joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb0c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8108
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5321d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0041d270
mov edi, eax
add esp, 4
test edi, edi
je 0x4cb164
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004d25b5
add esp, 4
mov dword [edi + 4], eax
jmp 0x4cb166
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.004c67c0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4cb1c7
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x4cb1c7
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x4cb1ea
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4cb20d
cmp byte [ebp + 0xc], 0
je 0x4cb1f9
push esi
call fcn.004d286d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4cb219
mov esi, str.ios_base::badbit_set
jmp 0x4cb229
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.004cb250
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004c6fc0
push 0x52b520
lea eax, [ebp - 0x30]
push eax
call fcn.0046ff32
int3
Function at 0x10002550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x10013150]
mov dword [ebp - 0xc], eax
push edi
mov eax, dword [ebp + 0xc]
mov dword [0x10013278], eax
lea ecx, [ebp - 8]
push ecx
call fcn.10009ce0
add esp, 4
cmp dword [ebp - 4], 1
jge 0x100025b2
mov byte [ebp - 0x70], 0
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0x6f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [0x10013278]
push edx
push str.kousongscore.secondshoulddisplaymoney:_d
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1000260c
mov edx, dword [0x10013278]
sub edx, dword [ebp - 4]
mov dword [0x10013278], edx
jns 0x100025cd
mov dword [0x10013278], 0
mov byte [ebp - 0xd0], 0
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0xcf]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [0x10013278]
push eax
push str.shoulddisplaymoney:_d
lea ecx, [ebp - 0xd0]
push ecx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0xc]
call fcn.1000e3ed
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x100027a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x10013150]
mov dword [ebp - 0xc], eax
push edi
mov dword [ebp - 4], 0
push 4
mov eax, dword [ebp + 8]
add eax, 0x668
push eax
lea ecx, [ebp - 4]
push ecx
call sub.MSVCR71.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 4]
cmp edx, dword [0x10013278]
jle 0x1000282a
mov byte [ebp - 0x70], 0
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0x6f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [0x10013278]
push eax
push str.inputmoney___shoulddisplaymoney_shoulddisplaymoney:_d
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 8], 0x3b9ac9ff
push 4
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x668
push ecx
call sub.MSVCR71.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0xc]
call fcn.1000e3ed
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x100047b0
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10013150]
mov dword [ebp - 4], eax
push edi
cmp dword [ebp + 0xc], 1
jne 0x10004977
push 0x1001318c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
call dword [sym.imp.MSVCR71.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCR71.dll_srand]
add esp, 4
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
add edx, 1
mov dword [0x100132a4], edx
lea edx, [ebp - 0x198]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x1000482f
push 0x10010528
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.10003540
push 0x10010544
lea ecx, [ebp - 0x21c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push 0x2d6d
lea eax, [ebp - 0x21c]
push eax
call fcn.10008240
add esp, 8
mov dword [0x10013268], eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
cmp dword [0x10013268], 0xffffffff
je 0x100048bf
mov byte [ebp - 0x200], 0
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0x1ff]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, dword [0x10013268]
push ecx
push str.plazasocket:_d
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x10013274], 1
jmp 0x100048c9
mov dword [0x10013274], 0
call fcn.10003540
push 0x10004650
push 0x1f40
push 1
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x1001327c], eax
push 0x10004650
push 0x7d0
push 2
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x10013280], eax
push 0x10004650
push 0x7530
push 3
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x10013284], eax
mov ecx, dword [ebp + 8]
push ecx
push 0x10013880
call sub.MFC71U.DLL_AfxHtmlHelp
test eax, eax
jne 0x1000492f
xor eax, eax
jmp 0x1000498e
push 0x40
call fcn.100049a0
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x1000495f
push 0
push 0x10013880
mov ecx, dword [ebp - 0x224]
call sub.MFC71U.DLL_CDWordArray::CDWordArray
mov dword [ebp - 0x228], eax
jmp 0x10004969
mov dword [ebp - 0x228], 0
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x220], edx
jmp 0x10004989
cmp dword [ebp + 0xc], 0
jne 0x10004989
push 0
push 0x10013880
call sub.MFC71U.DLL_AfxStringFromCLSID
mov eax, 1
mov ecx, dword [ebp - 4]
call fcn.1000e3ed
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008530
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x10013150]
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 0x81c], 0
cmp dword [0x10013274], 0
jne 0x1000857a
push 0x10010642
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov eax, dword [ebp - 0x81c]
or eax, 1
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp + 8]
jmp 0x10008660
lea ecx, [ebp - 0x410]
call fcn.1000ba00
mov cl, byte [ebp + 0x10]
mov byte [ebp - 0x40e], cl
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x410]
call fcn.1000ba20
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x410]
call fcn.1000baf0
mov dword [ebp - 4], eax
mov byte [ebp - 0x818], 0
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x817]
rep stosd dword es:[edi], eax
cmp dword [ebp - 4], 0xffffffff
je 0x100085ea
push 0
push 0x400
lea edx, [ebp - 0x818]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1000863e
mov dword [0x10013274], 0
mov ecx, dword [0x10013268]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 0
push 0
push 0x10008490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x10010643
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov edx, dword [ebp - 0x81c]
or edx, 1
mov dword [ebp - 0x81c], edx
mov eax, dword [ebp + 8]
jmp 0x10008660
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [ebp - 0x81c]
or ecx, 1
mov dword [ebp - 0x81c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.1000e3ed
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10008670
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x10013150]
mov dword [ebp - 8], eax
push edi
cmp dword [0x10013274], 0
jne 0x100086b1
mov eax, dword [0x10013268]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 0
push 0
push 0x10008490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10008768
lea ecx, [ebp - 0x410]
call fcn.1000ba00
mov cl, byte [ebp + 0xc]
mov byte [ebp - 0x40e], cl
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x410]
call fcn.1000ba20
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x410]
call fcn.1000baf0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10008768
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x414], eax
mov byte [ebp - 0x478], 0
mov ecx, 0x16
xor eax, eax
lea edi, [ebp - 0x477]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [ebp - 0x414]
push edx
push str.errd:_d
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x10013274], 0
mov edx, dword [0x10013268]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 0
push 0
push 0x10008490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
call fcn.1000e3ed
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000e971
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10013150]
jmp loc.10017d48
Function at 0x40372a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42129c]
jne 0x403734
repz ret
jmp fcn.00405f0b

Function at 0x405873
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402f44
and dword [ebp - 4], 0
cmp dword [0x425f84], 0
mov ebx, eax
jne 0x405924
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4059d5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4059d5
push eax
call fcn.00402ed2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425f84], eax
call esi
push eax
call fcn.00402ed2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425f88], eax
call esi
push eax
call fcn.00402ed2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425f8c], eax
call esi
push eax
call fcn.00402ed2
pop ecx
mov dword [0x425f94], eax
test eax, eax
je 0x405924
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402ed2
pop ecx
mov dword [0x425f90], eax
mov eax, dword [0x425f90]
cmp eax, ebx
je 0x40597c
cmp dword [0x425f94], ebx
je 0x40597c
push eax
call fcn.00402f4d
push dword [0x425f94]
mov esi, eax
call fcn.00402f4d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40597c
test edi, edi
je 0x40597c
call esi
test eax, eax
je 0x405973
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405973
test byte [ebp - 0xc], 1
jne 0x40597c
or dword [ebp + 0x10], 0x200000
jmp 0x4059b5
mov eax, dword [0x425f88]
cmp eax, ebx
je 0x4059b5
push eax
call fcn.00402f4d
pop ecx
test eax, eax
je 0x4059b5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4059b5
mov eax, dword [0x425f8c]
cmp eax, ebx
je 0x4059b5
push eax
call fcn.00402f4d
pop ecx
test eax, eax
je 0x4059b5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425f84]
call fcn.00402f4d
pop ecx
test eax, eax
je 0x4059d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4059d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4023b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4220c8]
jne 0x4023ba
repz ret
jmp fcn.0040560e

Function at 0x40523a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040394c
and dword [ebp - 4], 0
cmp dword [0x4271cc], 0
mov ebx, eax
jne 0x4052eb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40539c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40539c
push eax
call fcn.004038da
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4271cc], eax
call esi
push eax
call fcn.004038da
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4271d0], eax
call esi
push eax
call fcn.004038da
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4271d4], eax
call esi
push eax
call fcn.004038da
pop ecx
mov dword [0x4271dc], eax
test eax, eax
je 0x4052eb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004038da
pop ecx
mov dword [0x4271d8], eax
mov eax, dword [0x4271d8]
cmp eax, ebx
je 0x405343
cmp dword [0x4271dc], ebx
je 0x405343
push eax
call fcn.00403955
push dword [0x4271dc]
mov esi, eax
call fcn.00403955
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405343
test edi, edi
je 0x405343
call esi
test eax, eax
je 0x40533a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40533a
test byte [ebp - 0xc], 1
jne 0x405343
or dword [ebp + 0x10], 0x200000
jmp 0x40537c
mov eax, dword [0x4271d0]
cmp eax, ebx
je 0x40537c
push eax
call fcn.00403955
pop ecx
test eax, eax
je 0x40537c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40537c
mov eax, dword [0x4271d4]
cmp eax, ebx
je 0x40537c
push eax
call fcn.00403955
pop ecx
test eax, eax
je 0x40537c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4271cc]
call fcn.00403955
pop ecx
test eax, eax
je 0x40539c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40539e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4244f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
mov dword [edi + 0x1d448], 0xbd87b97f
push edi
jmp 0x42451a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x424521
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x424510
mov eax, 1
add ebx, ebx
jne 0x424533
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x424528
jne 0x424544
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x424528
xor ecx, ecx
sub eax, 3
jb 0x424558
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4245ca
mov ebp, eax
add ebx, ebx
jne 0x424563
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x424570
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x424594
inc ecx
add ebx, ebx
jne 0x424580
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x424575
jne 0x424591
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x424575
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4245b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4245a5
jmp 0x424516
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4245b4
add edi, ecx
jmp 0x424516
pop esi
mov edi, esi
mov ecx, 0x74d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4245d2
cmp byte [edi], 2
jne 0x4245d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4245d7
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x42464f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x242c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x243fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x424604
mov ecx, edi
jns 0x424633
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x24404]
or eax, eax
je 0x424649
mov dword [ebx], eax
add ebx, 4
jmp 0x424621
call dword [esi + 0x24400]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x424680
cmp al, 0xef
ja 0x424673
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x424655
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x424662
mov ebp, dword [esi + 0x24408]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4246b4
sub esp, 0xffffff80
jmp 0x414cef
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xb4a064b
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6707975
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00431219
Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
jmp loc.00401219