joyce8/EMBER2024-capa huggingface dataset:
Function at 0x207dd4
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.002070fb
je 0x207ea6
mov esi, dword [ebp + esi - 0x6c]
call fcn.002070e8
je 0x207ea6
cmp edx, ecx
jb 0x207ea6
push edx
push edi
call fcn.00207aeb
pop edi
pop edx
mov ebx, eax
test ebx, ebx
je 0x207ea6
push edx
mov dword [ebp - 0x60], edx
mov eax, ecx
mul ebx
mov ebx, ecx
pop ecx
sub ecx, eax
push edi
push dword [ebp - 0x60]
call fcn.0020708c
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop edx
pop edi
jb 0x207eb1
mov dword [ebp - 0x64], edi
mov ecx, ebx
push ebx
push esi
push edi
call fcn.00207b14
pop eax
pop esi
pop ebx
jae 0x207e54
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x60]
sub edx, eax
jmp 0x207e7a
push esi
push edi
mov esi, eax
mov ecx, edi
sub ecx, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
add edi, ebx
sub edx, ebx
cmp edx, ebx
jae 0x207e3b
mov eax, edi
mov ecx, edx
mov esi, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x68]
call fcn.00208e3e
call fcn.00207884
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
jmp 0x207eab
call fcn.00208e3e
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
call fcn.00208e3e
call fcn.00208e3e
call fcn.0020898c
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.002037d5

Function at 0x2081b1
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x2081d1
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.002070e8
call fcn.0020708c
jb 0x2081f6
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.002037e0

Function at 0x2083fa
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.002038bc
jb 0x208437
push esi
push edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x208432
mov edx, dword [esp + 0xc]
mov edx, dword [edx + 4]
mov ecx, dword [esp + 0x14]
jecxz 0x208422
jmp 0x208432
mov ecx, dword [edx + eax]
mov ecx, dword [ecx]
mov dword [edx + eax], ecx
jecxz 0x208432
push ecx
mov ecx, dword [ecx]
call dword [ecx + 4]
pop edi
pop esi
ret 0xc
pop edx
pop ecx
pop ecx
pop ecx
push edx
jmp fcn.002037e0
Function at 0x208441
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call fcn.002038f5
jb 0x208437
test dword [esp + 8], 0xffffffff
je 0x20847b
test dword [esp + 0xc], 0xffffffff
jne 0x20847b
mov edx, dword [esp + 4]
mov edx, dword [edx + 4]
xor ecx, ecx
xchg dword [edx + 0x18], ecx
jecxz 0x20847b
mov ecx, dword [edx + ecx]
jecxz 0x20847b
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
ret 0xc

Function at 0x208828
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xe
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x208855
je 0x208851
shr esi, 1
jae 0x208876
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.002070c0
jmp 0x208834
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x208887
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00203d99
pop ebx
jae 0x208834
pop esi
pop edx
pop eax
jmp fcn.002037e0
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x208834
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x208834
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x208834

Function at 0x2088f7
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x208917
and esi, 0xfffffffe
jne 0x208921
xchg dword [ebx], esi
call fcn.002070c0
pop edi
pop esi
ret
call fcn.002070e8
mov edi, dword [ebx]
or edi, edi
je 0x208931
cmp ecx, dword [edi - 4]
je 0x208951
call fcn.0020708c
jb 0x208961
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.002070c0
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.002070c0
pop edi
pop esi
jmp fcn.002037e0

Function at 0x208da0
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.002070e8
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.002070e8
jecxz 0x208e16
test ebx, ebx
je 0x208e1e
add ebx, ecx
xchg ecx, ebx
call fcn.0020708c
jb 0x208e2b
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.002070c0
mov esi, dword [ebp + edi - 0x6c]
call fcn.002070c0
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.002037e0
Function at 0x209230
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov eax, ecx
call fcn.002079c9
mov ebx, eax
test edi, 0x10
je 0x20924d
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00207810
jecxz 0x2092cc
and edi, 0xfff9fffb
or edi, 0x40004
cld
mov ax, 0x2e
push edi
mov edi, esi
repne scasw ax, word es:[edi]
pop edi
jne 0x209284
and edi, 0xfff9fffb
or edi, 0x20000
mov edx, dword [0x20f5fc]
test edi, 0x40004
jne 0x20929b
xor edx, edx
call fcn.0020931a
je 0x209300
push edi
push edx
push esi
mov edx, dword [sym.imp.WINMM.DLL_PlaySoundW]
call fcn.00208e58
jae 0x2092af
test eax, eax
je 0x2092ea
test ebx, ebx
jne 0x2092b5
jmp 0x2092dc
test eax, eax
jne 0x2092dc
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, ebx
call fcn.00207a2d
jne 0x209284
jmp 0x2092dc
push 0
push 0
push 0
call sub.WINMM.DLL_PlaySoundW
mov eax, 1
call fcn.00208e3e
pop edi
pop esi
ret
test edi, 0x20000
jne 0x209307
and edi, 0xfffbfffb
or edi, 0x20000
jmp 0x209284
mov edx, 0x35
jmp 0x20930c
mov edx, 5
call fcn.00208e3e
pop edi
pop esi
xor eax, eax
jmp fcn.002037d5

Function at 0x209c60
Capabilities:
Terminate process

Disassembly:
call fcn.0020e64b
call fcn.002038bc
mov dword [eax + 0x30], 0
jecxz 0x209c93
cmp dword [ecx + 0xf4], 0x1a
jne 0x209c82
or edx, 0x200
and dword [ecx + 0xc], 0xfffffdff
xor dword [ecx + 0xc], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x30], edx
ret
mov al, 5
jmp fcn.002037e0
Function at 0x20b161
Capabilities:
Terminate process

Disassembly:
push esi
push edi
call fcn.00209a9f
jb 0x20b2e5
mov esi, ecx
test eax, eax
jne 0x20b179
mov eax, 1
mov edx, eax
call fcn.002076de
jb 0x20b2e5
mov edi, eax
mov ebx, section..data
test dword [ebx + 0x11c], 0xffffffff
je 0x20b25e
test dword [edi + 0x10], 0xffffffff
jne 0x20b1eb
fild dword [ebx + 0x15c]
mov eax, dword [ebx + 0x17c]
add eax, dword [ebx + 0x180]
push eax
fidiv dword [esp]
pop eax
fldcw word [0x20350e]
frndint
fidivr dword [esi + 0xa8]
frndint
fldcw word [0x203508]
fistp dword [edi + 0x30]
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.GDI32.DLL_CreateFontIndirectW]
test eax, eax
je 0x20b2ed
mov dword [edi + 0x10], eax
and dword [esi + 0xc], 0xfbffffff
mov ecx, dword [edi + 0x38]
or ecx, dword [edi + 0x3c]
je 0x20b201
or dword [esi + 0xc], 0x4000000
mov ebx, dword [edi + 8]
xchg dword [esi + 0x1c], ebx
push dword [edi + 0x10]
push dword [esi + 0x3c]
call dword [sym.imp.GDI32.DLL_SelectObject]
test eax, eax
je 0x20b2ed
cmp eax, 0xffffffff
je 0x20b2ed
inc dword [edi + 4]
mov edx, ebx
call fcn.002076de
jb 0x20b2ed
dec dword [eax + 4]
xchg edi, esi
call fcn.0020b2fb
mov eax, dword [esi + 0x30]
sub eax, dword [edi + 0xd8]
sub eax, dword [edi + 0xdc]
js 0x20b2dd
add dword [edi + 0xdc], eax
jmp 0x20b2dd
test dword [edi + 0xc], 0xffffffff
jne 0x20b296
push 0x5a
push dword [esi + 0x3c]
call dword [sym.imp.GDI32.DLL_GetDeviceCaps]
push eax
fild dword [esp]
pop eax
fmul dword [edi + 0x28]
push 0x48
fidiv dword [esp]
pop eax
fchs
fistp dword [edi + 0x30]
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.GDI32.DLL_CreateFontIndirectW]
test eax, eax
je 0x20b2ed
mov dword [edi + 0xc], eax
and dword [esi + 0xc], 0xfbffffff
mov ecx, dword [edi + 0x38]
or ecx, dword [edi + 0x3c]
je 0x20b2ac
or dword [esi + 0xc], 0x4000000
mov ebx, dword [edi + 8]
xchg dword [esi + 0x1c], ebx
push dword [edi + 0xc]
push dword [esi + 0x3c]
call dword [sym.imp.GDI32.DLL_SelectObject]
test eax, eax
je 0x20b2ed
cmp eax, 0xffffffff
je 0x20b2ed
inc dword [edi + 4]
mov edx, ebx
call fcn.002076de
jb 0x20b2ed
dec dword [eax + 4]
mov edi, esi
call fcn.0020b2fb
call fcn.00209556
pop edi
pop esi
ret
call fcn.00209556
pop edi
pop esi
ret
call fcn.00209556
pop edi
pop esi
xor eax, eax
jmp 0x2037c2
Function at 0x20e6b2
Capabilities:
Terminate process

Disassembly:
mov edx, 5
jmp fcn.002037d5
push esi
push edi
mov edi, dword [ebp - 0x88]
mov edi, dword [ebp + edi - 0x6c]
call fcn.00207823
push ebp
mov ebp, esp
cmp edx, 0x1f
jb 0x20e6d0
mov edx, 0x1f
push edx
push edi
xor eax, eax
mov ecx, 0x33
push eax
loop 0x20e6d9
cld
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
lea edi, [ebp - 0x88]
rep movsw word es:[edi], word [esi]
mov eax, dword [ebp + 0x14]
mov byte [ebp - 0x89], al
mov eax, dword [ebp + 0x18]
mov byte [ebp - 0x8d], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x20e719
mov eax, 0x41000000
mov dword [ebp + 0x20], eax
mov dword [ebp - 0x94], 0x190
mov edx, dword [ebp + 0x1c]
test edx, 1
je 0x20e73b
mov dword [ebp - 0x94], 0x2bc
test edx, 2
je 0x20e74a
mov byte [ebp - 0x90], 1
test edx, 4
je 0x20e759
mov byte [ebp - 0x8f], 1
test edx, 8
je 0x20e768
mov byte [ebp - 0x8e], 1
test edx, 0x10
je 0x20e778
fld dword [ebp + 0x20]
fchs
fstp dword [ebp + 0x20]
mov dword [ebp - 0xb0], 0x2000
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], 0
lea edx, [ebp - 0xd4]
call fcn.0020770f
jae 0x20e7d0
call fcn.00207683
jb 0x20e7e0
mov edi, eax
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x24], 0x2000
mov dword [edi + 0x28], edx
mov dword [edi + 0x2c], 0
cld
mov ecx, 0x27
lea esi, [ebp - 0xa4]
lea edi, [edi + 0x30]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
call fcn.00208e3e
pop edi
pop esi
ret 0x14
mov esp, ebp
pop ebp
call fcn.00208e3e
pop edi
pop esi
pop eax
add esp, 0x14
push eax
xor eax, eax
jmp 0x2037c2
Function at 0x405e1b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x40a350
push edi
xor bl, bl
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov esi, eax
test esi, esi
jne 0x405e35
mov esi, edi
movzx eax, word [esi]
cmp eax, 0x5c
je 0x405e47
cmp eax, 0x2f
je 0x405e47
test ax, ax
jne 0x405e73
mov ebp, eax
xor eax, eax
push edi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405e67
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x405e69
test al, 0x10
je 0x405e7a
test bp, bp
je 0x405e78
mov word [esi], bp
add esi, 2
jmp 0x405e35
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret

Function at 0x410c7d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and cl, 0x79
pop esi
mov eax, dword [esp]
add esp, 8
jmp eax
ret
push dword [edx + 0x36]
lea esi, [edx - 6]
lea eax, [0xb76aa659]
add dword [esp], ebx
inc edi
not ah
pop ecx
adc al, ch
add edx, dword [ecx + 0x78]
add esi, dword [edx + 0x1a]
test al, 0xaf
pop ecx
add ch, 0
lodsd eax, dword [esi]
mov dl, dl
xchg edi, edi
test edi, eax
add ecx, 1
wait
lea edi, [eax + ebx + 4]
cmp dword [edx + 0x12], ecx
je 0x410a51
xor eax, eax
imul eax, eax, 0xf
push eax
movzx eax, byte [edi - 4]
cmp dh, 0x9e
neg eax
add dword [esp], eax
lea edi, [edi - 0xe]
sub edi, 0xfffffff1
pop eax
cmp byte [edi - 4], 0xa
ja 0x410bba
and ah, 0xff
cld
mov eax, 0x55a43208
cld
xor dword [esp - 4], eax
mov eax, dword [esp + 4]
sub dword [esp - 4], eax
jmp 0x410bf2
jne 0x410ba0
wait
cld
wait
nop
add edx, 0x1b
push dword [edx - 5]
pop edi
add edi, ebx
add ecx, ecx
add ecx, ebx
mov esi, dword [edx + 3]
mov ax, word [ecx + esi]
xchg dl, dl
xchg edx, ecx
not dl
cwde
push dword [edi + eax*4]
add dword [esp], ebx
jmp 0x410974
push 0xffffffffffffffff
lea edx, [ebx + 6]
jmp 0x410b7f

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6a
nop
nop
sub eax, 0x403d10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x5af7c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x152000]
push edi
jmp 0x5af7da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5af7e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5af7d0
mov eax, 1
add ebx, ebx
jne 0x5af7f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5af804
jne 0x5af823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5af823
dec eax
add ebx, ebx
jne 0x5af810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5af7e8
add ebx, ebx
jne 0x5af81f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5af875
xor ecx, ecx
sub eax, 3
jb 0x5af83b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5af8aa
sar eax, 1
mov ebp, eax
jmp 0x5af846
add ebx, ebx
jne 0x5af846
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5af814
inc ecx
add ebx, ebx
jne 0x5af854
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5af814
add ebx, ebx
jne 0x5af861
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5af856
jne 0x5af872
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5af856
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5af894
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5af886
jmp 0x5af7d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5af894
add edi, ecx
jmp 0x5af7d6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5af8b2
cmp byte [edi], 0x11
jne 0x5af8b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5af8b7
lea edi, [esi + 0x1a8000]
mov eax, dword [edi]
or eax, eax
je 0x5af92f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x279b04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x279c80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5af8e4
mov ecx, edi
jns 0x5af913
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x279c84]
or eax, eax
je 0x5af929
mov dword [ebx], eax
add ebx, 4
jmp 0x5af901
call dword [esi + 0x279c94]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5af960
cmp al, 0xef
ja 0x5af953
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5af935
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5af942
mov ebp, dword [esi + 0x279c88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5af994
sub esp, 0xffffff80
jmp 0x420577
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x4105bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43189c], 0
push esi
jne 0x4105f3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4105cd
mov dword [ecx*4 + 0x431898], eax
inc ecx
cmp ecx, 0x100
jl 0x4105c8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x410624
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431898]
xor eax, esi
inc ecx
dec edx
jne 0x410606
pop edi
not eax
pop esi
ret 0xc
Function at 0xf110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0xf11b9
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0xf1160
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0xf11a8
mov esi, dword [ebp - 4]
jns 0xf1187
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0xf1197
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0xf1169
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0xf1140
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xf11d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, edx
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0x18], ebx
push ebx
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0xf1024]
lea eax, [ebx - 1]
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0xf1254
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
sub edi, esi
lea ecx, [edi + eax]
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov al, byte [edx + esi]
mov esi, dword [ebp - 4]
mov byte [esi], al
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0xffffcfc7
mov byte [edx + esi], cl
imul edx, eax, 0xeeb9eb65
mov eax, dword [ebp - 4]
and edx, 0x7fffffff
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
dec ebx
jne 0xf1214
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf253b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2e20], 1
mov ecx, 0x8397
jne 0xf25c2
or dword [0x1b2e20], 1
lea eax, [ecx + 0x1b]
mov edx, eax
add eax, 0x19
mov word [0x1ac9d4], ax
mov word [0x1ac9c8], dx
add edx, 0x11
lea eax, [ecx + 0x5c]
mov word [0x1ac9d6], ax
add eax, 0xffffffef
mov word [0x1ac9d8], ax
mov word [0x1ac9ca], dx
lea edx, [ecx + 0x3b]
lea eax, [ecx + 0x63]
mov word [0x1ac9da], ax
mov word [0x1ac9cc], dx
add edx, 8
add eax, 0xffffffed
mov word [0x1ac9dc], ax
lea eax, [ecx + 0x31]
mov word [0x1ac9de], ax
mov eax, ecx
mov word [0x1ac9ce], dx
mov dword [0x1ac9d0], 0x83b283c7
mov word [0x1ac9e0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1ac9c8]
add eax, 2
mov word [eax + 0x1ad072], dx
cmp eax, 0x1a
jb 0xf25c4
mov eax, 0x1ad074
ret

Function at 0xf25e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2e18], 1
jne 0xf2610
or dword [0x1b2e18], 1
mov dword [0x1ac9f0], 0xf3f8faab
mov dword [0x1ac9f4], 0xa8f2fbe2
mov dword [0x1ac9f8], 0x97a9a8a8
xor eax, eax
mov cl, byte [eax + 0x1ac9f0]
xor cl, 0x97
mov byte [eax + 0x1ad09c], cl
inc eax
cmp eax, 0xc
jb 0xf2612
mov eax, 0x1ad09c
ret

Function at 0xf262d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2e14], 1
mov edx, 0x8397
jne 0xf26ed
push esi
lea ecx, [edx + 0x1e]
mov eax, ecx
mov word [0x1ac9fc], ax
add eax, 2
or dword [0x1b2e14], 1
mov word [0x1ac9fe], ax
lea eax, [edx + 0x23]
mov esi, eax
mov word [0x1aca00], si
mov word [0x1aca02], ax
add eax, 0x3a
mov word [0x1aca04], ax
lea eax, [edx + 0x4e]
mov esi, eax
mov word [0x1aca06], si
add esi, 0x11
mov word [0x1aca08], si
lea esi, [edx + 0x4d]
mov word [0x1aca0a], si
add esi, 0x1b
mov word [0x1aca0c], si
lea esi, [edx + 0x31]
mov word [0x1aca0e], si
mov esi, eax
mov word [0x1aca10], si
add esi, 0xd
add eax, 0xfffffffe
mov word [0x1aca12], si
lea esi, [edx + 0x50]
mov word [0x1aca1a], ax
mov eax, edx
mov word [0x1aca14], si
mov dword [0x1aca16], 0x83e583f8
mov dword [0x1aca1c], 0x83b583aa
mov word [0x1aca20], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x1ac9fc]
add eax, 2
mov word [eax + 0x1ad0a6], cx
cmp eax, 0x26
jb 0xf26ef
mov eax, 0x1ad0a8
ret