joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3001f3a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x3001f3dc
test cl, cl
lea eax, [eax - 4]
je 0x3001f420
test ecx, 0xff00
lea eax, [eax + 1]
je 0x3001f420
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x3001f420
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x3001f420
lea eax, [eax + 1]
jmp 0x3001f3dc
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3001f42f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x3001f456
cmp word [eax], 0
je 0x3001f44f
lea eax, [eax + 2]
test eax, 3
je 0x3001f456
jmp 0x3001f43d
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x3001f491
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x3001f456
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x3001f491
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x3001f491
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x3001f456
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3002138d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
cmp si, 0xffff
push edi
mov dword [ebp - 4], edx
je 0x30021402
test si, 0x3ff
je 0x30021402
push dword [ebp + 8]
call fcn.30021317
test eax, eax
jne 0x3002140b
movzx edi, si
mov esi, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
push eax
push eax
push 0x58
push edi
call esi
test eax, eax
je 0x3002140b
lea eax, [ebp - 0x24]
push 0x20
push eax
push 0x58
push edi
call esi
and dword [ebp - 0x10], 0
lea edx, [ebp - 0x44]
push 3
lea ecx, [ebp - 0x14]
call fcn.3002128d
test eax, eax
je 0x300213fa
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x44]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x3002140b
mov eax, dword [ebp - 4]
mov byte [eax], 1
jmp 0x30021405
mov byte [edx], 1
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop esi
leave
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4010b3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x4031e0
cmp dword [edi], ebx
je 0x401158
push str._mozilla.org_observer_service_1
mov edx, 0x403930
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.00401ba2
mov eax, dword [ebp - 4]
test eax, eax
je 0x401138
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_qm
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_telemetry
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00401c51
mov eax, dword [ebp - 4]
test eax, eax
je 0x401158
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40118f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x40118f
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.00401812
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.004019cc
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4011ab
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4011b8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x4011c4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4011d4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5d2541e4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x658f7131
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40186a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x40a310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00401844
xor ebx, ebx
mov edi, eax
pop ecx
mov dword [ebp - 0x1fc], edi
cmp edi, ebx
je 0x401a0a
push 3
call fcn.00403627
pop ecx
cmp eax, 1
je 0x4019b6
push 3
call fcn.00403627
pop ecx
test eax, eax
jne 0x4018c8
cmp dword [section..data], 1
je 0x4019b6
cmp esi, 0xfc
je 0x401a0a
push str.Runtime_Error__n_nProgram:
push 0x314
mov edi, 0x40ab80
push edi
call fcn.004035c4
sub esp, 0xfffffff4
or eax, eax
jne 0x4019ac
push 0x104
mov esi, 0x40abb2
push esi
push ebx
mov word [0x40adba], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or eax, eax
mov ebx, 0x2fb
jne 0x401934
push str._program_name_unknown_
push ebx
push esi
call fcn.004035c4
sub esp, 0xfffffff4
test eax, eax
je 0x401934
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00402ecc
push esi
call fcn.004035a9
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40196b
push esi
call fcn.004035a9
lea eax, [eax*2 + 0x40ab3c]
mov ecx, eax
sub ecx, esi
push 3
sar ecx, 1
push 0x407b5c
sub ebx, ecx
push ebx
push eax
call fcn.004034dc
sub esp, 0xffffffec
or eax, eax
jne 0x401928
push 0x407b54
mov esi, 0x314
push esi
push edi
call fcn.00403467
sub esp, 0xfffffff4
or eax, eax
jne 0x401928
push dword [ebp - 0x1fc]
push esi
push edi
call fcn.00403467
add esp, 0xc
test eax, eax
jne 0x401928
push 0x12010
push 0x407b08
push edi
call fcn.004032fb
add esp, 0xc
jmp 0x401a0a
push ebx
push ebx
push ebx
push ebx
push ebx
jmp 0x40192f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, ebx
je 0x401a0a
cmp esi, 0xffffffff
je 0x401a0a
xor eax, eax
mov cl, byte [edi + eax*2]
mov byte [ebp + eax - 0x1f8], cl
cmp word [edi + eax*2], bx
je 0x4019e3
inc eax
cmp eax, 0x1f4
jb 0x4019cb
lea edi, [ebp - 0x1fc]
lea eax, [ebp - 0x1f8]
push ebx
push edi
push eax
mov byte [ebp - 5], bl
call fcn.00403270
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00403666
leave
ret
Function at 0x401f2c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
mov esi, eax
cmp esi, ebx
jne 0x401f48
xor eax, eax
jmp 0x401fbf
cmp word [esi], bx
je 0x401f5d
add eax, 2
cmp word [eax], bx
jne 0x401f4d
add eax, 2
cmp word [eax], bx
jne 0x401f4d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
sub eax, esi
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call edi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x401fb5
push eax
call fcn.00403ee4
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x401fb5
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push esi
push ebx
push ebx
call edi
or eax, eax
jne 0x401fa9
push dword [ebp - 4]
call fcn.00403e4b
pop ecx
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 4]
jmp 0x401fbe
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402ecc
Capabilities:
Terminate process

Disassembly:
push esi
push 1
mov edi, edi
mov esi, 0xc0000417
push esi
push 2
call fcn.00402da3
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov edx, 0x5a4d
mov eax, esp
mov ecx, dword [eax + 8]
cmp word [ecx], dx
je 0x403136
pop ebp
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x403132
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
pop ebp
sete dl
mov eax, edx
ret

Function at 0x403160
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push esi
mov edx, esp
mov eax, dword [edx + 8]
mov esi, dword [eax + 0x3c]
add esi, eax
movzx eax, word [esi + 0x14]
push ebp
lea eax, [eax + esi + 0x18]
push ebx
xor ebp, ebp
movzx ebx, word [esi + 6]
test ebx, ebx
push edi
je 0x40319d
mov esi, dword [edx + 0xc]
mov edi, dword [eax + 0xc]
cmp esi, edi
jb 0x403195
mov edx, dword [eax + 8]
add edx, edi
cmp esi, edx
jb 0x40319f
inc ebp
add eax, 0x28
cmp ebp, ebx
jb 0x403185
xor eax, eax
pop edi
pop ebx
pop ebp
pop esi
ret
Function at 0x4032fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, dword [0x40a310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402256
and dword [ebp - 0x14], 0
cmp dword [0x40b43c], 0
mov dword [ebp - 0x18], eax
jne 0x4033ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403456
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call esi
or eax, eax
je 0x403456
mov edi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call edi
push str.GetActiveWindow
push ebx
mov dword [0x40b43c], eax
call esi
push eax
call edi
push str.GetLastActivePopup
push ebx
mov dword [0x40b440], eax
call esi
push eax
call edi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b444], eax
call esi
push eax
call edi
mov dword [0x40b44c], eax
test eax, eax
je 0x4033ae
push str.GetProcessWindowStation
push ebx
call esi
push eax
call edi
mov dword [0x40b448], eax
mov eax, dword [0x40b448]
mov ecx, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403407
cmp dword [0x40b44c], ecx
je 0x403407
push eax
call edi
push dword [0x40b44c]
mov esi, eax
call edi
or esi, esi
mov ebx, eax
je 0x403407
or ebx, ebx
je 0x403407
call esi
or eax, eax
je 0x4033fe
lea esi, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push esi
push 0xc
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4033fe
test byte [ebp - 8], 1
jne 0x403407
or dword [ebp + 0x10], 0x200000
jmp 0x40343a
mov eax, dword [0x40b440]
cmp eax, dword [ebp - 0x18]
je 0x40343a
push eax
call edi
or eax, eax
je 0x40343a
call eax
mov dword [ebp - 0x14], eax
or eax, eax
je 0x40343a
mov eax, dword [0x40b444]
cmp eax, dword [ebp - 0x18]
je 0x40343a
push eax
call edi
test eax, eax
je 0x40343a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b43c]
call edi
test eax, eax
je 0x403456
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403458
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop ebx
pop esi
xor ecx, ebp
call fcn.00403666
leave
ret

Function at 0x403666
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a310]
jne 0x403670
repz ret
jmp fcn.004048d6
Function at 0x407a20
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x50d800
push 0x40
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call esi
test eax, eax
mov dword [0x70f864], eax
jne 0x407a5d
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push 0x50d800
push 0x40
call esi
test eax, eax
mov dword [0x70f868], eax
jne 0x407a84
mov eax, dword [0x70f864]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
xor edx, edx
test edx, edx
mov esi, 0x40b020
je 0x407a94
mov esi, 0x40f080
mov eax, edx
mov edi, dword [edx*4 + 0x70f864]
neg eax
sbb eax, eax
mov dword [esp + edx*4 + 0x10], edi
and eax, 0x8844
add eax, 0x4060
mov ecx, eax
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + edx*4 + 0x10]
add esi, eax
mov dword [esp + edx*4 + 0x10], esi
inc edx
cmp edx, 2
jl 0x407a86
push 0
push 4
push 3
push 0
push 1
push 0x80000000
push 0x70f760
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407b11
mov ecx, dword [0x70f864]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ecx
call esi
mov edx, dword [0x70f868]
push edx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esi + 4]
push edi
push ecx
push ebx
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], edi
je 0x407b62
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x70f864]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
call esi
mov eax, dword [0x70f868]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [edi + 4]
mov edi, dword [esp + 0x14]
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x407b90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x407bb2
xor eax, eax
add esp, 0x190
ret
call fcn.00407620
call fcn.00407a20
add esp, 0x190
ret

Function at 0x407bd0
Capabilities:
Create thread

Disassembly:
call fcn.00407b90
test eax, eax
jne 0x407bda
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__beginthreadex]
push 0
push 0
push 0
push 0x407720
push 0
push 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
test eax, eax
je 0x407c05
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0
push 0
push esi
push 0x407840
push 0
push 0
call edi
add esp, 0x18
test eax, eax
je 0x407c27
push eax
call ebp
push 0x7d0
call ebx
inc esi
cmp esi, 0x80
jl 0x407c0d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x35f71140
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0xc293460
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0xfa, al
xor byte [eax + 0x5738ed19], ch
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0xd1, al
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0xd1, al
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0xb2, al
mov eax, dword [edi]
cmpsd dword [esi], dword es:[edi]
adc bl, byte [ecx + 0x77]
xchg byte [ebx - 5], dl
xchg esp, eax
out 0x12, al
sti
push edi
out 0x47, al
jb 0x414a15
insd dword es:[edi], dx
push edi
fsub qword [ebx - 0x9fd8fe2]
xchg edx, eax
invalid
js 0x414a26
out 0x60, eax
mov ecx, 0x8f130ed4
pop ebx
cli
cli
and esi, ebp
xchg ecx, eax
adc edx, dword [esi - 0x6e]
or eax, 0xb20e6610
cmpsb byte [esi], byte es:[edi]
test al, 0x19
cli
xor byte [ecx], dh
sbb ebp, ebp
adc byte [edx + 0xe], dh
push ss
cdq
test al, 0x19
stosb byte es:[edi], al
sti
push edi
out 0x13, al
adc edi, dword [ebp - 0x47]
in eax, dx
add al, 0xbc
in eax, dx
into
pop es
mov edi, 0xdbbffb53
aad 5
test al, 0x63
ror byte [edi - 0x5b19f1ae], cl
test al, 0x19
fstp xword [ecx]
pop ebx
out 0x47, al
inc edi
inc edi
jb 0x414a75
and byte [edi], dl
sub eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
adc bh, dl
aas
sar byte ss:[ecx + 0x13e48c57], 1
sub eax, 0x704ec23
push cs
mov dh, 0x3d
test eax, 0xb7fbab19
movsb byte es:[edi], byte [esi]
adc al, byte [ecx + 0x53]
push es
push eax
sti
out dx, eax
salc
jb 0x414aa4
push edi
push cs
inc edx
add al, 0xa8
sbb edx, edi
mov al, byte [0x43ed19a8]
inc edi
xchg byte [ebx - 5], dl
mov edi, 0xa8049437
das
sar ebx, 1
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0xed, al
add al, 0xa8
sbb dword [edx], edx
sti
push edi
out 0xed, al
add al, 0xa8
sbb dword [edx], edx
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
push edi
out 0x12, al
sti
aam 0xa
push ss
cmp al, 0x53
ret 0x53fe
Function at 0x10007a26
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x10007a74
push 0x19
push 0x4015529
push 6
call fcn.1001675a
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10007a7f
mov esp, ebp
pop ebp
ret 8

Function at 0x10017800
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10025a42
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1001786a
push esi
lea edi, [eax + 0x400]
call fcn.10025a6b
push edi
call fcn.10025a42
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1001783a
push esi
xor edi, edi
call dword [0x1003c024]
add esp, 4
test eax, eax
je 0x10017886
push eax
push esi
call fcn.10018ca0
add esp, 8
mov edi, eax
push esi
call fcn.10025a6b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10017e60
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10017ec9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.100169f0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret