joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70dfa380
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x71855040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.70dfa3e0

Function at 0x70dfa3e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x71856378]
test esi, esi
jle 0x70dfa4cd
mov edi, dword [0x7185637c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x70dfa414
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x70dfa4c6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x70dfa400
mov dword [esp], eax
mov esi, eax
call fcn.70dfab80
test eax, eax
mov edi, eax
je 0x70dfa50a
mov esi, dword [0x7185637c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.70dfac90
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x7185637c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x70dfa4ea
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x70dfa4bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x70dfa4bf
mov eax, dword [esp + 0x20]
add ebx, dword [0x7185637c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x70dfa4d4
add dword [0x71856378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x70dfa41e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.70dfa380
mov eax, dword [0x7185637c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.70dfa380
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.70dfa380
lea esi, [esi]
Function at 0x70dfa7f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x71856388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x71856380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x70dfa845
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x70dfa83e
test esi, esi
je 0x70dfa83e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x70dfa820
mov dword [esp], 0x71856388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404400
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x404461
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x404444
cmp edi, 2
jb 0x404444
cmp byte [esi], cl
jne 0x404444
cmp byte [esi + 1], cl
jne 0x404444
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x434a30]
jmp 0x404415
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x434a30]
test edi, edi
jne 0x404415
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x404490
cmp cl, 0x23
jne 0x404477
cmp byte [esi], cl
jne 0x404477
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x434a30]
test cl, cl
jne 0x404468
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x4045a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4045b4
mov dword [ebx], 0
mov edx, 0x434814
call fcn.004044a0
mov esi, eax
test esi, esi
je 0x4046a2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x404698
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404698
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x404698
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404698
mov eax, dword [0x43c6d0]
test eax, eax
je 0x40462c
inc dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x404698
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40467d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x43c6d0]
add esp, 4
test eax, eax
je 0x40466a
dec dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x40468f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405c60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x434a30]
sub esi, 1
jne 0x405c93
mov eax, dword [0x43c6d0]
not ebx
cmp dword [eax + 0x1be0], ebx
jne 0x405cc2
mov dword [eax + 0x1be4], ebx
cmp dword [eax + 0x1c1c], ebx
jne 0x405cd1
mov byte [eax + 0x1c20], 1
cmp dword [eax + 0x1bc8], ebx
jne 0x405cea
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.004159c0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431906
mov esp, ebp
pop ebp
ret 4
Function at 0x40a2a0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40a2dd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40a2c3
cmp byte [esi], bl
jne 0x40a2c3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x434a30]
test bl, bl
jne 0x40a2b4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.0040a240

Function at 0x40f850
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43c6d0]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1ba8]
mov esi, 4
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x434a30]
sub esi, 1
jne 0x40f891
mov eax, dword [0x43c6d0]
not ebx
cmp dword [eax + 0x1bc8], ebx
jne 0x40f8cb
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.004159c0
add esp, 8
mov ecx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ecx
jne 0x40f8f6
inc esi
test ecx, ecx
je 0x40f8e4
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x40f8e9
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.00416320
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431906
mov esp, ebp
pop ebp
ret
Function at 0x414ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2fa8], 0
lea esi, [edi + 0x2fac]
je 0x414b42
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x414afc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.004165f0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00404970
mov edx, dword [esi]
mov ecx, 0x43c6cb
push dword [edi + 0x2fa8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2fb4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00404970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41e6ba
mov eax, dword [0x43c6d0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x41e6ad
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x41e6eb
mov eax, dword [0x43c6d0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x41e6de
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41e71c
mov eax, dword [0x43c6d0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x41e70f
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x41e769
mov eax, dword [0x43c6d0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x41e75c
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x41e79a
mov eax, dword [0x43c6d0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x41e78d
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41e7cb
mov eax, dword [0x43c6d0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x41e7be
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00420f10
Function at 0x43263c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43267b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43267b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43267b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43267b
cmp dword [ecx + 0x74], 0xe
jbe 0x43267b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401184
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00409460
mov eax, dword [0x249ac5c]
mov ecx, dword [0x249a6e8]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x401243
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x249ac5c], 0x959
jne 0x401232
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.Hipejes_joh_jagibavicedok_lozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401061
add ebx, 8
dec edi
jne 0x4011b0
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401510
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x800
push esi
xor esi, esi
cmp dword [0x249ac5c], 0x400
push edi
jne 0x401570
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.00402527
push esi
call fcn.004023b1
push esi
push esi
call fcn.004024e7
push esi
call fcn.00402bfd
push esi
push esi
call fcn.00402a48
push esi
call fcn.00402cb3
push esi
push esi
call fcn.004023eb
add esp, 0x28
xor edi, edi
cmp edi, 0x16c76
jge 0x401582
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x4015a8
inc edi
cmp edi, 0x3003f
jl 0x401572
mov eax, dword [0x47d69c]
mov dword [0x249ac5c], eax
call fcn.00401246
mov edi, 0x3078f
cmp dword [0x249ac5c], 0x51f
jne 0x4015d4
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x4015bc
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x404aff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47c824]
jne 0x404b09
repz ret
jmp fcn.0040804c
Function at 0x4090f2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47c824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a5e
and dword [ebp - 0x14], 0
cmp dword [0x488510], 0
mov dword [ebp - 0x18], eax
jne 0x4091a5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40924d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40924d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x488510], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x488514], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x488518], eax
call edi
push eax
call esi
mov dword [0x488520], eax
test eax, eax
je 0x4091a5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x48851c], eax
mov eax, dword [0x48851c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4091fe
cmp dword [0x488520], ecx
je 0x4091fe
push eax
call esi
push dword [0x488520]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4091fe
test ebx, ebx
je 0x4091fe
call edi
test eax, eax
je 0x4091f5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4091f5
test byte [ebp - 8], 1
jne 0x4091fe
or dword [ebp + 0x10], 0x200000
jmp 0x409231
mov eax, dword [0x488514]
cmp eax, dword [ebp - 0x18]
je 0x409231
push eax
call esi
test eax, eax
je 0x409231
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409231
mov eax, dword [0x488518]
cmp eax, dword [ebp - 0x18]
je 0x409231
push eax
call esi
test eax, eax
je 0x409231
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x488510]
call esi
test eax, eax
je 0x40924d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40924f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404aff
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x61a03d95
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x40161865
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1017c1d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 8]
mov ecx, dword [0x102b1638]
add ecx, 0xffffd373
mov dword [0x102b1634], ecx
mov dword [ebp - 0x10], eax
call fcn.1017d4f6
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x102b1634], 0x9dc
mov edi, dword [0x102b1638]
add edi, 0x21bf
mov dword [0x102b1638], edi
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x102b1634], 0xffffeeb0
mov dword [0x102b1638], 0x15d7
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x1017c38c
jmp 0x1017c26c
mov al, byte [ebp - 0x25]
test al, 1
jne 0x1017c356
jmp 0x1017c31a
mov eax, 0x15d7
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
xor esi, esi
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + eax*4]
mov edi, edx
add edi, 0xffffecbf
mov dword [0x102b1634], edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x25], cl
je 0x1017c25c
mov eax, dword [ebp - 0x4c]
add eax, 1
mov cl, byte [ebp - 0x4d]
cmp cl, 0
setne dl
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x55], dl
mov al, byte [ebp - 0x25]
mov cl, byte [ebp - 0x55]
and al, cl
mov edx, dword [ebp - 0x54]
cmp edx, 0x20
setb ah
and al, ah
test al, 1
mov dword [ebp - 0x48], edx
jne 0x1017c2b4
jmp 0x1017c25c
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0xffffec71
mov dword [0x102b1638], ecx
mov edx, dword [ebp - 0x3c]
add edx, 2
mov esi, dword [ebp - 0x38]
add esi, 1
mov edi, dword [ebp - 0x18]
cmp esi, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], eax
jb 0x1017c286
jmp 0x1017c38c
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov edi, dword [edx + esi + 0x1c]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x60]
add eax, ecx
mov edx, dword [ebp - 0x5c]
mov eax, dword [eax + edx*4]
mov dword [0x102b1634], 0x651
mov esi, dword [ebp - 0x1c]
add esi, eax
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1017c6ee
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102b1640], 0
mov byte [0x102b1644], 0
mov dword [0x102b163c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x102b1634], 0x7ed
mov eax, dword [0x102b163c]
add eax, 1
mov dword [0x102b163c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1017c729
xor eax, eax
mov dword [0x102b1638], 0x441
mov dword [0x102b163c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x102b1648], 0
mov dword [0x102b1638], 0x2651
mov edx, dword [0x102b1640]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x102b1648], edi
mov dword [0x102b1634], 0x103
mov eax, edi
cdq
idiv ecx
mov dword [0x102b1640], edx
mov dword [0x102b1638], 0xfffff8df
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x102b1644], cl
mov dword [0x102b1638], 0x23a8
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x102b1644]
mov edx, dword [0x102b1640]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x102b1634], 0x11a4
mov edx, dword [0x102b163c]
add edx, 1
mov dword [0x102b163c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1017c772
mov dword [0x102b1634], 0x12fc
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret