joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
mov ebx, ecx
xorps xmm0, xmm0
push edi
mov edi, edx
movq qword [ebp - 0xc], xmm0
mov cl, byte [esi]
test cl, cl
je 0x414e49
nop dword [eax + eax]
xor byte [eax], cl
lea edx, [ebp - 4]
inc eax
lea ecx, [ebp - 0xc]
cmp eax, edx
lea esi, [esi + 1]
cmovne ecx, eax
mov eax, ecx
mov cl, byte [esi]
test cl, cl
jne 0x414e30
xor edx, edx
lea ecx, [ebp - 0xc]
cmp dword [ebp + 0xc], edx
sete dl
call fcn.00414280
mov eax, edi
cdq
and edx, 7
lea edi, [edx + eax]
sar edi, 3
test edi, edi
jle 0x414ef5
lea esi, [ebx + 6]
movzx ecx, byte [esi - 6]
movzx eax, byte [esi - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 1]
mov dword [ebp - 0xc], ecx
movzx ecx, byte [esi - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0xc]
call fcn.004144d0
movzx eax, byte [ebp - 9]
lea esi, [esi + 8]
mov byte [esi - 0xe], al
movzx eax, byte [ebp - 0xa]
mov byte [esi - 0xd], al
mov eax, dword [ebp - 0xc]
mov byte [esi - 0xc], ah
mov byte [esi - 0xb], al
movzx eax, byte [ebp - 5]
mov byte [esi - 0xa], al
movzx eax, byte [ebp - 6]
mov byte [esi - 9], al
mov eax, dword [ebp - 8]
mov byte [esi - 8], ah
mov byte [esi - 7], al
sub edi, 1
jne 0x414e70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a23c
mov esp, ebp
pop ebp
ret
Function at 0x416e20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x416e2b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x416ee7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
sub edi, 1
jne 0x416e40
pop edi
test esi, esi
je 0x416f0a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
sub esi, 1
jne 0x416ef0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x417810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 8], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x417858
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41784a
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x4178cb
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4178c6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x4178f8
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4178dc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x41790c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x417903
cmp byte [esi + 8], 0
je 0x417903
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4179d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
cmp byte [ebx], 0
je 0x417a19
cmp byte [ebx + 1], 0
je 0x417a4d
push 2
push 0
push 0
push dword [ebx + 4]
call esi
cmp byte [ebx], 0
je 0x417a1f
cmp byte [ebx + 1], 0
je 0x417a12
push 1
push 0
push 0
push dword [ebx + 4]
call esi
sub eax, dword [ebx + 0xc]
jmp 0x417a22
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x417a31
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x1c]
mov esi, 0xffff
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
cmp eax, esi
jae 0x417a36
mov esi, eax
mov dword [ebp - 0x10], eax
push 0x404
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x417a57
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp esi, eax
jbe 0x417b66
nop dword [eax + eax]
mov edx, dword [ebp - 8]
add eax, 0x400
cmp eax, esi
mov ecx, esi
cmovbe ecx, eax
mov eax, 0x404
sub edx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x404
mov dword [ebp - 0x1c], edx
mov esi, ecx
cmova esi, eax
cmp byte [ebx], 0
mov dword [ebp - 0x18], esi
je 0x417ae1
cmp byte [ebx + 1], 0
je 0x417b66
mov eax, dword [ebx + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebx], 0
mov edx, esi
je 0x417ae6
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x417adc
mov byte [ebx + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x417b17
mov dword [ebx + 0x1c], edx
mov edx, esi
mov edi, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x14]
lea eax, [edi + esi]
mov esi, dword [ebx + 0x18]
sub esi, edi
cmp eax, dword [ebx + 0x18]
cmovbe esi, edx
add ecx, edi
push esi
push ecx
push dword [ebp - 0xc]
call sub.VCRUNTIME140.dll_memcpy
lea ecx, [esi + edi]
mov eax, esi
mov esi, dword [ebp - 0x18]
add esp, 0xc
mov edi, dword [ebp - 0xc]
mov dword [ebx + 0x1c], ecx
xor edx, edx
div esi
cmp eax, 1
jne 0x417b66
lea ecx, [esi - 3]
test ecx, ecx
js 0x417b51
lea eax, [edi + 3]
add eax, ecx
nop dword [eax]
mov edx, ecx
lea eax, [eax - 1]
dec ecx
cmp byte [eax - 3], 0x50
jne 0x417b4d
cmp byte [edx + edi], 0x4b
jne 0x417b4d
cmp byte [eax - 1], 5
jne 0x417b4d
cmp byte [eax], 6
je 0x417b7a
test ecx, ecx
jns 0x417b30
mov eax, dword [ebp - 4]
test eax, eax
jne 0x417b66
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
cmp eax, esi
jb 0x417a70
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov dword [ebp - 4], eax
jmp 0x417b54
Function at 0x418460
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x41861a
cmp dword [edi + 0x18], 0
je 0x41861a
cmp dword [edi + 0x7c], 0
je 0x418489
call fcn.00418960
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00418200
add esp, 8
test eax, eax
je 0x4184ad
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x4184f3
push 0x4000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x4184ff
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x54], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x418557
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00417170
test eax, eax
jne 0x418557
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov cl, byte [edi + 0x30]
mov dword [esi + 0x58], eax
and cl, 1
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x30]
shr eax, 3
mov byte [esi + 0x6c], cl
test al, 1
je 0x41857b
mov al, byte [edi + 0x39]
jmp 0x41857e
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov edx, 0xc
xor eax, eax
mov dword [esi + 0x70], 0x12345678
test cl, cl
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmovne eax, edx
mov dword [esi + 0x7c], eax
test ebx, ebx
je 0x4185fb
nop dword [eax]
mov al, byte [ebx]
test al, al
je 0x4185fb
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
movzx eax, cl
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
mov dword [esi + 0x70], ecx
mov ecx, dword [esi + 0x78]
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x420fc0]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x4185b0
mov eax, dword [ebp - 0xc]
add eax, 0x1e
mov dword [edi + 0x7c], esi
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419090
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x4190c2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4190c2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4191ac
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x4190e1
cmp dx, 0x5c
jne 0x4190e3
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4190d5
cmp edi, ebx
je 0x41912e
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x208
jae 0x4191bc
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00419090
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x419153
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x419143
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x419155
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x419170
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x4191ac
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a23c
mov esp, ebp
pop ebp
ret
call fcn.0041a835
int3
Function at 0x4195a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dfb7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x42800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
push 0x44c
call fcn.0041a6e3
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
mov dword [ebx], 0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x238], 0xffffffff
mov dword [ebx + 0x23c], 0
mov dword [ebx + 0x240], 0
test esi, esi
je 0x41964d
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419620
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0041a6c7
add esp, 4
mov dword [ebx + 0x23c], eax
sub eax, esi
nop dword [eax]
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [eax + esi - 1], cl
test cl, cl
jne 0x419640
mov dword [ebp - 4], 0xffffffff
cmp dword [ebx], 0
jne 0x419727
cmp dword [ebx + 4], 0xffffffff
jne 0x419727
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419680
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x4196b7
cmp eax, 0x2f
je 0x4196b7
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4196a4
mov eax, dword [0x42290c]
mov dword [edi], eax
push 0x20
call fcn.0041a6e3
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x18], ecx
mov ecx, eax
mov word [eax], 0x100
mov byte [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.00417b90
mov dword [ebx], eax
test eax, eax
jne 0x4196f8
mov eax, 0x200
jmp 0x41972c
push 8
mov dword [0x428a20], 0
call fcn.0041a6e3
add esp, 4
mov dword [eax], 1
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x1000000
mov dword [0x428a20], eax
mov eax, dword [ebx + 0x23c]
test eax, eax
je 0x419744
push eax
call fcn.0041a6d0
add esp, 4
mov eax, dword [ebx + 0x240]
mov dword [ebx + 0x23c], 0
test eax, eax
je 0x419761
push eax
call fcn.0041a6d0
add esp, 4
push 0x44c
push ebx
mov dword [ebx + 0x240], 0
call fcn.0041a6d5
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419ef0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x419fc5
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x419f28
cmp dword [esi + 0x40], ebx
jae 0x419f28
push ecx
call fcn.0041a6d0
add esp, 4
mov dword [esi + 0x3c], 0
jmp 0x419f2c
test eax, eax
jne 0x419f3e
lea eax, [ebx + ebx]
push eax
call fcn.0041a6c7
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x419fc2
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x421500]
movzx eax, cl
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
mov dword [esi + 0x30], ecx
mov ecx, edi
xor ecx, 1
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x421500]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x419f52
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41a003
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x419fea
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x41a025
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x22f86974
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x29573df4
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x408b24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408b76
test eax, edx
je 0x408b79
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408b39
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408b5f
add ecx, 4
js 0x408b4f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408b5c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408b85
test edx, edx
jne 0x408b2c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42364c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x423652
ret
Function at 0x43d964
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43db1f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040533c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x43db38
call fcn.00404ed0
mov eax, ebx
call fcn.0041f964
mov edi, eax
dec edi
test edi, edi
jl 0x43da1c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041f938
mov edx, dword [0x430574]
call fcn.00403ef8
test al, al
je 0x43da18
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0041f938
lea edx, [ebp - 0x14]
call fcn.0045f414
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040533c
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404f4c
inc esi
dec edi
jne 0x43d9ca
movzx eax, byte [0x43db3c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43db48
mov eax, dword [ebp - 8]
call fcn.0040e4c4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404c50
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0045f414
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43db38
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.0045f414
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43db38
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43db38
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43db54
call fcn.0040a4c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43db26
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404bdc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404bdc
lea eax, [ebp - 0x14]
call fcn.00404bb8
lea eax, [ebp - 0x10]
call fcn.00404bb8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404bdc
ret
Function at 0x402a46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x402a63
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x10]
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x402a7a
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc