joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
sub byte [esi + ebx], 0x65
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x94
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x32
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xc7
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x83
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0x74
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x4c
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x9d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x8e
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x20
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xbc
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb1
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x4c
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x58
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x23
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x78
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xe8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x64
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x69
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x18
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x52
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x19
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xec
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa3
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x95
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xe5
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x79
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x14
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x83
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x19
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x26
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa6
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xb6
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x76
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8c
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x407b68
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49f440]
jne 0x407b72
repz ret
jmp fcn.004099a6

Function at 0x4088cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49f440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405f13
and dword [ebp - 0x14], 0
cmp dword [0x4a15bc], 0
mov dword [ebp - 0x18], eax
jne 0x40897e
push 0x4022c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408a26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4022b8
push ebx
call edi
test eax, eax
je 0x408a26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4022a8
push ebx
mov dword [0x4a15bc], eax
call edi
push eax
call esi
push 0x402294
push ebx
mov dword [0x4a15c0], eax
call edi
push eax
call esi
push 0x402278
push ebx
mov dword [0x4a15c4], eax
call edi
push eax
call esi
mov dword [0x4a15cc], eax
test eax, eax
je 0x40897e
push 0x402260
push ebx
call edi
push eax
call esi
mov dword [0x4a15c8], eax
mov eax, dword [0x4a15c8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4089d7
cmp dword [0x4a15cc], ecx
je 0x4089d7
push eax
call esi
push dword [0x4a15cc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4089d7
test ebx, ebx
je 0x4089d7
call edi
test eax, eax
je 0x4089ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4089ce
test byte [ebp - 8], 1
jne 0x4089d7
or dword [ebp + 0x10], 0x200000
jmp 0x408a0a
mov eax, dword [0x4a15c0]
cmp eax, dword [ebp - 0x18]
je 0x408a0a
push eax
call esi
test eax, eax
je 0x408a0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408a0a
mov eax, dword [0x4a15c4]
cmp eax, dword [ebp - 0x18]
je 0x408a0a
push eax
call esi
test eax, eax
je 0x408a0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a15bc]
call esi
test eax, eax
je 0x408a26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408a28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407b68
leave
ret
Function at 0x49b400
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x825648], ax
mov word [0x82564c], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x825648
mov dword [0x825654], 0x320033
mov dword [0x82565c], 0x6c006c
mov word [0x82564e], cx
mov dword [0x825650], 0x6c0065
mov dword [0x825658], 0x64002e
mov word [0x82564a], dx
mov word [0x825660], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x825644]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x825640], eax
mov eax, dword [0x4a6694]
push edx
push eax
mov byte [0x4a190b], 0x65
mov dword [0x4a1901], 0x75747269
mov word [0x4a1905], 0x6c61
mov byte [0x4a1900], 0x56
mov word [0x4a190c], 0x7463
mov byte [0x4a190e], 0
mov dword [0x4a1907], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x49b4f0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1050
call fcn.00409120
cmp dword [0x825644], 0x37
jne 0x49b5bc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x402c2c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x454]
push edx
push 0x402c48
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 8]
push edx
push 0x402c5c
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x402c7c
push 0x402c98
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea eax, [esp + 0x854]
push eax
push 0
push 0x402cd4
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x402cf0
push 0x402d10
push 0x402d2c
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x826638]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4a6694]
mov byte [ecx + esi], al
add esp, 0x1050
ret
Function at 0x49b780
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x825644]
sub esp, 0x48c
push ebx
push ebp
push esi
mov esi, dword [0x4a6694]
shr eax, 3
push edi
test eax, eax
je 0x49b950
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jmp 0x49b7b4
mov esi, dword [esp + 0x14]
cmp dword [0x825644], 0x1c
jne 0x49b7d1
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x49fdc0]
mov eax, dword [0x49fdc4]
mov ecx, dword [0x49fdc8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x20], edx
mov edx, dword [0x49fdcc]
mov ebp, 0xc6ef3720
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0x20
mov eax, ebx
shl eax, 4
add eax, dword [esp + 0x24]
mov esi, ebx
shr esi, 5
cmp dword [0x825644], 0x1b
mov dword [esp + 0x10], eax
jne 0x49b84d
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x9c]
push ecx
push 0
push 0x402b00
push 0x402b6c
push 0x402ba0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x28]
lea ecx, [ebx + ebp]
xor esi, ecx
xor esi, eax
sub edi, esi
mov eax, edi
shl eax, 4
mov dword [0x8255b4], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x825644], 0x1be
jne 0x49b892
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x825644], 0x979
mov dword [0x8255b8], 0xff6b3619
mov dword [0x8255bc], 0xffffffff
jne 0x49b8cf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x10]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x49b80a
cmp dword [0x825644], 0x8d4
jne 0x49b907
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0x825644], 0x17
jne 0x49b93f
push 0
push 0
push 0
push 0x402bec
push 0x402c20
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x49b7b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
pop ebp
ret
push ebp
mov ebp, esp
xchg ecx, eax
in al, dx
js 0x401e9d
mov esi, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x66]
push 0x78
push eax
mov gs, eax
mov dword [eax], ebp
add byte [ebx + 0x158b084d], cl
enter 0x40c0, 0
push eax
rol byte [eax], 0x50
push ecx
add edx, 0xffffff87
push 0x40bdac
push edx
call dword [0x402980]
mov eax, dword [0x4102ac]
add esp, 0x14
test eax, eax
je 0x401e5d
push eax
push 0x39d202
call dword [0xe99fc164]
xor ebp, 8
in eax, dx
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
jecxz 0x401e26
nop
nop
nop
nop
mov dword [eax - 0x526f6f70], edx
nop
nop
lodsd eax, dword [esi]
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov edi, dword [edi]
add byte [edi - 0x75], dl
inc esi
int 0x89
inc ebp
mov dword [0x4b49e8], eax
add byte [ebx + 0x36410ba0], ah
mov dword [0x410ba4], edx
mov cl, 0xd8
mov eax, dword [esi + 0x14]
xchg edi, eax
shl ch, 0xfa
jne 0x401f0d
inc eax
mov esp, dword [edx - 0x2b]
jns 0x401e98
push 0xffffffffffffff8f
push ecx
call 0xc28c47
mov dword [esi + 0x838], ebx
mov esp, esp
pop ss
or byte [eax], al
add bh, al
inc esi
sbb byte [eax], al
or al, 0
add byte [ebx + 0x4117ec15], cl
add byte [ecx + 0x60a11456], cl
pushal
cmp eax, dword [ecx]
test eax, eax
out dx, al
cmp edx, dword [eax + 0x41a570]
jle 0x401ed0
add ecx, eax
mov ebp, ecx
jmp 0x401ef7
mov ecx, dword [esi + 0x6b003738]
mov eax, dword [0x40d0e1]
mov edx, dword [0x40d02c]
add ecx, eax
mov eax, dword [esi + 0x83c]
adc edx, dword [ebp - 0x28a407eb]
in eax, 0
add byte [eax], al
jl 0x401f3a
cmp ebx, ecx
push es
xchg dword [ebx - 0x54000000], eax
lodsb al, byte [esi]
dec edi
sbb byte [ebp + ebx + 0x51], ch
rol byte [eax + 0xd], 1
mov ebp, ebx
mov dword [0x3084d8d], eax
inc eax
or eax, 0x8da3eb8b
dec ebp
or byte [ebx], al
rcl dword [ecx + 0x52], cl
push eax
and al, 0x6d
imul esi, dword [eax], 0xffffff85
sal byte [esi + ecx*8 - 0x7d], 0xf8
or esi, dword [edi + edi*2 + 0x3d]
push 0x74000afd
daa
cmp eax, 0x410133
je 0x401f8a
cmp eax, 0xafd57
je 0x401f41
cmp eax, 0xafd24
add edx, esp
fisub dword [ecx - 0x71fff504]
or ecx, dword [ebp + 0xb23b3]
jne 0xc8406230
add byte [ebp + 8], 0x8b
sbb eax, 0x4102a0
scasb al, byte es:[edi]
cmp eax, 0x4102a4
add ebx, eax
adc edi, 0
mov dword [0xe64102a0], ebx
mov dword [0x7a41b3a4], edi
sbb al, 0x56
push ebx
mov ecx, dword [esi + 0x14]
add edx, eax
sub esi, eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x14], ecx
sbb dword [eax - 0x14], ecx
invalid

Function at 0x404f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x404f54
push edi
xchg byte [esi + 0x69], dl
invalid
xchg dword [esi + 0x5b], ebx
sbb esp, dword [ecx - 0x6e]
int3
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc708]
add byte [ebp + 0xc458b00], dh
test eax, eax
jne 0x404f7e
mov ecx, dword [0x4102a5]
mov edx, esi
or al, 0x8b
ror dword [ebx - 0x3688efb3], 0x75
or cl, byte [edi - 0x74f98b8a]
push eax
and byte [ecx + 0x6d531055], cl
insd dword es:[edi], dx
mov ecx, dword [ebp + 0x10]
ja 0x404f4c
jne 0x404f8f
invalid
push ebx
Function at 0x408780
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
dec ebp
adc byte [esi - 0x75], dl
jne 0x408795
push eax
push ecx
push esi
call fcn.0040a550
mov eax, esi
syscall
ret

Function at 0x408db0
Capabilities:
Access peb ldr_data

Disassembly:
cwde
ret 0x3bd2
les edi, [edi + 0x8eb907b]
pushal
mov cl, 0xc0
jno 0x408d84
sbb eax, 0xebc0310e
or bl, byte [eax + 0x47]
mov bl, 0x11
jne 0x408d60
daa
dec edi
test eax, 0xeb90acf8
or dword [ecx + edi - 0x41c0b76], esi
dec edi
ljmp 0xeb14

Function at 0x409248
Capabilities:
Encode data using xor

Disassembly:
call fcn.00409134
mov ecx, 0x1e0
call 0x409248
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40924b
mov eax, 0x50402cc
out dx, al
clc
div esi
cmc
retf 0x3d52

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
hlt
push ebp
mov ebp, esp
mov eax, dword [0x6a758b56]
mov bl, byte [edi]
sub al, 0x84
rol byte [0x4484], 0
mov ecx, dword [esi + 0x48]
xor edx, dword [eax]
push ebx
cmp ecx, 1
jp 0x40b277
inc ebp
mov dword [0x4a084589], eax
test dword [eax + eax + 0x7ea90000], ebx
jmp 0x40b338
cmp eax, 0x5576ffcb
adc dword [ebp - 1], 0xffffff95
add al, al
invalid
clc
xchg edx, eax
fmul dword [ecx - 0x7aafaa]
mov ecx, edx
push esp
ja 0x40b307
mov edi, dword [eax + ecx + 0x5f]
mov dword [esi + 0x3c], 0
pop ebx
adc eax, 0xc85de58b
test byte [edx - 0x43], al
cmp eax, 0x6bc0f7
call edi
test eax, eax
jne 0x40b369
mov dword [ebp + 8], eax
jmp 0x40b373
call edi
add eax, 0xafc80
sbb dword [ebp - 0x28], eax
mov ebx, esi
cld
mov edx, ebp
pushal
mov ecx, dword [esi + 0x54]
add edx, eax
sahf
ret
Function at 0x4a0e06
Capabilities:
Print debug messages

Disassembly:
jmp 0x4c8964
push esi
mov esi, ecx
call fcn.004a4e75
mov eax, 0x400000
mov dword [esi], 0x38
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0xe00
mov dword [esi + 0x10], 0x5f868c
call fcn.004a01e5
test eax, eax
jns 0x4c89b3
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4c89ac
push str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x643a60], 1
mov eax, esi
pop esi
ret

Function at 0x4a1b94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5d5850
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x648904], 1
jge 0x5d58bf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x5d5895
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x5d5895
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5d5872
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5d58ab
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x5d58b2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5d59af
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5d5980
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5d5975
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x5d5969
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x5d5970
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5d59af
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5d59aa
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5d5993
mov eax, dword [ebx + 8]
jmp 0x5d59af
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5d59a1
xor eax, eax
jmp 0x5d59af
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5d58df
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret