joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ee74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9b30]
jne 0x48ee7e
repz ret
jmp fcn.00493927

Function at 0x491ab1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048c052
and dword [ebp - 0x14], 0
cmp dword [0x4acb0c], 0
mov dword [ebp - 0x18], eax
jne 0x491b64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x491c0c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x491c0c
mov esi, dword [fcn.00488080]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acb0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acb10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acb14], eax
call edi
push eax
call esi
mov dword [0x4acb1c], eax
test eax, eax
je 0x491b64
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acb18], eax
mov eax, dword [0x4acb18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00488084]
cmp eax, ecx
je 0x491bbd
cmp dword [0x4acb1c], ecx
je 0x491bbd
push eax
call esi
push dword [0x4acb1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x491bbd
test ebx, ebx
je 0x491bbd
call edi
test eax, eax
je 0x491bb4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x491bb4
test byte [ebp - 8], 1
jne 0x491bbd
or dword [ebp + 0x10], 0x200000
jmp 0x491bf0
mov eax, dword [0x4acb10]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491bf0
mov eax, dword [0x4acb14]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acb0c]
call esi
test eax, eax
je 0x491c0c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x491c0e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ee74
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4042d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add dword [0x4496bc], 0x48d3cca7
fld dword [0x47d0bc]
fld dword [0x47b50c]
fmul dword [0x47865c]
fadd dword [0x4733a4]
fld dword [0x47d0bc]
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x47d0bc]
fxch st(1)
fcompi st(2)
fstp st(1)
jb 0x40432f
fld dword [0x475b54]
fadd dword [0x47bb1c]
fadd dword [0x471ddc]
fadd dword [0x471714]
fstp dword [0x471714]
jmp 0x404359
fld dword [0x474690]
fsub dword [0x46fbdc]
fadd dword [0x478be8]
fld dword [0x474d98]
fxch st(1)
fcompi st(1)
fstp st(0)
jb 0x404359
or dword [0x445918], 0x4b55ea06
fld dword [0x476c8c]
fsub qword [0x455d08]
fstp dword [0x476c8c]
fadd qword [0x455d08]
cmp dword [ebp + 8], 0
fstp qword [0x455d08]
je 0x4044f0
push esi
push edi
lea edi, [ebp + 8]
jmp 0x404390
and dword [0x4498ec], 0x9321fbfd
mov esi, dword [ebp + 8]
add esi, 8
cmp dword [esi], 0
je 0x404444
mov eax, dword [0x43ddb4]
movzx ecx, word [0x46e056]
imul eax, eax, 0x37b0c6b4
mov edx, dword [ebp + 8]
add ecx, eax
mov word [0x46e056], cx
mov eax, dword [edx + 4]
mov ecx, dword [esi]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.00411ae0
fld dword [0x476808]
fstp qword [0x467ee8]
fld dword [0x476808]
fadd qword [0x43ada0]
fstp dword [0x476808]
mov edx, dword [esi]
push edx
call fcn.00411b70
mov eax, dword [0x4432e0]
xor eax, 0xffbd4b7f
or eax, 0xafad405f
add esp, 0x10
cmp eax, 0xd46c4b1e
jg 0x404444
mov ecx, dword [0x441764]
not ecx
cmp ecx, 0x3d72233
jg 0x404444
mov eax, dword [0x43cf54]
mov edx, dword [0x43d2cc]
shl eax, 6
add eax, 0xe1ca63
imul edx, eax
mov dword [0x43d2cc], edx
fld dword [0x472a4c]
add edi, 4
fadd qword [0x459c48]
fmul dword [0x47b0a8]
mov eax, dword [ebp + 8]
fstp dword [0x47b0a8]
mov dword [eax], 1
movzx ecx, word [0x46b8bc]
mov edx, dword [0x44484c]
movsx eax, cx
imul edx, eax
mov dword [0x44484c], edx
dec word [0x46b8bc]
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [0x4430dc]
imul ecx, ecx, 0x4d3119e6
mov dword [0x4430dc], ecx
mov dword [esi], 0
movzx edx, word [0x46aa5a]
movsx eax, dx
or eax, 0xf7cf9bbf
sub dword [0x4471c4], eax
movzx ecx, word [0x46a838]
mov eax, dword [edi]
movzx edx, word [0x46bc96]
mov dword [ebp + 8], eax
movsx eax, cx
and eax, 0x72c2773
imul edx, eax
cmp dword [ebp + 8], 0
mov word [0x46bc96], dx
jne 0x404390
pop edi
pop esi
inc word [0x468e48]
mov ax, word [0x468e48]
mov ecx, dword [0x440b2c]
cwde
xor eax, 0xaffadffd
or eax, 0x27e8dab8
imul ecx, eax
mov dword [0x440b2c], ecx
add dword [0x43dca0], 0x8b5a49c4
pop ebp
ret
Function at 0x41d390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
fld dword [0x473aac]
fadd dword [0x47d40c]
fsub dword [0x471454]
fld dword [0x472a04]
fadd dword [0x471870]
fsub qword [0x450b50]
fxch st(1)
fucompi st(1)
fstp st(0)
lahf
test ah, 0x44
jp 0x41d3ea
mov ax, word [0x4681ae]
mov edx, dword [0x43e228]
movsx ecx, ax
mov eax, 0xdbbcb7ea
sub eax, ecx
mov ecx, dword [0x43d2c8]
add eax, edx
imul ecx, eax
mov dword [0x43d2c8], ecx
inc dword [0x446354]
mov eax, dword [0x446354]
mov edx, dword [ebp + 8]
push ebx
xor eax, 0x4bcc4236
or dword [0x43e2a0], eax
movzx eax, byte [edx]
push esi
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
movzx ebx, cl
sub eax, ebx
jne 0x41d428
test cl, cl
je 0x41d428
mov cl, byte [esi + 1]
movzx eax, byte [edx + 1]
inc esi
inc edx
movzx ebx, cl
sub eax, ebx
je 0x41d414
mov edx, dword [0x448a48]
mov word [0x46a1f4], dx
or edx, 0xffffffff
test eax, eax
jge 0x41d47e
fld dword [0x476a08]
mov eax, edx
fadd qword [0x455758]
fstp dword [0x475cc4]
inc word [0x468cde]
mov cx, word [0x468cde]
mov si, word [0x46baa8]
movsx esi, si
movsx ecx, cx
add ecx, 0x4b088fe7
sar esi, 2
and esi, ecx
mov dword [0x43c4f8], esi
jmp 0x41d499
jle 0x41d499
and dword [0x43decc], 0x7b1e07cb
or dword [0x4405d8], 0xccdbb881
mov eax, 1
mov cx, word [0x46b200]
mov esi, dword [0x448d78]
movsx ecx, cx
add ecx, 0x1cc8c0
or esi, ecx
mov dword [0x445b3c], esi
add word [0x46b200], dx
add dword [0x448d78], edx
pop esi
pop ebx
pop ebp
ret

Function at 0x428500
Capabilities:
Hash data with md5

Disassembly:
inc dword [0x442074]
mov eax, dword [0x442074]
mov edx, dword [0x446a10]
or eax, 0x8c23a350
imul edx, eax
mov dword [0x446a10], edx
mov dword [ecx], 0
fld dword [0x4738c0]
fadd dword [0x470ce4]
fadd dword [0x476758]
fmul dword [0x47b5ec]
fstp dword [0x47b5ec]
fld dword [0x476758]
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x476758]
fld dword [0x4738c0]
fsub st(1)
fstp dword [0x4738c0]
mov dword [ecx + 4], 0
add dword [0x447640], 0x420796a9
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x43dce0]
mov edx, dword [0x44a0d8]
xor eax, edx
xor eax, 0x9ed0c18d
add dword [0x449b98], eax
mov dword [ecx + 0xc], 0xefcdab89
movzx eax, word [0x46c976]
and eax, 0xf6af7d3f
mov word [0x46c976], ax
mov dword [ecx + 0x10], 0x98badcfe
fld dword [0x477d04]
fld qword [0x45afc0]
fld dword [0x4741a8]
fmulp st(2)
fsubrp st(1)
fadd dword [0x47a400]
fstp dword [0x47a400]
fsubr qword [0x45afc0]
fstp qword [0x45afc0]
mov dword [ecx + 0x14], 0x10325476
mov ecx, dword [0x448cb8]
and ecx, 0xef80b99c
cmp ecx, 0xdef1eb5d
je 0x428609
mov eax, dword [0x43fd40]
add eax, eax
or dword [0x44a990], eax
ret
Function at 0x429600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
inc dword [0x443358]
mov ecx, dword [0x443358]
mov edx, dword [0x445cf4]
mov eax, 0x47e80e02
sub eax, ecx
mov ecx, 0x9ed79076
sub ecx, edx
cmp ecx, eax
jne 0x429647
mov edx, dword [0x440bfc]
xor edx, 0x55bbf3b9
cmp edx, 0xfb3f86d1
jle 0x429651
add dword [0x448568], 0xe2142696
jmp 0x429651
mov dword [0x44a208], 0xc
fld dword [0x47dc08]
fsub qword [0x461ab0]
fadd dword [0x4733bc]
fld dword [0x4769a8]
fadd qword [0x4646f8]
fadd dword [0x474d54]
fld dword [0x474d54]
fld1
fsub st(1), st(0)
fxch st(1)
fstp dword [0x474d54]
fld dword [0x4769a8]
fadd st(1)
fstp dword [0x4769a8]
fld dword [0x47dc08]
fsub st(1)
fstp dword [0x47dc08]
fxch st(1)
fcompi st(2)
fstp st(1)
jbe 0x4296be
movzx eax, word [0x46e4de]
imul eax, eax, 0x82d1d864
mov word [0x46e4de], ax
movzx ecx, word [0x4691b4]
and ecx, 0xd5e2ff90
xor edx, edx
mov word [0x4691b4], cx
cmp dword [ebp + 8], edx
je 0x429786
lea ecx, [ebp + 8]
push ebx
add dword [0x444a88], 0x257fe374
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov eax, dword [0x43cac0]
movzx ebx, word [0x46cc84]
sar eax, 4
xor eax, 0xa7929157
add ebx, eax
mov eax, dword [ebp + 8]
mov word [0x46cc84], bx
mov dword [eax + 4], edx
mov eax, dword [0x4419e8]
mov ebx, dword [0x4430bc]
add eax, 0xc0b6a909
add ebx, eax
mov dword [0x4419e8], ebx
inc dword [0x4430bc]
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov eax, dword [ecx + 4]
fld dword [0x47bd5c]
add ecx, 4
fadd dword [0x474b98]
mov dword [ebp + 8], eax
fstp dword [0x47bd5c]
fld dword [0x478fb0]
fadd qword [0x467bc0]
fadd qword [0x45dfc0]
fstp qword [0x45dfc0]
fld dword [0x478fb0]
fadd st(1)
fstp dword [0x478fb0]
cmp dword [ebp + 8], edx
jne 0x4296e1
pop ebx
fld dword [0x473abc]
fadd dword [0x4750f8]
fmul dword [0x4798a0]
fstp dword [0x4798a0]
fsubr dword [0x4750f8]
fstp dword [0x4750f8]
movzx ecx, word [0x46e144]
xor ecx, 0x8d583502
mov word [0x46e144], cx
pop ebp
ret
Function at 0x10009610
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100097dd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x1000963a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10009641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10009630
mov eax, 1
add ebx, ebx
jne 0x10009653
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10009648
jne 0x10009664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10009648
xor ecx, ecx
sub eax, 3
jb 0x10009678
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100096ea
mov ebp, eax
add ebx, ebx
jne 0x10009683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10009690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100096b4
inc ecx
add ebx, ebx
jne 0x100096a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10009695
jne 0x100096b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10009695
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100096d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100096c5
jmp 0x10009636
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100096d4
add edi, ecx
jmp 0x10009636
pop esi
mov edi, esi
mov ecx, 0xc1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100096f2
cmp byte [edi], 2
jne 0x100096f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100096f7
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x1000976f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x90f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10009724
mov ecx, edi
jns 0x10009753
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x90f4]
or eax, eax
je 0x10009769
mov dword [ebx], eax
add ebx, 4
jmp 0x10009741
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100097a0
cmp al, 0xef
ja 0x10009793
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10009775
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10009782
mov ebp, dword [esi + 0x90f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100097d4
sub esp, 0xffffff80
jmp 0x10002c31
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x9301c0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301c6
pop ebp
sub ebp, 6
sub ebp, 0x5301c0
jmp 0x930224
jmp 0x93022d
mov eax, 0x5301c0
add eax, ebp
add eax, 0x93
mov ecx, 0x61a
mov edx, 0x1776e0db
xor byte [eax], dl
inc eax
dec ecx
jne 0x930244
jmp 0x930257
mov cl, 0x9b
mov bl, 0xdb
retf
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401c66
pop dword [ebp - 0x14]
mov eax, 0x49eb7499
sub eax, 0x49ab5833
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x99dcc1f9
sub dword [ebp - 0x24], 0x4b8a7cae
mov dword [ebp - 0x20], 0xc366b5c1
add dword [ebp - 0x20], 0x6ecc9684
mov dword [ebp - 0x1c], 0xf5a7877d
sub dword [ebp - 0x1c], 0xa95b434f
mov dword [ebp - 0x18], 0x60920d67
add dword [ebp - 0x18], 0x9f6df299
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc6e9e11d
add eax, 0x39564f37
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x59701fd1
sub dword [ebp - 0x24], 0xe4fdb67b
mov dword [ebp - 0x20], 0x36ef8c6c
add dword [ebp - 0x20], 0xa7cd509
mov dword [ebp - 0x1c], 0x59a07b97
sub dword [ebp - 0x1c], 0xf6310f2b
mov dword [ebp - 0x18], 0x183ac50b
add dword [ebp - 0x18], 0xe7c53af5
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3d222
push 0
call eax
mov ecx, 0x629c
mov ebx, eax
mov edi, 0xc2cb79fe
add edi, 0x3d74f602
add edi, dword [ebp - 0x14]
mov edx, 0x5d3a5d98
add edx, 0x13458e29
mov esi, dword [edi]
add dword [ebp - 4], 0x66150fd6
xor esi, edx
xor dword [ebp - 8], esi
mov dword [ebx], esi
mov dword [ebp - 0xc], 0xa2b0d9ab
add ebx, 0x5ddc9d5c
sub ebx, 0x5ddc9d58
add edi, 4
loop 0x401d7d
add eax, 0x4615a79f
add eax, 0xb9ebd5a4
xor ebx, ebx
add ebx, eax
add eax, 0x5a8c87d6
sub eax, 0x5a8c87d1
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403c60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00403e10
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x403d5e
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x403d01
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x403d44
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x403d18
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x403d33
test al, 0x40
je 0x403d2a
mov ecx, dword [edi + 0x20]
jmp 0x403d31
test al, 0x80
je 0x403d44
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x403d44
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x403cd0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x405bf7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x405ccc
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x405ccc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x405ccc
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x405c52
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x405ccc
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x405c97
test dl, dl
je 0x405c93
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x405c97
add ecx, 2
add eax, 2
test dl, dl
jne 0x405c77
xor eax, eax
jmp 0x405c9c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405cae
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x405cb9
inc esi
cmp esi, ebp
jae 0x405ccc
mov edx, dword [esp + 0x10]
jmp 0x405c6d
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x405f30
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x405f3b
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x405f4f
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x405f53
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x405f8c
cmp dword [edi + ecx], 0x4550
jne 0x405f8c
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x405f8c
test byte [edi + ecx + 0x16], 2
je 0x405f8c
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x405f91
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x405fcd
xor eax, eax
jmp 0x405fb0
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x405fd6
inc edx
movzx eax, dx
cmp eax, edi
jl 0x405fb0
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x405fdc
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x406014
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x406022
add edx, 0x20
cmp eax, edx
jne 0x406033
test bx, bx
je 0x406068
add esi, 2
add edi, 2
jmp 0x406004
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x406041
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x40604f
add edx, 0x20
sub ecx, edx
je 0x406068
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x405ffd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x406ae1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x406ba2
test ecx, ecx
je 0x406ba2
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x406ba2
test ebx, ebx
je 0x406ba2
mov ebx, eax
add ebx, edx
je 0x406ba2
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x406ba2
cmp dword [edx + eax + 0x14], 0
je 0x406ba2
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x406ba2
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x406b92
test dl, dl
je 0x406b8e
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x406b92
add edi, 2
add esi, 2
test dl, dl
jne 0x406b72
xor eax, eax
jmp 0x406b97
sbb eax, eax
or eax, 1
test eax, eax
je 0x406bae
inc ebp
cmp ebp, dword [esp + 4]
jb 0x406b5f
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8