joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b8e4
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, edi
add cl, al
call 0x3c16ec06
xor edx, edx
cmp edx, dword [eax + eax]
xor edx, edx
cmp edx, dword [eax + eax]
jne 0x44b8ef
cmp eax, dword [esp]
jecxz 0x44b8f1
je 0x44b914
lea edx, [ebp - 0xc]
mov eax, dword [0x30]
call 0x564c9c80
add byte [ebp - 0xc], cl
mov dl, 1
mov eax, dword [0xb3a4]
call fcn.004aadd8
sbb al, byte [eax]
mov byte [0x75ff0007], al
cld
push dword [ebp - 4]
inc dword [eax]
add byte [ebx - 0x2e8173a], cl
xor byte [eax], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], eax
add byte [esi - 0x72ffbf97], ch
lodsd eax, dword [esi]
add al, ch
loop 0x44b8dd
pop es
add bl, al
jmp 0x4bb93c
xchg ecx, eax
clc
in eax, 0x8f
je 0x4bb995
in eax, 0x86
invalid
ljmp 0xf69e:0x117efa15
cli
jle 0x4bb971
sahf
idiv byte [ecx - 0x8d330b0]
invalid
jno 0x4bb95b
out dx, al
inc edx
pushfd
xchg ebp, eax
sal dword [ebp - 0x220d1be2], cl
push esi
xchg edi, eax
adc dword [ecx - 0x13], eax
in eax, 0xb1
sub byte [ebx - 0x52ae8c13], ch
mov bh, 0x46
push es
movsd dword es:[edi], dword [esi]
and dword [ebp - 0xc5c3048], 0x5baa01c9
daa
push esp
or al, 0x52
leave
add dword [edx + 0xc54275b], ebp
push edx
dec ecx
cmp eax, dword [edi]
nop
mov ah, 0xea
inc edx
jg 0x4bb95d
retf 0x6382

Function at 0x459718
Capabilities:
Encode data using xor

Disassembly:
mov dword [0xf214b93e], eax
xor al, 0xc
push ss
js 0x459774
invalid
cmp byte [esi + 0x46], 0x41
std
adc eax, 0xed146949
pop ebx
lodsd eax, dword [esi]
push ecx
in al, 0x1a
or esi, dword [ecx]
nop
in eax, 0x25
aaa
and dword [ecx - 0x5b], edx
movsd dword es:[edi], dword [esi]
push 0x21
push ebx
out dx, al
cmp eax, 0x88310582
dec ebp
dec edi
push ebp
push ebp
or dword [edx + 0x7f], ebp
test ebx, ebx
aaa
push 0xffffffffffffffc8
stosd dword es:[edi], eax
push edi
imul ebx, eax, 0x2610531
push esi
pop ds
mul ch
or esp, ebp
or ecx, dword [0x2aaf5a5b]
out dx, eax
imul dx, word [ecx], 0xffa5
inc edi
fidiv word [ebx]
outsb dx, byte [esi]
rcr ecx, cl
mov cl, 0xa
xchg dword [eax - 0x2b9dd023], esi
cmp esp, dword [ebx]
js 0x45975c
add al, 0x86
push eax
mov ebx, 0x44d9671e
adc dl, ah
add ebp, dword [ecx - 0x20]
sub byte [edx - 0x21b9514e], dl
inc ebp
pop ss
adc dl, bl
xchg edi, eax
invalid

Function at 0x462f54
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, edi
add cl, al
call 0x3c186276
xor edx, edx
cmp edx, dword [eax + eax]
xor edx, edx
cmp edx, dword [eax + eax]
jne 0x462f5f
cmp eax, dword [esp]
jecxz 0x462f61
je 0x462f84
lea edx, [ebp - 0xc]
mov eax, dword [0x30]
call 0x564e12f0
add byte [ebp - 0xc], cl
mov dl, 1
mov eax, dword [0xb3a4]
call fcn.004c2448
sbb al, byte [eax]
mov byte [0x75ff0007], al
cld
push dword [ebp - 4]
inc dword [eax]
add byte [ebx - 0x2e8173a], cl
xor byte [eax], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], eax
add byte [esi - 0x72ffbf97], ch
lodsd eax, dword [esi]
add al, ch
loop 0x462f4d
pop es
add bl, al
jmp 0x4d2fac
Function at 0x47a964
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, edi
add cl, al
call 0x3c19dc86
xor edx, edx
cmp edx, dword [eax + eax]
xor edx, edx
cmp edx, dword [eax + eax]
jne 0x47a96f
cmp eax, dword [esp]
jecxz 0x47a971
je 0x47a994
lea edx, [ebp - 0xc]
mov eax, dword [0x30]
call 0x564f8d00
add byte [ebp - 0xc], cl
mov dl, 1
mov eax, dword [0xb3a4]
call 0x4d9e58
sbb al, byte [eax]
mov byte [0x75ff0007], al
cld
push dword [ebp - 4]
inc dword [eax]
add byte [ebx - 0x2e8173a], cl
xor byte [eax], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], eax
add byte [esi - 0x72ffbf97], ch
lodsd eax, dword [esi]
add al, ch
loop 0x47a95d
pop es
add bl, al
jmp 0x4ea9bc

Function at 0x493044
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, edi
add cl, al
call 0x3c1b6366
xor edx, edx
cmp edx, dword [eax + eax]
xor edx, edx
cmp edx, dword [eax + eax]
jne 0x49304f
cmp eax, dword [esp]
jecxz 0x493051
je 0x493074
lea edx, [ebp - 0xc]
mov eax, dword [0x30]
call 0x565113e0
add byte [ebp - 0xc], cl
mov dl, 1
mov eax, dword [0xb3a4]
call 0x4f2538
sbb al, byte [eax]
mov byte [0x75ff0007], al
cld
push dword [ebp - 4]
inc dword [eax]
add byte [ebx - 0x2e8173a], cl
xor byte [eax], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], eax
add byte [esi - 0x72ffbf97], ch
lodsd eax, dword [esi]
add al, ch
loop 0x49303d
pop es
add bl, al
jmp 0x50309c

Function at 0x4aab04
Capabilities:
Encode data using xor

Disassembly:
push eax
mov eax, edi
add cl, al
call 0x3c1cde26
xor edx, edx
cmp edx, dword [eax + eax]
xor edx, edx
cmp edx, dword [eax + eax]
jne 0x4aab0f
cmp eax, dword [esp]
jecxz 0x4aab11
je 0x4aab34
lea edx, [ebp - 0xc]
mov eax, dword [0x30]
call 0x56528ea0
add byte [ebp - 0xc], cl
mov dl, 1
mov eax, dword [0xb3a4]
call fcn.00509ff8
sbb al, byte [eax]
mov byte [0x75ff0007], al
cld
push dword [ebp - 4]
inc dword [eax]
add byte [ebx - 0x2e8173a], cl
xor byte [eax], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], eax
add byte [esi - 0x72ffbf97], ch
lodsd eax, dword [esi]
add al, ch
loop 0x4aaafd
pop es
add bl, al
jmp 0x51ab5c
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0xf96058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f961a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf9607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf9606a
add dl, dl
jne 0xf96089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf960dc
xor eax, eax
add dl, dl
jne 0xf96096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf9617d
add dl, dl
jne 0xf960a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf960b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf960bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf960c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf960d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf96075
mov eax, 1
add dl, dl
jne 0xf960ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf960f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf960e1
sub eax, ebx
mov ebx, 1
jne 0xf96128
mov ecx, 1
add dl, dl
jne 0xf9610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf96119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf96105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf96075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf9613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf9614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf96136
cmp eax, 0x7d00
jae 0xf9616d
cmp eax, 0x500
jb 0xf96168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf96075
cmp eax, 0x7f
ja 0xf96170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf96075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf9619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf96075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x700345d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x700346c
pop dword [ebp - 0x40]
mov eax, 0x700346c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x692fe3e4
add dword [ebp - 0x50], 0xe5226167
mov dword [ebp - 0x4c], 0x40f47b0b
add dword [ebp - 0x4c], 0xf13ed13a
mov dword [ebp - 0x48], 0x51fae8c9
add dword [ebp - 0x48], 0xfa515b65
mov dword [ebp - 0x44], 0x41a4045f
sub dword [ebp - 0x44], 0x41a4045f
lea eax, [ebp - 0x50]
push eax
mov eax, 0xcfcf17b3
add eax, 0x3732287d
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf7b99116
add dword [ebp - 0x50], 0x7cb8d840
mov dword [ebp - 0x4c], 0x3271930a
add dword [ebp - 0x4c], 0xeface6b
mov dword [ebp - 0x48], 0x3dac7cc5
sub dword [ebp - 0x48], 0xda3d1059
mov dword [ebp - 0x44], 0x84f45495
add dword [ebp - 0x44], 0x7b0bab6b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3b743
push 0
call eax
mov ecx, 0xb4e43ddf
add ecx, 0x4b1c0ea9
mov esi, eax
mov edi, 0x7021400
add edi, dword [ebp - 0x40]
mov edx, 0x193cdc89
mov dword [ebp - 4], 0xc1749c03
mov ebx, dword [edi]
add ebx, edx
xor dword [ebp - 0x1c], 0x35f091ac
mov dword [esi], ebx
add dword [ebp - 0x28], 0x462c1879
add esi, 0xa994f855
add esi, 0x566b07af
add edi, 4
loop 0x7003578
add eax, 0x124f3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf886a83a
add ecx, 0xe7957c6
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x700dc1f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7012b4c
call fcn.07001ce0
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700de1f
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700e7aa
lea ecx, [ebp - 0x10]
call fcn.0700dbbc
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700dc8c
mov eax, dword [eax + 0x14]
jmp 0x700dc91
mov eax, 0x70148c2
push 0x7016240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700dcbf
mov ecx, edi
call fcn.07007930
lea ecx, [ebp - 0x10]
call fcn.0700345d
mov eax, edi
call fcn.07001e84
ret 4
push str.file_does_not_exist
push ebx
call fcn.0700345d
int3
Function at 0x700e880
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700e8e4
cmp byte [esi + 0x10], 0
je 0x700e8a2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [esi + 0xc]
pop ecx
mov byte [esi + 0x10], 0
push edi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700e8d2
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
test eax, eax
je 0x700e8eb
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700e8e6
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.0700345d
int3

Function at 0x700eb50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700eba3
cmp dword [esi + 0xc], 0
je 0x700eb9e
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700eb91
push str.stream_write_error
jmp 0x700eba8
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.0700345d
int3
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp int.00401219

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.00401537
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x4019de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, esi
add ebx, 0xc8
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, edi
shl eax, cl
cdq
idiv ebx
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x401a7c
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
jmp 0x401a17
add dword [ebp - 0xc], ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10], eax
jl 0x401a11
mov ecx, dword [ebp - 8]
cmp eax, ecx
jne 0x401a30
mov eax, dword [ebp + 0xc]
add eax, esi
mov ebx, eax
sub ebx, dword [ebp - 0xc]
or ebx, ebx
je 0x401a8d
and dword [ebp - 0x14], 0
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x18], eax
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
or edx, esi
add edx, eax
push edx
mov edx, dword [ebp - 0x18]
xor edx, esi
add edx, eax
push edx
call fcn.00401970
add esp, 0x20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x7e8
jl 0x401a38
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edx, esi
dec edx
and eax, edx
cmp dword [ebp - 4], eax
jle 0x401a07
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
cmp dword [0xc26160], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jne 0x401074
push 0
lea ecx, [ebp - 0x42c]
push ecx
push 0
push str.serogefikajuxapowizufin_jikesijelipovocanopowum_ladahuki_nogiwodopuxeyojimada_masitobimalezal
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push str.wabux
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x806f3c]
mov edx, dword [0x806f38]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], edx
call fcn.00401020
mov esi, dword [ebp - 0x10]
mov ecx, dword [str.STh5]
mov edx, dword [0x806f44]
add esi, 0x23f
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], edx
mov ebx, 0x20
jmp 0x4010c3
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0xc26160]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40112b
push 0
lea eax, [ebp - 0x42c]
push eax
push str.patarofo_lugagodagurusol_bahecekolotegejahub
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ebp - 0x24]
push ecx
push 0
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0xc26160]
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x401145
mov dword [0xc256fc], 0xedeb2e40
jmp 0x401157
cmp ecx, 0x3eb
jne 0x401157
mov dword [0xc250b0], 0
mov ecx, dword [ebp - 0xc]
lea edx, [esi + edi]
mov dword [ebp - 0x14], edx
mov edx, edi
shr edx, cl
mov dword [0xc256f8], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0xc26160], 0xc
jne 0x4011a8
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
mov ecx, dword [ebp - 8]
shl ecx, 4
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
mov ecx, dword [ebp - 4]
add esi, edx
add eax, dword [ebp - 0x20]
xor eax, esi
xor ecx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ecx
sub edi, ecx
call fcn.00401010
sub ebx, 1
jne 0x4010c0
cmp dword [0xc26160], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x401203
push ebx
push str.puloginuyekawayihuyufomeciyijuw
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
pop edi
mov dword [esi + 4], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4