joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov ax, word [esi]
cmp ax, word [ebx]
jae 0x404925
mov ax, 1
jmp 0x4048f5
movzx edx, ax
mov cx, word [esi + edx*2]
xor cx, word [ebx + edx*2]
inc eax
push ecx
pop ecx
mov word [edi + edx*2], cx
cmp ax, word [esi]
jbe 0x4048e3
movzx ecx, word [ebx]
movzx esi, word [esi]
movzx edx, ax
sub ecx, esi
add edx, edx
add ecx, ecx
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.00424b60
mov ax, word [ebx]
add esp, 0xc
mov word [edi], ax
jmp 0x4049ac
mov ax, word [esi]
cmp ax, word [ebx]
jbe 0x404972
mov ax, 1
jmp 0x404945
movzx edx, ax
mov cx, word [esi + edx*2]
xor cx, word [ebx + edx*2]
inc eax
push ecx
pop ecx
mov word [edi + edx*2], cx
cmp ax, word [ebx]
jbe 0x404933
movzx ecx, word [esi]
movzx ebx, word [ebx]
movzx edx, ax
sub ecx, ebx
add edx, edx
add ecx, ecx
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.00424b60
mov ax, word [esi]
add esp, 0xc
mov word [edi], ax
jmp 0x4049ac
mov ax, word [ebx]
test ax, ax
jbe 0x40498d
movzx edx, ax
mov cx, word [esi + edx*2]
xor cx, word [ebx + edx*2]
jne 0x40498d
dec eax
test ax, ax
ja 0x40497a
mov word [edi], ax
test ax, ax
jbe 0x4049ac
movzx edx, ax
dec eax
mov cx, word [esi + edx*2]
xor cx, word [ebx + edx*2]
test ax, ax
push ecx
pop ecx
mov word [edi + edx*2], cx
ja 0x404995
pop edi
pop esi
pop ebx
ret

Function at 0x4049b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
cmp word [eax], 0
je 0x404aa9
mov edx, dword [esp + 8]
cmp word [edx], 0
je 0x404aa9
mov ecx, dword [esp + 8]
movzx eax, word [ecx]
test eax, eax
je 0x404a03
mov edx, dword [esp + 8]
movzx ecx, word [edx + eax*2]
mov edx, dword [0x42b490]
mov cx, word [edx + ecx*2]
mov word [esp + eax*2 + 0x10], cx
dec eax
test eax, eax
jne 0x4049e7
mov eax, dword [esp]
call fcn.004048a8
mov eax, dword [esp + 4]
movzx edx, word [eax]
test edx, edx
je 0x404a86
mov ecx, dword [esp + 4]
movzx eax, word [ecx + edx*2]
mov ecx, dword [0x42b490]
mov ax, word [ecx + eax*2]
mov word [esp + 0xc], ax
cmp ax, 0x7fff
je 0x404a81
mov ecx, dword [esp + 8]
movzx eax, word [ecx]
test eax, eax
je 0x404a81
mov bx, word [esp + eax*2 + 0x10]
cmp bx, 0x7fff
je 0x404a7c
mov cx, word [esp + 0xc]
add cx, bx
cmp cx, 0x7fff
jb 0x404a64
movzx ebx, cx
sub ebx, 0x7fff
jmp 0x404a67
movzx ebx, cx
mov ecx, dword [0x42b48c]
mov esi, dword [esp]
mov cx, word [ecx + ebx*2]
lea ebx, [eax + edx]
xor word [esi + ebx*2 - 2], cx
dec eax
test eax, eax
jne 0x404a3e
dec edx
test edx, edx
jne 0x404a16
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dx, word [eax]
mov eax, dword [esp]
add dx, word [ecx]
add dx, 0xffff
mov word [eax], dx
mov eax, dword [esp]
call fcn.00404050
jmp 0x404ab1
mov edx, dword [esp]
mov word [edx], 0
push 0x26
push 0
lea ecx, [esp + 0x18]
push ecx
call fcn.00424bd0
add esp, 0xc
add esp, 0x38
pop esi
pop ebx
ret
Function at 0x406f98
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x4092e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x432a68
push edi
push ebp
mov ebp, edx
cmp dword [esi + 4], 0
mov edi, ecx
mov ebx, eax
jne 0x409302
call fcn.004092b0
mov eax, ebp
cmp edi, 8
jb 0x40938d
xor ebx, dword [eax]
xor edx, edx
mov dl, bl
sub edi, 8
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
xor ebx, dword [eax + 4]
add eax, 8
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x40930d
xor edx, edx
jmp 0x4093a7
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp edi, edx
ja 0x409391
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4093dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov edx, dword [esp]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
xor edx, dword [eax + 0x100]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
xor edx, dword [eax + 0x104]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ebx, dword [ecx + 8]
mov esi, dword [edx + 0xc]
xor ebx, dword [eax + 0x108]
xor esi, dword [eax + 0x10c]
xor edx, edx
mov ecx, esi
mov edi, esi
shr edi, 0x15
shl ecx, 0xb
or ecx, edi
mov edi, edx
and edi, 3
add ecx, ebx
xor ecx, dword [eax + edi*4 + 0x100]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi]
movzx ebp, byte [eax + ebp]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp]
movzx ecx, byte [eax + ecx]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
mov ecx, ebx
xor edi, dword [esp + 4]
mov dword [esp + 0xc], edi
mov edi, ebx
shr edi, 0xf
shl ecx, 0x11
or ecx, edi
mov edi, edx
and edi, 3
xor ecx, esi
add ecx, dword [eax + edi*4 + 0x100]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi]
movzx ebp, byte [eax + ebp]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp]
movzx ecx, byte [eax + ecx]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
xor edi, dword [esp + 8]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov ecx, edi
mov esi, ecx
mov ebx, dword [esp + 0xc]
inc edx
cmp edx, 0x20
jl 0x40942a
mov edx, dword [esp + 0x10]
xor ebx, dword [eax + 0x100]
mov dword [edx], ebx
xor esi, dword [eax + 0x104]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x108]
mov dword [ecx + 8], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x10c]
mov dword [ecx + 0xc], edx
mov edx, dword [esp]
call fcn.004096e8
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40955c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
xor ecx, dword [ebx + 0x100]
mov dword [esp], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
xor ecx, dword [ebx + 0x104]
mov dword [esp + 4], ecx
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 8]
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x108]
mov edi, dword [eax + 0xc]
xor edi, dword [ebx + 0x10c]
push 0x10
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00424b60
add esp, 0xc
mov edx, 0x1f
mov eax, edi
mov ecx, edi
shr ecx, 0x15
shl eax, 0xb
or eax, ecx
mov ecx, edx
and ecx, 3
add eax, esi
xor eax, dword [ebx + ecx*4 + 0x100]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx]
movzx ebp, byte [ebx + ebp]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp]
movzx eax, byte [ebx + eax]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
mov eax, esi
xor ecx, dword [esp]
mov dword [esp + 8], ecx
mov ecx, esi
shr ecx, 0xf
shl eax, 0x11
or eax, ecx
mov ecx, edx
and ecx, 3
xor eax, edi
add eax, dword [ebx + ecx*4 + 0x100]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx]
movzx ebp, byte [ebx + ebp]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp]
movzx eax, byte [ebx + eax]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
xor ecx, dword [esp + 4]
mov dword [esp], esi
mov dword [esp + 4], edi
mov eax, ecx
mov edi, eax
mov esi, dword [esp + 8]
dec edx
test edx, edx
jge 0x4095b8
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x100]
mov dword [eax], esi
xor edi, dword [ebx + 0x104]
mov edx, dword [esp + 0xc]
mov dword [edx + 4], edi
mov ecx, dword [esp]
mov eax, dword [esp + 0xc]
xor ecx, dword [ebx + 0x108]
mov dword [eax + 8], ecx
mov eax, ebx
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor edx, dword [ebx + 0x10c]
mov dword [ecx + 0xc], edx
lea edx, [esp + 0x10]
call fcn.004096e8
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4096e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x432a68
xor ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x100], esi
movzx esi, byte [edx + ecx + 1]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x104], esi
movzx esi, byte [edx + ecx + 2]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x108], esi
movzx esi, byte [edx + ecx + 3]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x10c], esi
add ecx, 4
cmp ecx, 0x10
jl 0x4096f1
pop esi
pop ebx
ret
Function at 0x40cb58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ecx, dword [eax + 0x18]
cmp ecx, 0x100000
jae 0x40cbb9
mov edx, dword [eax + 0x1a6c]
cmp ecx, edx
jbe 0x40cb8c
mov esi, 0x100000
sub esi, ecx
jmp 0x40cb85
mov ecx, dword [eax]
lea ebx, [ecx + edx]
mov bl, byte [ebx + esi]
mov byte [ecx + edx], bl
inc edx
cmp edx, dword [eax + 0x18]
jb 0x40cb79
jmp 0x40cbb9
xor edx, edx
mov ecx, dword [eax + 0x1a6c]
sub ecx, dword [eax + 0x18]
jmp 0x40cba5
mov esi, dword [eax]
lea ebx, [esi + edx]
mov bl, byte [ebx + ecx]
mov byte [esi + edx], bl
inc edx
cmp edx, dword [eax + 0x18]
jb 0x40cb99
xor edx, edx
mov dword [eax + 0x1a6c], edx
mov byte [eax + 0x1a72], 1
mov ecx, dword [eax + 0x1a6c]
inc ecx
and ecx, dword [eax + 0x1c]
mov dword [eax + 0x1a68], ecx
jmp 0x40ccd1
mov ecx, dword [eax]
mov ebx, dword [eax]
movzx ecx, byte [ecx + edx]
inc edx
and edx, dword [eax + 0x1c]
movzx edx, byte [ebx + edx]
shl edx, 8
mov bl, byte [eax + 0x1a68]
add ecx, edx
mov edx, ecx
mov ecx, dword [eax + 4]
and edx, 0x3fff
mov byte [ecx + edx], bl
mov edx, dword [eax + 0x1a68]
mov esi, dword [eax + 0x1c]
mov ebx, dword [eax]
mov edi, dword [eax]
lea ecx, [edx + 2]
and ecx, esi
movzx ecx, byte [ebx + ecx]
mov ebx, dword [ecx*4 + 0x432a68]
lea ecx, [edx + 1]
and ecx, esi
and edx, esi
shl ebx, 0xa
movzx ecx, byte [edi + ecx]
mov ecx, dword [ecx*4 + 0x432a68]
shl ecx, 4
add ebx, ecx
mov ecx, dword [eax]
movzx edx, byte [ecx + edx]
add ebx, edx
mov ecx, dword [eax + 8]
and ebx, 0x3ffff
mov edx, ebx
mov bx, word [eax + 0x1a68]
mov word [ecx + edx*2], bx
mov ebx, dword [eax + 0x1a68]
mov esi, dword [eax]
mov ecx, ebx
add ecx, 3
and ecx, dword [eax + 0x1c]
movzx ecx, byte [esi + ecx]
mov ecx, dword [ecx*4 + 0x432a68]
shl ecx, 6
add edx, ecx
mov ecx, dword [eax + 0xc]
and edx, 0x3ffff
mov dword [ecx + edx*4], ebx
mov esi, dword [eax + 0x1a68]
mov ebx, dword [eax + 0x1c]
mov ecx, esi
mov edi, dword [eax]
add ecx, 4
and ecx, ebx
movzx ecx, byte [edi + ecx]
shl ecx, 8
add edx, ecx
mov ecx, dword [eax + 0x10]
and edx, 0x3ffff
mov edi, dword [ecx + edx*4]
mov dword [ecx + edx*4], esi
and edi, ebx
mov ecx, dword [eax]
mov ebx, edi
movzx ecx, byte [ecx + ebx]
xor edx, ecx
test dl, 0xf
je 0x40ccb5
xor ebx, ebx
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x1a68]
mov dword [edx + ecx*4], ebx
mov edx, dword [eax + 0x1a68]
inc edx
and edx, dword [eax + 0x1c]
mov dword [eax + 0x1a68], edx
mov edx, dword [eax + 0x1a68]
cmp edx, dword [eax + 0x1a6c]
jne 0x40cbce
pop edi
pop esi
pop ebx
ret
Function at 0x4104d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, 0x42bb94
call fcn.00424fbc
lea eax, [ebx + 0x48]
call fcn.00401f2c
lea eax, [ebx + 0x188]
call fcn.00401f2c
lea eax, [ebx + 0x190]
call fcn.00401f2c
lea eax, [ebx + 0x198]
call fcn.00401f2c
lea eax, [ebx + 0x1a0]
call fcn.00401f2c
lea eax, [ebx + 0x1a8]
call fcn.00401f2c
lea eax, [ebx + 0x1b0]
call fcn.00401f2c
lea eax, [ebx + 0x1b8]
call fcn.00401f2c
xor edx, edx
xor ecx, ecx
mov dword [ebx], edx
mov dword [ebx + 0xc], ecx
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x24], 0
mov byte [ebx + 0x30], 0
mov dword [ebx + 0x44], 0xffffffff
xor edx, edx
lea eax, [ebp - 0x2c]
call fcn.00401f50
mov ecx, dword [eax]
xor edx, edx
mov dword [ebx + 0x48], ecx
mov ecx, dword [eax + 4]
xor eax, eax
mov dword [ebx + 0x4c], ecx
xor ecx, ecx
mov byte [ebx + 0x50], 1
mov byte [ebx + 0x51], 0
mov byte [ebx + 0x52], 0
mov byte [ebx + 0x184], 0
mov byte [ebx + 0x185], 0
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], edx
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x5c], esi
xor eax, eax
xor edx, edx
mov dword [ebx + 0x17c], eax
lea eax, [ebp - 0x34]
call fcn.00401f50
mov ecx, dword [eax]
xor edx, edx
mov dword [ebx + 0x188], ecx
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x3c]
mov dword [ebx + 0x18c], ecx
call fcn.00401f50
mov ecx, dword [eax]
xor edx, edx
mov dword [ebx + 0x190], ecx
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x44]
mov dword [ebx + 0x194], ecx
call fcn.00401f50
mov ecx, dword [eax]
mov dword [ebx + 0x1b8], ecx
mov ecx, dword [eax + 4]
lea eax, [ebx + 0x1b8]
mov dword [ebx + 0x1bc], ecx
lea ecx, [ebx + 0x1b0]
mov edx, dword [eax]
mov dword [ebx + 0x1b0], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1b4], edx
lea edx, [ebx + 0x1a8]
mov eax, dword [ecx]
mov dword [ebx + 0x1a8], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0x1ac], eax
or eax, 0xffffffff
mov ecx, dword [edx]
mov dword [ebx + 0x1a0], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 0x1a4], ecx
mov dword [ebx + 0x1c8], eax
mov dword [ebx + 0x1c4], eax
mov dword [ebx + 0x1c0], eax
mov dword [ebx + 0x180], 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424798
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4258a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4258bf
mov eax, dword [0x42e32c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4258cc
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4258f9
je 0x42590b
sub ecx, 0x100
je 0x425919
sub ecx, 0x100
je 0x425920
sub ecx, 0x100
je 0x425912
jmp 0x425927
sub ecx, 0x600
je 0x425920
sub ecx, 0x100
je 0x42590b
jmp 0x425927
mov edi, 1
jmp 0x42592c
mov edi, 2
jmp 0x42592c
mov edi, 4
jmp 0x42592c
mov edi, 5
jmp 0x42592c
mov edi, 3
test byte [ebp + 0xd], 1
je 0x425953
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x42dda4]
test al, 0x80
je 0x42594c
mov ebx, 0x80
jmp 0x425965
mov ebx, 1
jmp 0x425965
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x425965
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x425977
je 0x425980
dec eax
je 0x425989
jmp 0x425992
mov dword [ebp - 4], 0x80000000
jmp 0x4259a1
mov dword [ebp - 4], 0x40000000
jmp 0x4259a1
mov dword [ebp - 4], 0xc0000000
jmp 0x4259a1
push 1
call fcn.00426aa4
pop ecx
mov ebx, eax
jmp 0x425a8d
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4259bd
sub eax, 0x10
je 0x4259c4
sub eax, 0x10
je 0x4259cd
sub eax, 0x10
je 0x4259d6
jmp 0x4259d6
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4259dd
mov dword [ebp - 8], 1
jmp 0x4259dd
mov dword [ebp - 8], 2
jmp 0x4259dd
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x425a46
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x425a3b
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x425a3b
add ebx, 0xffffffb2
push ebx
call fcn.00426aa4
pop ecx
mov ebx, eax
jmp 0x425a8d
mov edi, esi
push edi
call fcn.00425810
pop ecx
test eax, eax
je 0x425a5a
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x425a66
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004267e8
add esp, 8
mov ebx, eax
inc eax
jne 0x425a8d
push 4
call fcn.00426aa4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427c78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x427cda
call fcn.00427c28
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00424d68
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00424d68
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x427d38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x42eb58], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x427e12
cmp dword [0x42eb54], 0
jne 0x427e12
cmp dword [0x42ed48], 0
je 0x427dcc
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00427bd0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x427db2
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00427bd0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x427db2
lea ebx, [ebp - 0x84]
jmp 0x427db3
inc ebx
call fcn.00427cf4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x427e4d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x42eb5c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00424d68
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x42eb5f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x427e4d
cmp dword [0x42eb54], 0
je 0x427e2c
cmp dword [0x42eb54], 0xffffffff
je 0x427e4d
push esi
call dword [0x42eb54]
pop ecx
mov eax, dword [0x42eb58]
test eax, eax
je 0x427e4d
cmp dword [0x42eb58], 0xffffffff
je 0x427e4d
cmp byte [eax], 0
je 0x427e4d
push esi
push eax
call fcn.00427c78
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x54611c59
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x3adb79c4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5dfb3b38
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x54674bb7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219