joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cd5de
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ccf9c

Function at 0x100d69c0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d65b3

Function at 0x100d69cb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d673d

Function at 0x100db3e8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100db2bc

Function at 0x100efd48
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
jmp 0x100efd4a
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x100e3fc0

Function at 0x100f87a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x110], 0
jmp 0x10109f50
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push ebp
mov ebp, esp
sub esp, 0x14c
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x114], 0
jmp 0x100f66f8
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x88], 0
nop
jmp 0x100f6c98

Function at 0x100ff230
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x100ff232
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x10101fd0
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret

Function at 0x1010cc20
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
jmp 0x1010cc22
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x1010a3f8

Function at 0x101121b8
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x101121ba
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x10112898
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret

Function at 0x10116440
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
jmp 0x10116442
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x101162d8
Function at 0x1013a270
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
jmp 0x1013a272
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x10119728
Function at 0x10153270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1013c18f
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1013c1c1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1013c176
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1013c1b1
sal byte [eax + 0x468504a], cl
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x40], 0xf3bcc908
mov dword [ebp - 0x3c], 0x6a09e667
mov dword [ebp - 0x38], 0x84caa73b
mov dword [ebp - 0x34], 0xbb67ae85
jmp 0x1013d0b0

Function at 0x101593f0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ebp - 4], 0xc3d2e1f0
push 0x14
mov eax, dword [ebp + 8]
add eax, 0x50
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10154850
add esp, 0xc
mov edx, dword [ebp + 8]
jmp 0x101561a0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0x67452301
mov dword [ebp - 0x10], 0xefcdab89
mov dword [ebp - 0xc], 0x98badcfe
mov dword [ebp - 8], 0x10325476
jmp 0x10127260

Function at 0x1015fa48
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
mov ecx, 0x28
call fcn.1011e553
call 0x10127535
pop esi
add esi, 0x4763
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x28
call 0x10127549
pop esi
add esi, 0xffff24ff
rep movsb byte es:[edi], byte [esi]
jmp 0x10164138
call 0x101383fd
pop esi
add esi, 0xfffe6ee3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x28
call 0x10138411
pop esi
add esi, 0x30787
rep movsb byte es:[edi], byte [esi]
jmp 0x1011e548
mov edi, dword [ebp - 0x288]
mov ecx, 0x28
call 0x1014d539
pop esi
add esi, 0xffff36af
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x28
jmp 0x10127530
push ebp
mov ebp, esp
sub esp, 0x794
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x284], eax
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x288], ecx
jmp 0x1014d528
mov ecx, 0x28
call 0x10164143
pop esi
add esi, 0xfffb7165
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x28
jmp 0x101383f8
Function at 0x1016c0d0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x18], ecx
xor eax, eax
ret
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
jmp 0x101698f8
jmp 0x1016c0d2
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
jmp 0x1016e728
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
jmp 0x1016bb00

Function at 0x10170c08
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
jmp 0x10170c0a
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x101700a0

Function at 0x10176358
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ebx, byte [edi + eax]
xor bl, byte [eax]
add eax, 4
mov byte [eax + ebp - 4], bl
movzx ebx, byte [edx + ecx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
movzx ebx, byte [eax - 2]
xor bl, byte [esi - 1]
jmp 0x1017d4f0
push ecx
push ebx
push ebp
mov ebx, eax
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, edx
mov ebp, ebx
lea esi, [edx + 3]
sub edi, eax
sub ebp, eax
lea ecx, [ebx + 1]
sub edx, ebx
mov dword [esp + 0x10], 4
jmp 0x101748a0
add esi, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [esi - 4]
dec dword [esp + 0x10]
mov byte [ecx - 2], bl
jne 0x101748a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1017ba88
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x1017ba8a
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x1017d0b8
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret

Function at 0x1017c4d8
Capabilities:
Hash data using sha1

Disassembly:
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xc3d2e1f0
push 0x14
mov eax, dword [ebp + 8]
add eax, 0x50
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10179198
add esp, 0xc
mov edx, dword [ebp + 8]
jmp 0x10175c28
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0x67452301
mov dword [ebp - 0x10], 0xefcdab89
mov dword [ebp - 0xc], 0x98badcfe
mov dword [ebp - 8], 0x10325476
jmp 0x10175d18

Function at 0x10181958
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ebx, byte [edi + eax]
xor bl, byte [eax]
add eax, 4
mov byte [eax + ebp - 4], bl
movzx ebx, byte [edx + ecx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
movzx ebx, byte [eax - 2]
xor bl, byte [esi - 1]
jmp 0x10180468
add esi, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [esi - 4]
dec dword [esp + 0x10]
mov byte [ecx - 2], bl
jne 0x1017e848
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ecx
push ebx
push ebp
mov ebx, eax
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, edx
mov ebp, ebx
lea esi, [edx + 3]
sub edi, eax
sub ebp, eax
lea ecx, [ebx + 1]
sub edx, ebx
mov dword [esp + 0x10], 4
jmp 0x1017e848
Function at 0x10184920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ebx, byte [edi + eax]
xor bl, byte [eax]
add eax, 4
mov byte [eax + ebp - 4], bl
movzx ebx, byte [edx + ecx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
movzx ebx, byte [eax - 2]
xor bl, byte [esi - 1]
jmp 0x10184088
add esi, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [esi - 4]
dec dword [esp + 0x10]
mov byte [ecx - 2], bl
jne 0x10183f48
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ecx
push ebx
push ebp
mov ebx, eax
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, edx
mov ebp, ebx
lea esi, [edx + 3]
sub edi, eax
sub ebp, eax
lea ecx, [ebx + 1]
sub edx, ebx
mov dword [esp + 0x10], 4
jmp 0x10183f48
Function at 0x101914b8
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
jmp 0x101914ba
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x1018f320

Function at 0x10197c70
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x10197c72
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x101a6dd8
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
Function at 0x101aa228
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor eax, eax
ret
jmp 0x101aa22a
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp 0x101a7a78
Function at 0x1002412
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
push 0x5c
push dword [ebx]
xor edi, edi
mov dword [ebp - 0x10], esi
inc edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
cmp eax, esi
jne 0x1002442
mov eax, dword [ebx]
jmp 0x1002449
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor edx, edx
inc edx
cmp dword [ebp + 8], edx
mov dword [ebp - 4], eax
jle 0x10024bc
mov eax, dword [ebx + edi*4]
movzx ecx, word [eax]
cmp cx, 0x2d
je 0x1002466
cmp cx, 0x2f
jne 0x10024bc
movzx ecx, word [eax + 2]
cmp cx, 0x6d
je 0x10024a4
cmp cx, 0x4d
je 0x10024a4
cmp cx, 0x72
je 0x1002499
cmp cx, 0x52
je 0x1002499
cmp cx, 0x66
je 0x100248e
cmp cx, 0x46
jne 0x10024bc
cmp word [eax + 4], si
jne 0x10024bc
or dword [ebp - 0xc], edx
jmp 0x10024b6
cmp word [eax + 4], si
jne 0x10024bc
mov dword [ebp - 0x14], edx
jmp 0x10024b6
cmp word [eax + 4], 0x3a
jne 0x10024bc
add eax, 6
cmp word [eax], si
je 0x10024bc
mov dword [ebp - 0x10], eax
inc edi
cmp dword [ebp + 8], edi
jg 0x1002454
mov eax, dword [ebp + 8]
sub eax, edi
cmp eax, edx
jl 0x1002516
mov esi, dword [ebx + edi*4]
movzx eax, word [esi]
cmp ax, 0x2d
je 0x10024d7
cmp ax, 0x2f
jne 0x10024e0
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
and dword [ebp - 8], 0
inc edi
cmp dword [section..data], 0
je 0x1002516
mov eax, section..data
push dword [eax]
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1002526
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
shl eax, 4
lea eax, [eax + section..data]
cmp dword [eax], 0
jne 0x10024f3
push dword [ebp - 4]
call fcn.0100196c
rol edi, 0x14
inc edx
not ecx
call fcn.01006f20
dec ecx
add byte [eax], al
add ecx, 0xfffd539
xor esi, eax
rol eax, 0xb
neg edx
mov eax, 0x44bfaee
inc esi
xor edi, edx
rol eax, 0x11
shr esi, 9
mov ecx, 0x16b725f8
ror eax, 0x17
neg edx
inc eax
xchg edi, eax
shr edx, 0x17
xor dword [0x100913b], 0x309b25e6
inc esi
xchg edx, edx
ror esi, 0x15
or esi, dword [0x10093c4]
mov dword [0x1009064], 0xafa9836
xor dword [0x10093c3], ecx
xchg eax, esi
rol edi, 1
add edx, esp
invalid
xor edi, edx
mov esi, eax
xor esi, 0xc8b9140
test ebp, eax
jo 0x1002587
inc eax
xchg ecx, eax
mov ecx, dword [eax*4 - 0x3e078f3b]
mov byte [edx], 0x46
rol esi, 2
inc esi
mov ecx, dword [0x100952c]
neg edx
xchg esi, eax
dec edx
mov edx, edi
mov ebx, eax
xor ecx, esi
xor edx, 0x3617756d
mov esi, eax
mov esi, eax
mov ecx, 0x266caf80
mov dword [0x100916c], esi
inc esi
add dword [0x10094b6], 0x361f9f6
inc esi
xchg eax, edx
xor dword [0x1009084], ebx
xchg eax, edx
xor dword [0x10094f2], esi
shr esi, 1
shl esi, 0x1d
call fcn.01002efa
rol edx, 0x16
loop 0x10025b1
and esi, edi
mov ebx, edx
xchg edi, edx
shl esi, 0xe
xor edi, esi
invalid
test esp, eax
jo 0x10025a9
or eax, 0x51d643f
dec ecx
sub ecx, eax
mov ecx, 0x4585a80
Function at 0x10025ed
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
inc byte [ebp - 0x7e488f3c]
enter 0x643f, 0x1d
add eax, 0xb9c82b49
sbb byte [edx + 0x58], 4
xchg esi, esi
not edx
call fcn.010060c5
ror esi, 0xf
inc edx
not esi
mov dword [0x1009100], ecx
xchg eax, eax
shr esi, 0x1c
inc edi
xor dword [0x10091ec], ecx
shl esi, 0x11
neg esi
call fcn.01006a63
loop 0x1002600
mov esi, ebx
sub ecx, dword [0x1009204]
ror esi, 9
mov esi, 0x13da1091
mov ecx, edx
add esi, 0x3ffd161
and esi, edi
mov esi, eax
neg edi
add esi, eax
xor edx, eax
ror esi, 0xb
add ecx, eax
xchg esi, eax
test esi, ebx
jb 0x10026af
mov ecx, 0x118
dec esi
neg ecx
xor edi, dword [0x1009cbc]
xor esi, eax
neg eax
sub ebx, eax
xor esi, eax
xor edi, dword [0x1009d55]
dec esi
ror esi, 0x14
sub esi, eax
mov dword [0x10098d7], edi
mov dword [0x1009ae3], 0x81b89bc
xor esi, edx
xor edi, eax
rol eax, 5
mov dword [0x1009bf8], 0x6b3560d
mov dword [0x10099dc], esi
xchg eax, eax
rol ebx, 0x1e
ror ebx, 0x1e
xchg eax, eax
or dword [0x1009982], ebx
cdq
add byte [ecx], al
sbb byte [ecx - 0x373eff00], 5
Function at 0x4936f9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x493727
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x493745
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049365f
jmp 0x493745
mov eax, dword [esi + 0x14]
test eax, eax
je 0x493745
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049365f
test edi, edi
mov eax, edi
jne 0x49372f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x500e3b16
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4c28217b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xb410b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb410b9
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xb41596
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
lea eax, [ebp - 4]
call fcn.00a153f0
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb10c74]
call fcn.00b12c00
mov dword [ebp - 0x20], eax
xor ecx, ecx
push ebp
push 0xb41569
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12cec
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb410ac
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb41090
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb41094
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
movzx edx, byte [0xb415a8]
call fcn.00b120a8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.00af0c80
test al, al
je 0xb41191
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b12554
jmp 0xb4119f
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b125d4
mov eax, dword [ebp - 0xc]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b12654
xor eax, eax
push ebp
push 0xb41206
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12514
jmp 0xb411ee
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0xba9da8]
mov eax, dword [eax]
call fcn.00a86f08
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb411fc
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb411cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb41210
call fcn.01895711
xor eax, 0x37e374e3
sub byte cs:[0x7c4b444], al
xchg byte [0xd3af07c3], ch
invalid
Function at 0x55dcbf
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0xf0000040
push 1
push ebx
push ebx
lea edi, [esi + 4]
mov dword [esi], ebx
push esi
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x55dcf5
push edi
push ebx
push ebx
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5741b6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00573e76

Function at 0x576f26
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00576da5

Function at 0x57c0b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x57c0dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x57c0dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x401080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push str.Enter_password:
mov dword [ebp - 8], 0
call fcn.00401020
lea eax, [ebp - 8]
push eax
push 0x40312c
call fcn.00401050
movaps xmm1, xmmword [0x403160]
add esp, 0xc
xor eax, eax
nop dword [eax + eax]
movups xmm0, xmmword [eax + 0x404098]
xorps xmm0, xmm1
movups xmmword [eax + 0x404098], xmm0
add eax, 0x10
cmp eax, 0x30
jl 0x4010c0
cmp eax, 0x35
jge 0x4010ef
lea eax, [eax + 0x404098]
xor byte [eax], 0xae
inc eax
cmp eax, 0x4040cd
jl 0x4010e4
push dword [ebp - 8]
mov eax, 0x404098
call eax
test eax, eax
mov edx, str.oh__yes__my_king_
mov ecx, str.go_fuck_youself_
cmovne ecx, edx
push ecx
call fcn.00401020
add esp, 8
call sub.api_ms_win_crt_conio_l1_1_0.dll__getch
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00401126
mov esp, ebp
pop ebp
ret

Function at 0x401920
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40195f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40195f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40195f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40195f
cmp dword [ecx + 0x74], 0xe
jbe 0x40195f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x419610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419628
mov eax, 1
add ebx, ebx
jne 0x41964b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419640
jne 0x41965c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419640
xor ecx, ecx
sub eax, 3
jb 0x419670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4196e2
mov ebp, eax
add ebx, ebx
jne 0x41967b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4196ac
inc ecx
add ebx, ebx
jne 0x419698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41968d
jne 0x4196a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41968d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4196cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4196bd
jmp 0x41962e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4196cc
add edi, ecx
jmp 0x41962e
pop esi
mov edi, esi
mov ecx, 0x677
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4196ea
cmp byte [edi], 5
jne 0x4196ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4196ef
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41975e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a578]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a62c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41971c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a630]
or eax, eax
je 0x419758
mov dword [ebx], eax
add ebx, 4
jmp 0x419739
call dword [esi + 0x1a634]
popal
jmp 0x40aaf8