joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9820
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8e000]
push edi
or ebp, 0xffffffff
jmp 0x4c9842
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c9849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c9838
mov eax, 1
add ebx, ebx
jne 0x4c985b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c986c
jne 0x4c988b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c988b
dec eax
add ebx, ebx
jne 0x4c9878
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c9850
add ebx, ebx
jne 0x4c9887
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c98dd
xor ecx, ecx
sub eax, 3
jb 0x4c98a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c9912
sar eax, 1
mov ebp, eax
jmp 0x4c98ae
add ebx, ebx
jne 0x4c98ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c987c
inc ecx
add ebx, ebx
jne 0x4c98bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c987c
add ebx, ebx
jne 0x4c98c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c98be
jne 0x4c98da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c98be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c98fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c98ee
jmp 0x4c983e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c98fc
add edi, ecx
jmp 0x4c983e
pop esi
mov edi, esi
mov ecx, 0x37cf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c991a
cmp byte [edi], 0x13
jne 0x4c991a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c991f
lea edi, [esi + 0xc6000]
mov eax, dword [edi]
or eax, eax
je 0x4c998e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf538c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf547c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c994c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf5480]
or eax, eax
je 0x4c9988
mov dword [ebx], eax
add ebx, 4
jmp 0x4c9969
call dword [esi + 0xf5490]
mov ebp, dword [esi + 0xf5484]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c99c2
sub esp, 0xffffff80
jmp 0x4898b0
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x2a2a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x2a2a860]
xor edx, dword [ebx*4 + 0x2a2ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x2a2a460]
add ecx, 4
xor edx, dword [eax*4 + 0x2a2b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x2a2a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x2a2ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x2a2a460]
add ecx, 4
xor eax, dword [edx*4 + 0x2a2b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x2a2a860]
xor edx, dword [ebx*4 + 0x2a2ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x2a2a460]
xor edx, dword [eax*4 + 0x2a2b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x2a2a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x2a2ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x2a2a460]
xor eax, dword [edx*4 + 0x2a2b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x2a2a860]
xor edx, dword [ebx*4 + 0x2a2ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x2a2a460]
xor edx, dword [eax*4 + 0x2a2b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x2a2a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x2a2ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x2a2a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x2a2b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x2a2a860]
xor edx, dword [ebx*4 + 0x2a2ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x2a2a460]
add ecx, 4
xor edx, dword [eax*4 + 0x2a2b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x2a2a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x2a2ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x2a2a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x2a2b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x2a2a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x2a2ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x2a2a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x2a2b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x2a2a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x1000b140
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
push esi
push edi
je 0x1000b1fd
mov ecx, dword [esp + 0x18]
xor eax, eax
jmp 0x1000b160
imul ecx, ecx, 0x2e90edd
add ecx, 1
mov dword [eax + 0x453740f0], ecx
add eax, 4
cmp eax, 0x10
jb 0x1000b160
mov eax, dword [0x453740f8]
xor eax, dword [0x453740f0]
mov ecx, dword [0x453740fc]
shr eax, 0x1f
lea edx, [ecx + ecx]
or eax, edx
mov dword [0x453740fc], eax
mov eax, 0x453740f4
mov ecx, 0x7b
nop
mov edx, dword [eax + 8]
xor edx, dword [eax]
mov esi, dword [eax - 4]
xor esi, dword [eax + 4]
shr edx, 0x1f
add esi, esi
or edx, esi
mov dword [eax + 0xc], edx
add eax, 4
sub ecx, 1
jne 0x1000b1a0
xor ecx, ecx
mov dword [0x4536a590], ecx
jmp 0x1000b1d0
mov eax, dword [ecx*4 + 0x453740f0]
push eax
call fcn.10027bf0
mov ecx, dword [0x4536a590]
mov dword [ecx*4 + 0x453740f0], eax
add ecx, 1
add esp, 4
cmp ecx, 0x7f
mov dword [0x4536a590], ecx
jb 0x1000b1d0
jmp 0x1000b203
mov ecx, dword [0x4536a590]
mov edi, dword [esp + 0x10]
test edi, edi
je 0x1000b24f
mov esi, dword [esp + 0xc]
lea edx, [ecx + 1]
push ebx
lea eax, [edx - 0x40]
and eax, 0x7f
mov eax, dword [eax*4 + 0x453740f0]
mov ebx, edx
and ebx, 0x7f
xor eax, dword [ebx*4 + 0x453740f0]
mov ebx, ecx
and ebx, 0x7f
mov dword [ebx*4 + 0x453740f0], eax
xor dword [esi], eax
add ecx, 1
add edx, 1
add esi, 4
sub edi, 1
jne 0x1000b213
mov dword [0x4536a590], ecx
pop ebx
pop edi
pop esi
ret
Function at 0x1001a4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, dword [0x453e0d24]
push ebp
push esi
push eax
push 2
lea ecx, [esp + 0x10]
push 1
push ecx
xor ebp, ebp
xor esi, esi
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], 0xff
call fcn.10028910
add esp, 0x10
call fcn.10002bb0
cmp eax, 0x80008
jne 0x1001a603
call fcn.10002bb0
test eax, eax
je 0x1001a603
push ebx
call fcn.10002b60
movzx ebx, ax
cmp ebx, 0xa
je 0x1001a53e
cmp ebx, 0xc
jne 0x1001a602
mov eax, 0x20
sub eax, ebx
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], eax
mov edi, 0x453c0600
mov dword [esp + 0x18], 8
jmp 0x1001a560
cmp esi, ebx
jge 0x1001a5d2
mov edx, dword [0x453e0d24]
push edx
push 2
lea eax, [esp + 0x18]
push 1
push eax
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], 0xff
call fcn.10028910
add esp, 0x10
xor eax, eax
cmp word [0x453c0590], 0x4949
jne 0x1001a59d
mov ah, byte [esp + 0x11]
mov al, byte [esp + 0x10]
jmp 0x1001a5a9
movzx cx, byte [esp + 0x11]
mov ah, byte [esp + 0x10]
or eax, ecx
mov ecx, dword [esp + 0x14]
mov edx, ecx
and edx, 1
movzx edx, word [edx*2 + 0x452f2000]
movzx eax, ax
xor edx, eax
mov eax, dword [esp + 0x1c]
shl ebp, 0x10
add ecx, 1
or ebp, edx
mov dword [esp + 0x14], ecx
add esi, 0x10
mov ecx, 0x20
sub ecx, esi
mov edx, ebp
shl edx, cl
mov ecx, eax
sub esi, ebx
add edi, 2
shr edx, cl
sub dword [esp + 0x18], 1
mov word [edi - 2], dx
jne 0x1001a560
cmp edi, 0x453c0680
jl 0x1001a553
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x1001ce20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x453e0d24]
fld qword [0x452f84a8]
push ebx
fstp qword [esp + 0x18]
fld qword [0x452f84a8]
push esi
push edi
fstp qword [esp + 0x28]
push eax
mov esi, 2
push esi
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.10028910
mov eax, dword [ebp + 8]
add esp, 0x10
sub eax, esi
je 0x1001cf18
mov dword [esp + 0xc], eax
lea esp, [esp]
mov edx, dword [0x453e0d24]
push edx
push 1
lea edi, [esp + esi*2 + 0x20]
push 2
push edi
call fcn.10028910
movzx edx, byte [edi]
mov eax, esi
xor eax, 2
add eax, eax
movzx ecx, byte [esp + eax + 0x28]
movzx edi, byte [esp + eax + 0x29]
mov dword [esp + 0x24], edx
mov ebx, ecx
shl ebx, 8
or edi, ebx
movzx ebx, byte [esp + esi*2 + 0x29]
shl edx, 8
or ebx, edx
sub edi, ebx
xor edx, edx
mov dh, byte [esp + eax + 0x29]
mov dword [esp + 0x20], edi
xor eax, eax
mov ah, byte [esp + esi*2 + 0x29]
fild dword [esp + 0x20]
add esi, 1
add esp, 0x10
and esi, 3
fld st(0)
or edx, ecx
fmul st(1)
fadd qword [esp + 0x20]
or eax, dword [esp + 0x14]
fstp qword [esp + 0x20]
sub edx, eax
sub dword [esp + 0xc], 1
fstp st(0)
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fld st(0)
fmul st(1)
fadd qword [esp + 0x28]
fstp qword [esp + 0x28]
fstp st(0)
jne 0x1001ce70
fld qword [esp + 0x20]
fcomp qword [esp + 0x28]
fnstsw ax
test ah, 5
mov eax, 0x4d4d
jnp 0x1001cf1d
mov eax, 0x4949
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c840
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
movd xmm6, dword [esp + 0x58]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ebp
mov eax, 1
cpuid
xor eax, eax
cmp dword [esp + 0x50], 5
jl 0x1002ca80
cmp dword [esp + 0x54], 5
jl 0x1002ca80
test edx, 0x4000000
je 0x1002ca80
movss xmm5, dword [0x452fb780]
pshufd xmm6, xmm6, 0xe0
xorps xmm7, xmm7
cvtdq2ps xmm6, xmm6
shufps xmm5, xmm5, 0xe0
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
lea eax, [0x452ec530]
lea edi, [0x452ec495]
test dword [esp + 0x3c], 1
cmovne eax, edi
lea edi, [ebp*8]
call eax
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
lea eax, [0x452ec70c]
lea edi, [0x452ec5d4]
test dword [esp + 0x3c], 1
cmovne eax, edi
lea edi, [ebp*8]
add ebx, edi
add ecx, edi
add edx, edi
xor esi, esi
call eax
movdqu xmm0, xmmword [esp + 0x3c]
movdqu xmm1, xmmword [esp + 0x4c]
sub esp, 0x20
movdqu xmmword [esp], xmm0
movdqu xmmword [esp + 0x10], xmm1
call fcn.1002caa0
add esp, 0x20
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
sub esi, 2
mov eax, dword [esp + 0x3c]
mov edi, ebx
test esi, 1
cmove ebx, edx
cmove edx, edi
xor eax, esi
test eax, 1
lea eax, [0x452ec5d4]
lea edi, [0x452ec70c]
cmovne eax, edi
lea edi, [ebp*8]
imul esi, edi
add ebx, esi
add ecx, esi
add edx, esi
xor esi, esi
call eax
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
sub esi, 1
mov eax, dword [esp + 0x3c]
mov edi, ebx
test esi, 1
cmovne ebx, edx
cmovne edx, edi
xor eax, esi
test eax, 1
lea eax, [0x452ec530]
lea edi, [0x452ec495]
cmovne eax, edi
lea edi, [ebp*8]
imul esi, edi
neg edi
add ebx, esi
add ecx, esi
add edx, esi
call eax
mov esi, dword [esp + 0x54]
sub esi, 4
mov dword [esp + 0x10], esi
mov dword [esp], 2
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov esi, dword [esp]
add dword [esp], 1
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
mov eax, dword [esp + 0x3c]
mov edi, ebx
test esi, 1
cmove ebx, edx
cmove edx, edi
xor eax, esi
test eax, 1
lea eax, [0x452ec5d4]
lea edi, [0x452ec70c]
cmovne eax, edi
lea edi, [ebp*8]
imul esi, edi
add ebx, esi
add ecx, esi
add edx, esi
lea esi, [ebp - 4]
neg esi
call eax
sub dword [esp + 0x10], 1
jne 0x1002ca11
mov eax, 1
emms
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
add esp, 0x38
ret
Function at 0x403ab0
Capabilities:
Encode data using xor

Disassembly:
add al, byte [ecx]
test eax, eax
je 0xa75f3c25
add byte [ebp + 0x6c840fc0], al
add dword [edi], ebx
cmpsd dword [esi], dword es:[edi]
rcr byte [0xd04102b4], 0xe9
popal
add dword [eax], eax
cwde
mov esi, 0xf154b4df
add byte [ecx], al
jne 0x403ad7
mov eax, dword [esi - 0x60]
mov dword [0x1c41028c], eax
jmp 0x403afb
mov ecx, dword [esi + 0x10]
mov eax, dword [0x41028c]
dec al
je 0x403aae
mov ecx, dword [0x4102b8]
mov eax, dword [0xf54102c0]
inc ecx
inc eax
mov dword [0x41029e], ecx
mov dword [0x764102c0], eax
mov eax, dword [0xdb410257]
mov ecx, dword [0xf440d010]
cmp edx, dword [edi + 0x1171ad1]
add byte [eax], al
mov edx, dword [0x410bc8]
mov ebp, dword [ebp + 0x305e7c1]
out 0x40, al
mov dword [0x4102ac], eax
call fcn.004069cd
mov dword [0x410ba0], eax
mov dword [0x8aa2a4], edx
pop es
xchg byte [eax + 8], dl
add byte [eax], al
mov edx, dword [0xc9410ba4]
mov eax, dword [esi + 0x830]
mov dword [0x854], ebx
or dword [edi], eax
lcall 0x8900, 0x8348e
dec edi
add al, 0x8b
invalid

Function at 0x4089d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x66]
push esi
mov ebp, dword [ebx + 0x550b8608]
adc byte [eax], dl
push ebx
push esi
push 0xa104fe
push edi
push 0
push 0x86d4
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x408a3e
mov ecx, edi
sbb al, 0xc3
inc eax
add byte [ebp + 0x395b1378], al
cmp al, 0x5f
sbb bl, al
mov ah, 0
loop 0x408a1b
jecxz 0x408a1b
lds esp, [ebx + eax*8]
sub eax, dword [eax]
inc eax
test ecx, ecx
jne 0x408a7d
jmp 0x408a5f
mov eax, dword [edi + ebx*4]
sbb al, 0xc3
push cs
add byte [ebx + 0x50], dl
push esi
call fcn.0040a550
mov edi, esi
or cl, cl
push dword [ebx]
sal dl, 0xae
retf 0x49d1
push es
dec esp
xor bl, dh
dec eax
mov esp, 0x574aea3
stc
or ah, byte [esp + eax - 2]
mov esp, 0xc0852030
jne 0x408a3e
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
invalid
push edi
push 0xf4100e6
push ebx
push esi
call 0xfffe8680
or edx, 0x2d
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
inc ebp
nop
nop
xlatb
nop
nop
int1
nop
rcl byte [eax - 0x1374aa70], cl
mov eax, dword [ebp + 8]
push eax
push 0x15
adc al, 0xc1
inc eax
add byte [ebx - 0x3f7aff62], al
je 0x408aa7
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
in al, 0x52
call 0x9b408780
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp + 0x10]
or dword [ebp + 0xc], 0x68
push esp
stc
inc esp
add byte [eax + 0x51], dl
call 0x4c407980
add esp, 0xc
pop ebp
mov dword [0x8b559090], eax
test al, 0x83
in al, dx
or al, 0x8b
inc esp
or al, 0x56
mov esi, dword [ebp - 0x1e]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push 0xffffffffffffffe1
mov eax, dword [esi]
push 0
invalid
Function at 0x4098a0
Capabilities:
Encode data using xor

Disassembly:
cmp ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x409899
mov dword [ebx - 0x4b], edx
pop esi
mov ch, 0x5e
pop ebx
sar dword [edi + 0x10], 1
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4108dc]
push ebx
xor edx, edx
cmpsb byte [esi], byte es:[edi]
cmp eax, 0xffffffeb
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
xor al, 0x55
nop
jge 0x409890
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
cli
call fcn.00409ed0
out dx, al
les ecx, [eax]
xlatb
out dx, al
pop ebx
mov esp, ebp
xor dword [ebp - 0x8efb275], edi
in eax, 0x31
mov ebp, 0xf7104d8b
push edi
add byte [esi - 0x7bf0ff37], dh
sub al, 2
add byte [eax], al
mov eax, dword [ebx + esi - 0x25]
adc eax, 0x110000d8
add byte [ecx - 0x497603a3], cl
in al, dx
je 0x409900
jno 0x40993d
cld
add dword [eax], eax
add byte [edi - 0x6f0b1a75], ah
nop
stc
out 0x61, eax
add byte [edx], ah
ja 0x40997d
push es
invalid
rol dword [eax], 0x83
les ecx, [esp + eax*2]
inc esi
jne 0x409974
mov eax, dword [ebp + 0xc]
mov ebx, 4
jp 0x4098d2
pop ss
or byte [eax - 0x80], ch
add dword [ecx], eax
push eax
call dword [0x323554]
add esp, 0xc
or eax, 0x490ed0c0
dec ebp
or al, 0xc3
push es
add byte [esp + ebx*8 + 0x66], dl
mov dword [ecx - 0x6c], 0x61a1b7fc
shr dword [ebp + 0x75c08100], cl
sbb dword [eax + 0x68], edx
mov eax, dword [0xadd361]
add eax, 0x68501975
push eax
push str.GetNamedSecurityInfoW
mov eax, dword [0xfb60801]
push 0xa1004101
add dword [eax], ecx
mov dh, 0xf
add byte [eax], al
add esp, 0xc
mov dword [0x41064c], eax
test eax, eax
je 0x4099ce
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
sub cl, bl
push edx
lea esi, [ecx]
invalid
retf 0x558d
push 1
call dword [0x82c04c]
and al, al
cmp ebx, 6
jne 0x4099e6
mov edi, ebx
or al, 0x66
mov dword [edx + 0xc], 0xc9330043
xor ecx, ecx
cmp eax, ecx
xchg ebx, eax
test dword [ecx - 0x75000000], esi
jge 0x4099fb
mov esi, dword [ecx - 0x14]
push 0x405720
push 0x409c60
mov esi, dword [ebp - 0x891afae]
mov ebx, 0xb3e9ffff
stosd dword es:[edi], eax
add byte [eax], al
push ds
clc
sal dword [ebp + 0x57], 1
mov eax, dword [0x413750]
cmp eax, edx
jne 0x4099a7
push edx
ficom dword [eax - 0x2e]
inc ecx
add byte [edx + 1], ch
call fcn.0040a929
add esp, 0xc
mov dword [0x4106b2], eax
int3

Function at 0x43b649
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
and edi, edi
and esi, esi
call fcn.0043b680
push 0xb9ec5dc9
mov edi, dword [esp]
add esp, 4
xor dword [ebx], eax
dec edi
inc ebx
dec esi
or edi, edi
cmp ebx, ecx
jne fcn.0043b649
add edi, 0x74aa8726
inc edi
ret
Function at 0x4017c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401820
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401820
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401812
nop word [eax + eax]
cmp esi, edx
jae 0x401820
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401800
cmp esi, edx
jae 0x401820
cmp word [esi], 0
je 0x401820
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4038e0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1014
call fcn.00410470
mov eax, dword [0x76dec4]
xor eax, esp
mov dword [esp + 0x100c], eax
push esi
push edi
mov edi, dword [esp + 0x1020]
cmp byte [edi + 2], 0
je 0x403966
lea eax, [esp + 0x1028]
mov dword [esp + 0xc], 0
push eax
push 0
push dword [esp + 0x102c]
lea eax, [esp + 0x1c]
push 0xffffffffffffffff
push eax
call fcn.00401690
lea esi, [esp + 0x24]
add esp, 0x14
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x403936
push 0
lea eax, [esp + 0x10]
sub esi, ecx
push eax
push esi
lea eax, [esp + 0x1c]
push eax
push dword [0x76e7dc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403962
cmp dword [esp + 0xc], esi
je 0x403966
mov byte [edi + 2], 0
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.0040fa7f
add esp, 0x1014
ret
Function at 0x4062d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x76dec4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00406f80
test eax, eax
je 0x40641d
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00411b60
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00407650
add esp, 8
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00406fe0
add esp, 8
test eax, eax
je 0x40640a
push 0x44
push 0
lea eax, [ebp - 0x15c]
push eax
call fcn.00411b60
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x15c], 0x44
push str.C9632CF058AE4321B6B0B5EA39B710FE
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00417695
add esp, 0xc
push 0x427748
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.00417695
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x15c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4063f7
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406408
call fcn.00407270
call fcn.004071b0
mov eax, 3
jmp 0x40642e
jmp 0x40641b
call fcn.00407270
call fcn.004071b0
mov eax, 3
jmp 0x40642e
jmp 0x406422
call fcn.004085f0
call fcn.00407270
call fcn.004071b0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fa7f
mov esp, ebp
pop ebp
ret

Function at 0x406fe0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x406ff0
cmp dword [ebp + 0xc], 0
jne 0x406ff7
xor eax, eax
jmp 0x4070a0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4275ac
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp - 4], 0
jne 0x40702a
mov dword [0x76ee00], 6
xor eax, eax
jmp 0x4070a0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x40704b
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx], 0x5c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
push 0x4275b4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00417695
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x4275bc
call fcn.00405dd0
add esp, 8
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret