joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009f246
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1009f290
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1009f237
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1009f246
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x104a4ee9
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1009f297
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1008610d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1009f336
add edi, 4
add eax, 2
dec ecx
jne 0x1009f27c
call 0x1009f2e3
loope 0x1009f2d9
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1009f333
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1009f344
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1009f2f7
cmp eax, ecx
ja 0x1009f2f7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1009f381
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1009f377
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100865ec
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x6454610
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x5b65551b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x412e40
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov ebp, ecx
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov eax, dword [ebp]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
je 0x412e80
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x412e51
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x41f480
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x41f4e0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x41f5d6
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x41f550
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x41f525
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x41f535
cmp byte [esp + 0x1e], 0
je 0x41f535
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x41f535
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0041f480
nop
Function at 0x41f870
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x49d320
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x49d338]
sub esp, 4
test ebx, ebx
je 0x41f8bb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x41f8b4
test esi, esi
je 0x41f8b4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x41f890
mov dword [esp], 0x49d320
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x420bf0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.00420b40
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], edx
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x420cdd
int3
mov dword [esp], edi
mov dword [ebp - 0x24], edx
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x420d80
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
nop
bt ebx, eax
jae 0x420d18
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x420d10
mov dword [esp], edi
call sub.KERNEL32.dll_AddAtomA
sub esp, 4
test ax, ax
je 0x420d74
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.00420b70
cmp eax, ebx
mov esi, eax
je 0x420d97
mov dword [esp], ebx
call fcn.00429370
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.00420b70
mov esi, eax
jmp 0x420d51
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x420d51
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x420d51
Function at 0x42afd0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x49dd44]
test ebx, ebx
je 0x42b000
call sub.KERNEL32.dll_TlsAlloc
mov dword [ebx], eax
mov eax, dword [0x49dd44]
test eax, eax
je 0x42b025
cmp dword [eax], 0xffffffff
je 0x42b048
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov ebx, eax
mov dword [0x49dd44], eax
jmp 0x42afde
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov dword [0x49dd44], eax
jmp 0x42afee
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x42b4e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x49dd48]
test eax, eax
je 0x42b630
call fcn.0042b460
mov eax, dword [0x49dd44]
test eax, eax
je 0x42b660
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
je 0x42b520
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.0042ae20
test eax, eax
mov ebx, eax
je 0x42b6ac
mov eax, dword [entry3]
test eax, eax
je 0x42b6ac
mov dword [ebx + 0x24], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 0x1c], 0xffffffff
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov edi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov esi, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x42b6b3
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetThreadPriority
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x49dd44]
test eax, eax
je 0x42b686
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x42b6b3
mov eax, ebx
jmp 0x42b516
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call fcn.0042f9b0
mov dword [0x49dd48], eax
jmp 0x42b4f3
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov dword [0x49dd44], eax
jmp 0x42b505
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov dword [0x49dd44], eax
jmp 0x42b60e
xor eax, eax
jmp 0x42b516
call sub.msvcrt.dll_abort
nop
lea esi, [esi]
sub esp, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_key_dest_shmem
call fcn.0042f9b0
add esp, 0x1c
ret
Function at 0x42bc20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
cmp dword [esp + 0x24], 3
je 0x42bc40
add esp, 0x18
mov eax, 1
pop ebx
ret 0xc
mov eax, dword [0x49dd44]
test eax, eax
je 0x42bdb0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42bc2b
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x42bc2b
test byte [eax + 0x20], 0x30
je 0x42bd00
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x42bda0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x42bcaf
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x42bca1
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0042a210
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x42be06
mov eax, dword [0x49dd44]
test eax, eax
je 0x42bde0
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, 1
add esp, 0x18
pop ebx
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x42bd60
test eax, eax
je 0x42bd19
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x42bd90
test byte [ebx + 0x24], 4
je 0x42bd76
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x42bca8
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x42bca8
test eax, eax
je 0x42bd6f
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0042a210
mov dword [ebx + 0x34], 0xffffffff
jmp 0x42bc2b
call fcn.0042ba30
jmp 0x42bd31
call fcn.0042ba30
jmp 0x42bc7d
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov dword [0x49dd44], eax
jmp 0x42bc4d
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov dword [0x49dd44], eax
jmp 0x42bcdc
mov eax, ebx
call fcn.0042b050
jmp 0x42bccf
Function at 0x42cfa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0042b4e0
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x42d030
test byte [ebx + 0x20], 0x30
je 0x42d11a
mov eax, dword [0x49dd44]
test eax, eax
je 0x42d0a0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x42d01b
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x42d040
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42d00a
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x42d0c6
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
call fcn.0042ba30
jmp 0x42cfbd
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42d058
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
test edx, edx
je 0x42d0e8
mov eax, dword [0x49dd44]
test eax, eax
je 0x42d0f4
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov dword [0x49dd44], eax
jmp 0x42cfd4
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x42d06c
mov eax, ebx
call fcn.0042b050
jmp 0x42d06c
mov dword [esp + 8], 0x42a460
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042f9b0
mov dword [0x49dd44], eax
jmp 0x42d075
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
lea esi, [esi]
Function at 0x42f9b0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.00420b40
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x1c], eax
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x42fa9d
int3
mov dword [esp], esi
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
test ax, ax
jne 0x42fb33
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x42facd
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x42fac5
mov dword [esp], esi
call sub.KERNEL32.dll_AddAtomA
sub esp, 4
test ax, ax
je 0x42fb30
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0042f930
cmp eax, ebx
mov esi, eax
je 0x42fb4a
mov dword [esp], ebx
call fcn.00429370
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0042f930
mov esi, eax
jmp 0x42fb06
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42fb06
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x42fb06
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x407467
pop dword [ebp - 0x10]
mov eax, 0x4fce0acd
sub eax, 0x4f8d9666
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x98c5f79f
add dword [ebp - 0x20], 0xb58c4dac
mov dword [ebp - 0x1c], 0xd98e909d
add dword [ebp - 0x1c], 0x58a4bba8
mov dword [ebp - 0x18], 0xaa9b963a
add dword [ebp - 0x18], 0xa1b0adf4
mov dword [ebp - 0x14], 0x75f1ada
sub dword [ebp - 0x14], 0x75f1ada
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9a1599f6
sub eax, 0x99d5197e
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x821022ab
add dword [ebp - 0x20], 0xf26246ab
mov dword [ebp - 0x1c], 0x212b1404
sub dword [ebp - 0x1c], 0xdfbeb28f
mov dword [ebp - 0x18], 0xaed001e5
add dword [ebp - 0x18], 0xb49f6a87
mov dword [ebp - 0x14], 0x34a3a733
sub dword [ebp - 0x14], 0x34a3a733
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39d5c
push 0
call eax
mov ecx, 0xbe9afcf0
add ecx, 0x416555ff
xor ebx, ebx
add ebx, eax
mov edi, 0x9b20389
sub edi, 0x96cef89
add edi, dword [ebp - 0x10]
mov edx, 0xd3357b7e
add edx, 0x50db4f13
add dword [ebp - 0xc], 0x6df94f73
mov esi, dword [edi]
xor dword [ebp - 4], ebx
sub esi, edx
sub dword [ebp - 4], 0xef30acda
mov dword [ebx], esi
add dword [ebp - 4], 0x585df030
add ebx, 0xbbc1bfcc
add ebx, 0x443e4038
add edi, 0xe4bf7f46
sub edi, 0xe4bf7f42
loop 0x407586
add eax, 0x26b50c51
add eax, 0xd94c323e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8e3a90af
sub ecx, 0x8dfa90af
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x26cd18b1
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
mov ecx, 0x68f13303
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret

Function at 0x4020a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4020b2
or eax, 0xffffffff
mov dword [section..data], eax
jmp 0x4020eb
mov edx, dword [esp + 8]
mov eax, dword [section..data]
push esi
mov esi, edx
dec edx
test esi, esi
je 0x4020e5
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov edi, dword [0x4053c4]
shr eax, 8
mov esi, dword [edi + esi*4]
xor eax, esi
inc ecx
dec edx
jne 0x4020c5
pop edi
mov dword [section..data], eax
pop esi
not eax
ret 8