax, eax
je 0xe8091f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaa7be4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaa7d60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xe808d4
mov ecx, edi
jns 0xe80903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaa7d64]
or eax, eax
je 0xe80919
mov dword [ebx], eax
add ebx, 4
jmp 0xe808f1
call dword [esi + 0xaa7d74]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xe80950
cmp al, 0xef
ja 0xe80943
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xe80925
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xe80932
mov ebp, dword [esi + 0xaa7d68]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xe80984
sub esp, 0xffffff80
jmp 0x54c85c
Function at 0x106fd058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106fd1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106fd07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106fd06a
add dl, dl
jne 0x106fd089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106fd0dc
xor eax, eax
add dl, dl
jne 0x106fd096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106fd17d
add dl, dl
jne 0x106fd0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106fd0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106fd075
mov eax, 1
add dl, dl
jne 0x106fd0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106fd0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106fd0e1
sub eax, ebx
mov ebx, 1
jne 0x106fd128
mov ecx, 1
add dl, dl
jne 0x106fd10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106fd119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106fd105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106fd075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106fd13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106fd14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106fd136
cmp eax, 0x7d00
jae 0x106fd16d
cmp eax, 0x500
jb 0x106fd168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106fd075
cmp eax, 0x7f
ja 0x106fd170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106fd075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106fd19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106fd075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100b0120
Capabilities:
Packed with generic packer

Disassembly:
or byte [ecx], al
jne 0x100b030a
pushal
mov esi, section.UPX1
lea edi, [esi - 0x75000]
push edi
or ebp, 0xffffffff
jmp 0x100b0147
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100b014e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100b013d
mov eax, 1
add ebx, ebx
jne 0x100b0160
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100b0171
jne 0x100b0190
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100b0190
dec eax
add ebx, ebx
jne 0x100b017d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100b0155
add ebx, ebx
jne 0x100b018c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100b01e2
xor ecx, ecx
sub eax, 3
jb 0x100b01a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100b0217
sar eax, 1
mov ebp, eax
jmp 0x100b01b3
add ebx, ebx
jne 0x100b01b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100b0181
inc ecx
add ebx, ebx
jne 0x100b01c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100b0181
add ebx, ebx
jne 0x100b01ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100b01c3
jne 0x100b01df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100b01c3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100b0201
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100b01f3
jmp 0x100b0143
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100b0201
add edi, ecx
jmp 0x100b0143
pop esi
mov edi, esi
mov ecx, 0x26ab
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100b021f
cmp byte [edi], 0x13
jne 0x100b021f
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100b0224
lea edi, [esi + 0xaa000]
mov eax, dword [edi]
or eax, eax
je 0x100b029c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb5820]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb5924]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100b0251
mov ecx, edi
jns 0x100b0280
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb5928]
or eax, eax
je 0x100b0296
mov dword [ebx], eax
add ebx, 4
jmp 0x100b026e
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100b02cd
cmp al, 0xef
ja 0x100b02c0
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100b02a2
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100b02af
mov ebp, dword [esi + 0xb592c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100b0301
sub esp, 0xffffff80
jmp 0x1004729e
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x7bc40cc9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x43ad714e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4010b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea ecx, [ebp - 0x20]
push ebx
sub esp, 0x3c
mov dword [ebp - 0x20], 0x1fe
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov edi, eax
test eax, eax
jne 0x4010f8
cmp dword [ebp - 0x1c], 1
je 0x401108
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [esi], 0
je 0x401158
mov eax, esi
add eax, 2
cmp word [eax], 0
jne 0x401110
sub eax, esi
add eax, 2
xor ecx, ecx
mov ebx, dword [sym.imp.ucrtbase.dll_wcschr]
mov word [esi + eax], cx
jmp 0x401138
xor edx, edx
lea esi, [eax + 2]
mov word [eax], dx
mov dword [esp + 4], 0x2c
mov dword [esp], esi
call ebx
test eax, eax
jne 0x401130
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x40111e
Function at 0x401db0
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x218]
sub esp, 0x23c
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineWineBrowser
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x401e20
mov esi, str._usr_bin_open
mov ecx, 0x21
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movzx eax, word [esi]
mov word [edi], ax
mov edx, dword [ebp - 0x22c]
mov eax, ebx
call fcn.00401a90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x21c]
mov ecx, ebx
mov edx, str.Mailers
call fcn.004010b0
mov esi, eax
mov eax, dword [ebp - 0x21c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test esi, esi
je 0x401e02
jmp 0x401dee

Function at 0x401e50
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x218]
sub esp, 0x23c
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineWineBrowser
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x401eb8
mov esi, str.xdg_open
mov ecx, 0x1f
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x22c]
mov eax, ebx
call fcn.00401a90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x21c]
mov ecx, ebx
mov edx, str.Browsers
call fcn.004010b0
mov esi, eax
mov eax, dword [ebp - 0x21c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test esi, esi
je 0x401e9c
jmp 0x401e8e

Function at 0x403970
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x4039e0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004025f0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x40eaa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x411550
push 0x40ef3a
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x41411c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov ecx, dword fs:[0x18]
mov esi, dword [ecx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
push esi
push 0x414948
call edi
test eax, eax
je 0x40eb1a
cmp eax, esi
jne 0x40eb35
mov ebx, 1
mov edx, dword [0x414944]
mov esi, 1
cmp edx, esi
jne 0x40eb42
push 0x1f
call sub.MOZCRT19.dll__amsg_exit
add esp, 4
jmp 0x40eb72
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40eb03
mov eax, dword [0x414944]
test eax, eax
jne 0x40eb6c
mov dword [0x414944], esi
push 0x4103e0
push 0x4103cc
call sub.MOZCRT19.dll__initterm_e
add esp, 8
test eax, eax
je 0x40eb72
jmp 0x40ecbe
mov dword [0x414578], esi
mov ecx, dword [0x414944]
cmp ecx, esi
jne 0x40eb98
push 0x4103c8
push 0x410380
call sub.MOZCRT19.dll__initterm
add esp, 8
mov dword [0x414944], 2
test ebx, ebx
jne 0x40eba8
push ebx
push 0x414948
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x41494c], 0
je 0x40ebce
push 0x41494c
call fcn.0040f250
add esp, 4
test eax, eax
je 0x40ebce
push 0
push 2
push 0
call dword [0x41494c]
mov eax, dword [sym.imp.MOZCRT19.dll__wcmdln]
cmp dword [eax], 0
je 0x40ecbe
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, 0x20
ja 0x40ec3e
test ax, ax
je 0x40ebf6
test edx, edx
jne 0x40ec3e
movzx eax, word [ecx]
test ax, ax
je 0x40ec0c
cmp ax, 0x20
ja 0x40ec0c
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40ebf6
test byte [ebp - 0x3c], 1
movzx eax, word [ebp - 0x38]
jne 0x40ec1b
mov eax, 0xa
push eax
push ecx
push 0
push 0x400000
call main
mov dword [0x414574], eax
cmp dword [0x414568], 0
jne 0x40ec88
push eax
call dword [sym.imp.MOZCRT19.dll_exit]
cmp ax, 0x22
jne 0x40ec50
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40ebe4
cmp dword [0x414578], 0
jne 0x40ec97
call dword [sym.imp.MOZCRT19.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x414574]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ede0
Capabilities:
Terminate process

Disassembly:
call fcn.0040f360
jmp fcn.0040eaa0

Function at 0x43b649
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
sub edi, edi
call fcn.0043b67b
or edi, edx
xor dword [eax], ecx
sub edi, edx
add edi, edx
sub edx, edx
inc eax
sub edx, 0x497071d7
cmp eax, esi
jne fcn.0043b649
inc edi
push edi
pop edi
mov edi, 0xc3db3383
ret
Function at 0x402af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x28
mov eax, dword [ebp + 8]
mov cx, 0x9540
mov word [ebp - 0xc], 0x413b
mov byte [ebp - 0x11], 0x92
mov dx, word [ebp - 0xa]
mov si, dx
or si, 0x659c
mov word [ebp - 0xa], si
mov bl, byte [ebp - 0x11]
add bl, 0xee
mov byte [ebp - 0x12], bl
mov si, dx
and si, si
mov word [ebp - 0xa], si
mov word [ebp - 0x1e], 0xfb
mov dword [ebp - 0x28], eax
mov si, word [ebp - 0x1e]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x3c]
sub cx, word [ebp - 0xc]
cmp si, cx
mov word [ebp - 0x2a], dx
mov dword [ebp - 0x30], eax
jne 0x402b73
mov dword [ebp - 0x24], 0
jmp 0x402ba8
mov eax, dword [ebp - 0x1c]
mov cl, byte [ebp - 0x11]
xor cl, 0xa0
mov dword [ebp - 0x18], eax
mov dl, byte [ebp - 0x12]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
cmp dl, cl
jb 0x402b58
jmp 0x402ba2
mov ax, word [ebp - 0x2a]
xor ax, 0x73a8
mov word [ebp - 0xa], ax
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x28]
mov ax, word [ebp - 0x2a]
imul dx, ax, 0x3296
mov word [ebp - 0xa], dx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0x4550
jne 0x402b4f
jmp 0x402b58
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x28
pop esi
pop ebx
pop ebp
ret 4

Function at 0x402e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0x4f66
mov word [esp + 0x36], 0x6f71
mov cx, 0x6f71
mov word [esp + 0x2a], 0x3a34
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0x4c5d
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
xor edx, 0x155b
or edx, esi
mov dword [esp + 0x18], edx
mov word [esp + 0x16], cx
mov dword [esp + 0x10], eax
jne 0x402ed0
jmp 0x402ee8
call fcn.00402f60
mov dword [esp + 0x2c], eax
jmp 0x402edb
mov eax, dword [esp + 0x10]
cmp eax, 0
je 0x402ec5
jmp 0x402ee8
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov ax, 0x3455
mov cx, word [esp + 0x16]
sub ax, cx
mov word [esp + 0x46], ax
mov ax, word [esp + 0x2a]
mov dx, word [esp + 0x36]
xor dx, 0x2365
mov esi, dword [esp + 0x30]
mov edi, esp
mov dword [edi], esi
mov dword [edi + 4], 0
mov word [esp + 0xe], ax
mov word [esp + 0xc], dx
call fcn.00403100
sub esp, 8
mov dword [esp + 0x1c], eax
mov cx, word [esp + 0xc]
mov dx, word [esp + 0xe]
cmp cx, dx
je 0x402ee8
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov cx, word [esp + 0x16]
xor cx, 0xffff
mov word [esp + 0x46], cx
jmp 0x402edb
Function at 0x431006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5a7020fe
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..7LWLf
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x49202649
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10001000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x1018c848
push 0x136000
push section..data
call fcn.10001830
push section..data
call fcn.10001080
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10001046
push dword [ebp + 8]
push ebx
call fcn.10001b70
add esp, 8
test eax, eax
jne 0x1000104b
push ebx
call fcn.10001d30
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
sub esp, 0x848
mov ecx, 0x212
mov edi, esp
mov esi, str.103.99.63.89
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.10001d30
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100016b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b760
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1018c880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
xor edx, edx
mov eax, dword [esi]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], ecx
movzx eax, word [eax + 6]
cmp edx, eax
jge 0x1000176d
cmp dword [ecx + 0x10], 0
push 0x10054bec
je 0x1000177f
jmp 0x10001796
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x24], 0x36
call fcn.10003402
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x28], 0x43
call fcn.10003402
mov eax, dword [ebp - 0x14]
push 4
push 0x1000
push dword [eax + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
mov eax, 0x100017d0
ret

Function at 0x10001830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push edi
xor edi, edi
test ebx, ebx
jle 0x10001883
mov dword [ebp + 0xc], 0x6d9
push esi
nop dword [eax + eax]
mov eax, dword [ebp + 0x10]
mov esi, ecx
movsx eax, byte [edi + eax]
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add dl, 0x4f
xor byte [eax + ecx], dl
mov eax, 0xcccccccd
mul ecx
inc ecx
shr edx, 2
lea eax, [edx + edx*4]
lea edx, [edi + 1]
xor edi, edi
cmp esi, eax
cmovne edi, edx
cmp ecx, ebx
jl 0x10001850
pop esi
pop edi
pop ebx
pop ebp
ret