joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409590
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x4095f5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x4095b0
mov eax, 0x270
jmp 0x4096cf
cmp eax, 0x4e0
jb 0x4096cf
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x409610
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x409660
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret

Function at 0x413270
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x800
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402750
mov esi, eax
cmp esi, 0
jne 0x413298
xor eax, eax
jmp 0x41519e
xor edi, edi
jmp 0x41329c

Function at 0x415640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov edx, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
xor eax, eax
nop
nop
Function at 0x41bc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0x41bc60
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0x41bce0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41bd21
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bd10
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x41bd51
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bd40
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0x41bd81
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bd70
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0x41bdb0
movzx eax, byte [esp + 0x48]
test al, al
je 0x41be2d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41be20
jmp 0x41be31
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.0040ba40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x443794]
mov ecx, 0xae6ce794
xor ecx, dword [0x44379c]
add eax, ecx
inc eax
jmp eax
Function at 0x43d660
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x43d680
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x43df70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43df90
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43dfab
mov eax, 0xffffffff
jmp 0x43dfae
add eax, 0xa
push eax
call fcn.00408bf0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43dff1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43dfe0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232ac]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232ac], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43e070
mov esi, dword [esp]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43e102
xor edx, edx
mov edi, dword [0x449660]
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43e0c0
inc edx
cmp ecx, edx
jne 0x43e0b0
jmp 0x43e102
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43e102
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x449664]
mov edi, eax
call fcn.0043c080
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408c00
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e140
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43e15b
mov eax, 0xffffffff
jmp 0x43e15e
add eax, 0xa
push eax
call fcn.00408bf0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43e1a1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43e190
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232ac]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232ac], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43e220
mov esi, dword [esp]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43e2a4
xor edx, edx
mov ebx, dword [0x449660]
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43e270
inc edx
cmp ecx, edx
jne 0x43e260
jmp 0x43e2a4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43e2a4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x449664]
mov edi, eax
call fcn.0043c080
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408c00
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e2e0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43e2fb
mov eax, 0xffffffff
jmp 0x43e2fe
add eax, 0xa
push eax
call fcn.00408bf0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43e341
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43e330
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232cc]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232cc], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43e3c0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43e439
xor edx, edx
mov edi, dword [0x449660]
nop
cmp dword [edi + edx*8], 0xcaa82e26
je 0x43e410
inc edx
cmp ecx, edx
jne 0x43e400
jmp 0x43e439
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43e439
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x449664]
mov edi, eax
call fcn.0043c080
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408c00
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43e44f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x43e480
mov eax, dword [esp]
mov edx, dword [0x44965c]
test edx, edx
je 0x43e4f8
xor ebx, ebx
mov ecx, dword [0x449660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43e4d0
inc ebx
cmp edx, ebx
jne 0x43e4c0
jmp 0x43e4f8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43e4f8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x449664]
call fcn.0043c080
add esp, 0x20
test edi, edi
je 0x43e502
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43e50e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xc8c9cacb
mov eax, 0x967dcd54
movzx edi, byte [esp + eax + 0x698232b0]
xor edi, eax
mov ebx, edi
and ebx, 0x5f
add ebx, ebx
xor edi, 0xa0
sub ebx, edi
mov byte [esp + eax + 0x698232b0], bl
inc eax
cmp eax, 0x967dcd58
jne 0x43e6a0
mov eax, dword [esp + 4]
mov ebx, dword [0x44965c]
test ebx, ebx
je 0x43e71e
xor ebp, ebp
mov edi, dword [0x449660]
nop
nop
cmp dword [edi + ebp*8], 0x88822328
je 0x43e6f0
inc ebp
cmp ebx, ebp
jne 0x43e6e0
jmp 0x43e71e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43e71e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x449664]
call fcn.0043c080
add esp, 0x30
cmp eax, 0x103
jne 0x43e7b9
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x43e740
mov eax, dword [esp]
mov ecx, dword [0x44965c]
test ecx, ecx
je 0x43e7b1
xor edx, edx
mov edi, dword [0x449660]
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43e790
inc edx
cmp ecx, edx
jne 0x43e780
jmp 0x43e7b1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43e7b1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x449664]
call fcn.0043c080
add esp, 0x18
test eax, eax
js 0x43e7b9
mov eax, dword [esp + 4]
test esi, esi
je 0x43e7c3
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6abf3283
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x7d655054
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x408913
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.0040892d
xor dword [edi], eax
inc edi
cmp edi, edx
jne fcn.00408913
add esi, 0xcce6dbe0
and ecx, esi
ret
Function at 0x10001cf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
xor eax, eax
push esi
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
push edi
mov ecx, 0x3d69db98
lea eax, [ebp - 0x218]
mov dword [ebp - 0x244], 0
call fcn.1001a5f0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
test eax, eax
sete al
test al, al
je 0x10001da3
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x100269ec
sub edi, 0x7e80af00
lea esi, [ebp - 0x230]
call fcn.1001a670
lea edx, [ebp - 0x108]
push edx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x234], eax
jmp 0x10001dd1
mov ecx, 0x3d69db98
lea eax, [ebp - 0x218]
call fcn.1001a5f0
push eax
call esi
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov word [ebp - 0x210], ax
cmp dword [ebp - 0x234], 0
jne 0x10001e08
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x23c]
mov dword [ebx], edx
mov dword [ebx + 4], eax
pop edi
mov dword [ebx + 8], ecx
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e242
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x238]
push edx
call esi
mov edi, 0x4bddf835
lea esi, [ebp - 0x230]
mov dword [ebp - 0x238], eax
call fcn.1001a6b0
push eax
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x238]
push 0xc
lea ecx, [ebp - 0x244]
mov esi, eax
xor eax, eax
push ecx
push edx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x21c], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [ebx + 8], edx
mov eax, ebx
pop esi
call fcn.1001e242
mov esp, ebp
pop ebp
ret 4

Function at 0x10002ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1002ab60
push 0x1001e889
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1002e018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], 0
push 0xa
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x20]
push ecx
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [edi]
mov dword [esi], edx
mov al, byte [edi + 4]
mov byte [esi + 4], al
add esi, 5
mov byte [esi], 0xe9
mov ecx, edi
sub ecx, esi
mov dword [esi + 1], ecx
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [edi], 0xe9
sub ebx, edi
sub ebx, 5
mov dword [edi + 1], ebx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esi - 5]
jmp 0x10002db9
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [esi + 5]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [esi + 5]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [esi + 5]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
push ebx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea edx, [ebp - 4]
push edx
add ebx, esi
push 0x40
mov eax, edi
sub eax, ebx
push esi
lea ecx, [eax + esi - 5]
push edi
mov byte [ebx], 0xe9
mov dword [ebx + 1], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edi
mov byte [edi], 0xe9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, ebx
sub eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 8]
push esi
push ecx
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push eax
push esi
push edi
call ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10002ed0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002f16
push str.Error:_Unable_to_create_toolhelp_snapshot_
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e242
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10002f04
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x10002f40
mov ecx, edi
lea eax, [ebp - 0x10c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002f68
test dl, dl
je 0x10002f64
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002f68
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002f48
xor eax, eax
jmp 0x10002f6d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002f8f
lea ecx, [ebp - 0x130]
push ecx
push esi
call ebx
test eax, eax
jne 0x10002f40
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e242
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e242
mov esp, ebp
pop ebp
ret