joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x4093d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4093d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4093c8
mov eax, 1
add ebx, ebx
jne 0x4093eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4093e0
jne 0x4093fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4093e0
xor ecx, ecx
sub eax, 3
jb 0x409410
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409482
mov ebp, eax
add ebx, ebx
jne 0x40941b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x409428
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40944c
inc ecx
add ebx, ebx
jne 0x409438
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40942d
jne 0x409449
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40942d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40946c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40945d
jmp 0x4093ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40946c
add edi, ecx
jmp 0x4093ce
pop esi
mov edi, esi
mov ecx, 0x12
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40948a
cmp byte [edi], 0
jne 0x40948a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40948f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x4094fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb3ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb404]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4094bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb40c]
or eax, eax
je 0x4094f8
mov dword [ebx], eax
add ebx, 4
jmp 0x4094d9
call dword [esi + 0xb408]
mov ebp, dword [esi + 0xb410]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x409532
sub esp, 0xffffff80
jmp 0x4014a6
Function at 0xa8accc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa8acd6
pushal
call 0xa8acdc
pop ebp
sub ebp, 0x10
sub ebp, 0x68accc
jmp 0xa8acf2
mov eax, 0x68accc
add eax, ebp
add eax, 0x4c
mov ecx, 0x60e
mov edx, 0x5c32eda0
xor byte [eax], dl
inc eax
dec ecx
jne 0xa8ad09
jmp 0xa8ad1c
sub ebp, dword [ebp + 0x2b]
sub dword [eax + 0x6121a0a0], ebx
pop eax
mov al, byte [0x6da3a0a0]
sbb byte [edi + 0x1aa0a0a0], ah
mov byte [eax + 0x4257a0a0], ah
mov dword [0xac212b68], eax
mov al, byte [0x65a3a0a0]
sub eax, 0x295c84c4
movsb byte es:[edi], byte [esi]
test byte [0x295c84c4], ch
movsb byte es:[edi], byte [esi]
test al, cl
pop eax
or eax, 0x74c8a0ae
pop esi
stc
mov al, byte [0xc8848ca1]
out dx, eax
push edi
jg 0xa8adab
movsd dword es:[edi], dword [esi]
mov al, byte [0x9049a0a0]
mov al, byte [0xc42da0a0]
test byte [ecx + ebp - 0x74], bl
test byte [0x2ba084cc], ch
and eax, 0xa0a0a0a8
sub esi, dword [0xa0a0a0ac]
sub ebp, dword [0xa0a0a0b0]
popal
dec ecx
mov byte [0x6223a291], al
movsb byte es:[edi], byte [esi]
jmp 0x5ffcd345
stc
mov al, byte [0x2d848ca1]
les eax, [esp + ebx*2 + 0x4884ac29]
movsd dword es:[edi], dword [esi]
mov al, byte [0xeb49a0a0]
mov byte [0x2bf5a0a0], al
dec esp
pop edi
aad 0xac
pop edi
aad 0xa8
dec eax
fisub word [eax + 0x1d2ba0a0]
test al, 0xa0
mov al, byte [0x2d5121a0]
pop edi
cwde
and dword [ecx], 0x985f2d51
adc dword [ebx + 0x43522169], 0x21392d08
push edx
inc ebx
or byte [0x23729339], ch
dec eax
movsd dword es:[edi], dword [esi]
call 0xa196d2a8
mov al, byte [0xe828afa0]
mov al, byte [0x2bc6a0a0]
mov esp, 0x485b2099
scasd eax, dword es:[edi]
and al, 0xba
mov al, byte [0x5b20a0a0]
dec ecx
scasd eax, dword es:[edi]
and al, 0xb1
mov al, byte [0x21c6a0a0]
pop ebx
pop edi
test dword [edi - 0x5f5f4adc], ebp
mov al, byte [0x5f6c49e1]
pop edi
pop edi
mov esp, ebp
cdq
mov eax, dword [0x23a56123]
dec eax
movsb byte es:[edi], byte [esi]
dec ecx
sbb eax, 0x895f5f5f
hlt

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6f0e1de7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x358f5052
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4010e5
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esp + 4]
ret

Function at 0x4010f8
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
cmp edi, 3
jle 0x40111d
cmp byte [edi + esi - 1], 0x5c
jne 0x40111d
and byte [edi + esi - 1], bl
push 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
dec eax
neg eax
sbb eax, eax
neg eax
test ebx, ebx
je 0x401134
mov byte [edi + esi - 1], 0x5c
pop edi
pop esi
pop ebx
ret

Function at 0x4014d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebx, ebx
lea eax, [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x20
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40153a
push 7
lea eax, [ebp - 0x28]
push str.PKBACK
push eax
call fcn.00401028
add esp, 0xc
test eax, eax
jne 0x40153a
mov al, byte [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmp al, bl
je 0x401536
cmp al, 0x2e
je 0x401536
cmp al, 0x20
je 0x401536
mov al, byte [ecx + 1]
inc ecx
jmp 0x401524
cmp byte [ecx], bl
jne 0x401540
or ax, 0xffff
jmp 0x40156c
mov al, byte [ecx]
cmp al, 0x30
jb 0x40154a
cmp al, 0x39
jbe 0x40154d
inc ecx
jmp 0x401540
xor eax, eax
mov dl, byte [ecx]
cmp dl, bl
je 0x40156c
movzx edx, dl
lea eax, [eax + eax*4]
shl eax, 1
sub edx, 0x30
js 0x40156c
cmp edx, 9
jg 0x40156c
add eax, edx
inc ecx
jmp 0x40154f
pop ebx
leave
ret 4

Function at 0x4016a5
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push 8
xor eax, eax
shl ecx, 1
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
test dl, 1
je 0x4016c5
shr eax, 1
xor eax, 0xedb88320
jmp 0x4016c7
shr eax, 1
dec esi
jne 0x4016b1
pop esi
ret 4

Function at 0x4016ee
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [0x4085c0]
mov edx, ecx
dec ecx
test edx, edx
je 0x401721
push edi
lea edx, [ecx + 1]
mov ecx, dword [esp + 8]
push esi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4081c0]
xor eax, esi
inc ecx
dec edx
jne 0x401707
pop esi
pop edi
mov dword [0x4085c0], eax
ret
Function at 0x401dd8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x5c8]
push eax
call edi
mov ebx, dword [ebp + 0xc]
cmp byte [ebx], 0
je 0x401e1c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x5c8]
push 0x407bd4
push eax
call esi
lea eax, [ebp - 0x5c8]
push ebx
push eax
call esi
cmp dword [ebp + 0x10], 0xffffffff
jne 0x401e36
lea eax, [ebp - 0x5c8]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x401f3d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, dword [ebp + 8]
cmp esi, dword [ebp + 8]
jbe 0x401e51
cmp byte [esi], 0x5c
je 0x401e51
dec esi
jmp 0x401e44
mov al, byte [esi]
cmp al, 0x5c
jne 0x401e6d
mov cl, byte [esi - 1]
cmp cl, 0x3a
je 0x401e6c
cmp cl, al
je 0x401e6c
cmp al, al
jne 0x401e6d
cmp cl, 0x2e
jne 0x401e6d
inc esi
push dword [ebp + 8]
mov bl, byte [esi]
and byte [esi], 0
lea eax, [ebp - 0x2e4]
push eax
call edi
cmp bl, 0x5c
mov byte [esi], bl
jne 0x401e86
inc esi
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x1f
jne 0x401ebf
push dword [ebp + 8]
push 0x2e
call fcn.0040108f
push eax
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
jmp 0x401f23
cmp eax, 0x20
jbe 0x401f05
mov eax, dword [ebp + 0xc]
push 1
push 0
mov cl, byte [eax]
neg cl
sbb ecx, ecx
and ecx, eax
mov eax, dword [0x407b14]
and eax, 0x20000
push ecx
push dword [ebp + 8]
neg eax
sbb eax, eax
and eax, str.Install
push eax
push dword [0x4088a0]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x401f00
mov dword [ecx], eax
cmp eax, 0x20
ja 0x401f3d
push dword [ebp + 8]
push eax
push 0xe
call fcn.0040108f
push eax
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea eax, [ebp - 0x2e4]
push str.WinZip_Self_Extractor
push eax
push dword [0x4088a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f42
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x401f7e
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x105
push eax
lea eax, [ebp - 0x10c]
push eax
push str.winzip_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x401f9d
push 0
push str.WinZip_Self_Extractor
push 0x1b
call fcn.0040108f
push eax
push dword [0x4088a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
leave
ret
mov cl, byte [ebp - 0x10c]
lea eax, [ebp - 0x10c]
test cl, cl
je 0x401fb8
cmp cl, 0x20
je 0x401fb8
mov cl, byte [eax + 1]
inc eax
jmp 0x401fa9
push 0x407e80
inc eax
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x407b14]
mov ecx, 0x1000
mov edx, eax
add esp, 0xc
and edx, ecx
cmp edx, ecx
jne 0x40200e
mov ecx, 0x8000
and eax, ecx
cmp eax, ecx
je 0x40200e
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x10c]
sub ecx, 3
add eax, ecx
dec eax
mov byte [eax], 0x7a
inc eax
mov byte [eax], 0x69
mov byte [eax + 1], 0x70
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push 0x40818c
push eax
call fcn.00401dd8
add esp, 0xc
neg eax
sbb eax, eax
neg eax
leave
ret

Function at 0x402363
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
ret
Function at 0x403910
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov bl, 0x22
cmp byte [eax], bl
je 0x403920
add bl, 0xfe
mov cl, byte [eax + 1]
inc eax
xor edx, edx
cmp cl, dl
je 0x403934
cmp cl, bl
je 0x403934
mov cl, byte [eax + 1]
inc eax
jmp 0x403926
cmp byte [eax], dl
je 0x403939
inc eax
push edx
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403ab1
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x40870e]
test eax, eax
ja 0x403ac4
and dword [0x4086ec], 0
xor eax, eax
ret
push edi
push esi
mov esi, 0x800
cmp eax, esi
ja 0x403ad1
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll__lread]
push esi
push dword [0x4086e8]
push dword [0x408110]
call edi
cmp dword [0x408120], 0
mov ecx, eax
mov dword [0x4086ec], ecx
je 0x403b40
cmp ecx, 0xffffffff
je 0x403b40
cmp ecx, esi
je 0x403b51
test ecx, ecx
jl 0x403b40
mov ax, word [0x407ab0]
push dword [0x408124]
inc ax
push eax
call fcn.0040132a
mov ecx, dword [0x4086ec]
test ecx, ecx
jne 0x403b39
push esi
push dword [0x4086e8]
push dword [0x408110]
call edi
mov ecx, eax
mov dword [0x4086ec], ecx
cmp ecx, 0xffffffff
je 0x403b40
mov esi, ecx
cmp ecx, esi
je 0x403b51
push 2
call fcn.00401c9a
mov ecx, dword [0x4086ec]
sub dword [0x40870e], ecx
mov esi, dword [0x4086e8]
cmp dword [0x408114], 0
mov dword [0x40871c], esi
je 0x403b93
mov eax, ecx
mov edx, eax
dec eax
test edx, edx
je 0x403b93
lea edi, [eax + 1]
call fcn.00405308
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040531e
inc esi
dec edi
pop ecx
jne 0x403b78
mov ecx, dword [0x4086ec]
mov eax, ecx
dec ecx
pop esi
mov dword [0x4086ec], ecx
pop edi
ret

Function at 0x40531e
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x408198]
xor eax, ecx
mov edx, 0xff
and eax, edx
push esi
shr ecx, 8
mov eax, dword [eax*4 + 0x4081c0]
xor eax, ecx
mov ecx, dword [0x4081a0]
mov dword [0x408198], eax
and eax, edx
add eax, dword [0x40819c]
mov esi, ecx
and esi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [0x40819c], eax
shr eax, 0x18
xor esi, eax
shr ecx, 8
mov eax, dword [esi*4 + 0x4081c0]
pop esi
xor eax, ecx
mov dword [0x4081a0], eax
ret

Function at 0x405405
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [0x40811c]
call fcn.00405379
pop ecx
lea eax, [ebp - 0xc]
push 0xc
push dword [ebp + 8]
push eax
call fcn.00401000
add esp, 0xc
xor edi, edi
lea esi, [ebp + edi - 0xc]
call fcn.00405308
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040531e
inc edi
pop ecx
cmp edi, 0xc
jl 0x40542c
cmp dword [0x408118], 0
movzx ax, byte [ebp - 1]
je 0x40545f
xor ecx, ecx
mov cl, byte [0x408707]
jmp 0x405468
mov ecx, dword [0x40870a]
shr ecx, 0x18
cmp ax, cx
je 0x405472
or eax, 0xffffffff
jmp 0x405474
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x405a3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esi
mov dl, al
add esi, dword [edi + eax*4]
ret 4
lea edi, [edi + 1]
nop
mov ch, ch
pop eax
mov edx, edx
cmp byte [edi], 1
mov eax, eax
lea eax, [eax]
ja 0x4059d5
jmp 0x405adf
pop eax
imul eax, eax, 0xf
test esi, edi
lea ebx, [ebx]
and edx, edx
push eax
lea esi, [esi]
movzx eax, byte [edi]
sub dword [esp], eax
jmp 0x40596e
mov edx, ebx
sub cl, ch
mov esi, ebx
jmp 0x405b93
mov ecx, ebp
add esi, dword [edx + 0x20]
pop ecx
xchg edi, edi
lodsd eax, dword [esi]
jmp 0x405bd5
nop
nop
xor eax, 0xe9a414b4
nop
nop
wait
mov edx, edx
wait
sbb eax, dword [esp + 4]
jne 0x405ac0
lea esi, [ebx]
and eax, ebx
dec eax
sbb ah, 0x63
lea edi, [ebx]
jmp 0x405b74
ret
inc eax
nop
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
sahf
push ebx
lea esi, [esi + ecx*2]
not edx
movzx eax, word [esi]
jmp 0x405957
mov eax, ebx
cmp ch, 0x24
sbb edi, 0x2b635afc
add eax, dword [ebx + 0x3c]
nop
add edx, dword [eax + 0x78]
push 0xffffffffffffffff
jmp 0x405ab8
inc ecx
lea edi, [eax + ebx]
nop
cmp ecx, dword [edx + 0x18]
lea ecx, [ecx]
je 0x405b26
push 0
jmp 0x4059d4

Function at 0x405a7b
Capabilities:
Encode data using xor

Disassembly:
call esi
nop
lea edx, [esi + 0x6995fd15]
sbb ch, bl
mov ch, 0x9e
adc ch, 0x13
lea edi, [eax]
lea ecx, [eax + 0x25fdc53c]
mov cl, 0x14
adc edx, 0xea44e1ec
call 0x405a7b
lea ecx, [esp + 0x20]
lea ebx, [ebx]
mov dword [ecx + 0x14], eax
jmp 0x405a94
inc dword [ebp + 0x4ddd]
call esi
cld
and cl, 0x3f
xor eax, edi
je 0x405a7b
jmp 0x405bec
mov dword [ecx + 0x18], edx
lea edx, [edx]
mov ebx, ebx
mov dword [ecx + 0x10], edi
and dword [ebp + 0x4ddd], 0
jmp 0x405a7b
xor edi, eax
lea ecx, [ebx - 0x1a]
rdtsc
mov ecx, edx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x101543bf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10155320
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
xor al, byte [eax]
sbb al, ah
add ah, al
insd dword es:[edi], dx
loope 0x1015442b
add edi, ecx
les ecx, [ecx]
or al, 1
or dh, bl
mov dword [0x105ec001], eax
and eax, dword [edx]
outsb dx, byte [esi]
push ecx
or dword [ecx + eax], edx
lodsb al, byte [esi]
push esi
add dword [ecx + 0x72], ebp
je 0x10154473
popal
insb byte es:[edi], dx
inc ecx
retf
test dword [eax + 0x8758b9f], eax
lea edi, [ebx - 0x46ec39db]
add ebp, dword [ebx]
pop ds
cld
rep movsd dword es:[edi], dword [esi]
mov word [ebx + 0x28501d6d], es
call dword [ebx + 0x61897d15]
jbe 0x10154458
lea esi, [ebx + 0x44bb0835]
inc ecx
lodsd eax, dword [esi]
add dword [ebp + 0x31474c0], eax
ret
or byte [ebx + 0x1ad4144], bh
test eax, eax
je 0x1015446c
add eax, ebx
push 0xffffffffffffffc3
sub byte [ebx + esi*4 + 0x1c], al
enter 0x2950, 0xffffffffffffff80
stosd dword es:[edi], eax
jmp 0x1015444e
ret 0x6204
bound esi, qword [edx + 0x10ff24e7]
dec ebp
nop
adc byte [ebp - 0x70], cl
and al, cl
push eax
inc ebp
inc ebx
xor ch, al
dec ecx
jae 0x1015446e
popal
push eax
arpl word [ebx + 0x140ea264], bx
or eax, 0xc4837bc2
cld
xchg esi, eax
inc eax
and byte [edi], ah
adc dword [eax], eax
mov eax, dword [ebp + 8]
cmp eax, 1
dec eax
je 0x101544d5
add al, 0x40
xchg esp, eax
jne 0x10154513
scasd eax, dword es:[edi]
pop es
or al, 0x81
invalid
pop esi
push ebp
inc byte [edx + ecx + 0x7b39b62e]
add dl, byte [eax + 0x1b831015]
adc bh, byte [eax + 0x50]
sbb eax, 0x6ca10be
or al, 0xc4
mov dword [0x833b09e9], eax
adc eax, dword [0x3e1506f3]
rcl byte [ecx]
ror dl, cl
or al, 0xf4
in al, dx
nop
push eax
movsb byte es:[edi], byte [esi]
sub dh, byte [eax + ebp*8]
xor eax, 0xe41b5ee9
psubb mm6, mm6
adc dword [esi - 0x5ab4d2ad], ecx
movsd dword es:[edi], dword [esi]
adc dword [0x1b403148], ebx
ret
Function at 0x4087f0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448f3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x18], esi
call fcn.00401620
mov ecx, eax
test ecx, ecx
je 0x4089a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push str.V1JlEdXIlzFil9UfE8
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004038c0
test al, al
jne 0x40885c
push 0x13
push str.V1JlEdXIlzFil9UfE8
mov ecx, esi
call fcn.00403de0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004023d0
add esp, 4
push dword [eax]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x14]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40889a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x408970
lea esp, [esp]
lea eax, [ebp - 0x440]
push eax
push dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x18], esi
call fcn.00401620
test eax, eax
je 0x4089a0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi], eax
push str.blhTycksvJIC5L7LyA
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004038c0
test al, al
jne 0x40890b
push 0x13
push str.blhTycksvJIC5L7LyA
mov ecx, esi
call fcn.00403de0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004023d0
add esp, 4
push dword [eax]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x14]
add esp, 0x10
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408946
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x46c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4088c0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40898f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004013f0
int3
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x7abd1a87
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2cf214ce
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10015da0
call fcn.10014f77
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10001e0d
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10001e0d
call fcn.1000143d
mov esi, eax
jmp 0x10001f1d
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10001e30
call fcn.1000143d
jmp 0x10001f10
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10001e26
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10001e63
mov esi, 0x8007000e
jmp 0x10001f12
push 2
push eax
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 2
push eax
call fcn.1000c04c
test eax, eax
js 0x10001f4b
cmp dword [ebp - 0x41c], 0x400
jbe 0x10001eb3
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x418]
call fcn.1000c04c
jmp 0x10001ebf
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10001e59
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10001e26
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.1000c04c
mov esi, eax
test edi, edi
je 0x10001f1d
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10001f36
lea ecx, [ebp - 0x418]
call fcn.10004b7b
lea ecx, [ebp - 0x42c]
call fcn.10004751
mov eax, esi
call fcn.10014ec8
ret 0x10
push eax
call fcn.1000c04c
int3