joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103b6c3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push esi
push edi
mov edi, ecx
xor edx, edx
mov dx, word [edi + 0xe]
xor eax, eax
mov ax, word [edi + 0x10]
mov dword [ebp - 4], 0x20
movzx ecx, ax
sub dword [ebp - 4], eax
mov esi, edx
and esi, dword [ebp + 8]
shr dword [ebp + 8], cl
xor dword [ebp - 8], esi
cmp word [ebp - 4], 0
jg 0x103b6e8
movzx eax, word [ebp - 8]
mov ecx, dword [edi + 8]
lea eax, [eax + eax*2]
lea esi, [ecx + eax*4]
cmp dword [esi + 8], 0
jne 0x103b72e
movzx eax, word [edi + 0x12]
shl eax, 2
push eax
call fcn.01013c3c
test eax, eax
mov dword [esi + 8], eax
je 0x103b74b
and dword [esi], 0
movzx eax, word [edi + 0x12]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp dword [esi], eax
jne 0x103b759
movzx ecx, word [edi + 0x12]
add ecx, eax
shl ecx, 2
push ecx
push dword [esi + 8]
call fcn.01013e3c
test eax, eax
jne 0x103b74f
xor al, al
jmp 0x103b777
mov dword [esi + 8], eax
movzx eax, word [edi + 0x12]
add dword [esi + 4], eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + eax*4], edx
mov eax, dword [esi + 8]
inc dword [esi]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
leave
ret 0x10

Function at 0x103b782
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push esi
mov eax, ecx
xor esi, esi
mov si, word [eax + 0xe]
xor edx, edx
mov dx, word [eax + 0x10]
push edi
mov dword [ebp - 4], 0x20
movzx ecx, dx
sub dword [ebp - 4], edx
mov edi, esi
and edi, dword [ebp + 8]
shr dword [ebp + 8], cl
xor dword [ebp - 8], edi
cmp word [ebp - 4], 0
jg 0x103b7a7
movzx ecx, word [ebp - 8]
mov eax, dword [eax + 8]
lea ecx, [ecx + ecx*2]
lea eax, [eax + ecx*4]
mov ecx, dword [eax]
cmp ecx, 1
pop edi
pop esi
jb 0x103b7d5
dec ecx
mov dword [eax], ecx
leave
ret 8
Function at 0x104b581
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push 0xb
pop edx
xor eax, eax
push esi
movzx esi, byte [ecx]
shl eax, 2
xor eax, esi
inc ecx
dec edx
jne 0x104b58f
mov ecx, dword [ebp + 8]
push 2
pop edx
movzx esi, byte [ecx]
shl eax, 2
xor eax, esi
inc ecx
dec edx
jne 0x104b5a1
pop esi
pop ebp
ret 4
Function at 0x4081c2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
xor esi, esi
push edi
push esi
push 1
push 0x30317038
xor edi, edi
mov dword [ebp - 0xc], esi
call fcn.0040ac4a
add esp, 0xc
cmp dword [0x41009c], esi
je 0x4083b3
cmp dword [0x4108d4], esi
je 0x4083b3
cmp dword [0x410858], esi
je 0x4083b3
cmp byte [0x4108e0], 0
jne 0x4083b3
push 0x410838
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x410858]
mov ecx, 0x21f
test byte [eax], 1
je 0x408230
inc edi
add eax, 0xe
dec ecx
jne 0x40822a
mov eax, 0x4105fc
add edi, dword [eax]
add eax, 0xc
cmp eax, 0x410614
jb 0x40823b
push ebx
mov ebx, edi
imul ebx, ebx, 0xe
mov dword [ebp - 0x14], edi
lea eax, [ebx + 0x68]
push eax
mov dword [ebp - 0x18], eax
call fcn.004075af
cmp eax, esi
pop ecx
mov dword [ebp - 0x10], eax
je 0x40837a
lea ecx, [eax + 0x68]
mov dword [ebp - 4], ecx
xor ecx, ecx
mov edx, dword [0x410858]
test byte [ecx + edx], 1
lea esi, [ecx + edx]
je 0x40828e
mov edi, dword [ebp - 4]
add dword [ebp - 4], 0xe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x14]
add ecx, 0xe
cmp ecx, 0x1db2
jb 0x408270
mov ecx, 0x4105f8
mov edx, dword [ecx + 4]
test edx, edx
jle 0x4082c4
and dword [ebp - 8], 0
mov esi, dword [ecx]
mov edi, dword [ebp - 4]
add esi, dword [ebp - 8]
add dword [ebp - 4], 0xe
add dword [ebp - 8], 0xe
dec edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x4082a9
mov edi, dword [ebp - 0x14]
add ecx, 0xc
cmp ecx, 0x410610
jb 0x40829e
push 0x1a
mov dword [0x4108ac], edi
pop ecx
mov esi, 0x410860
mov edi, eax
mov dword [0x4108a8], ebx
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax + 0x68]
push ecx
push eax
call fcn.00408b46
mov edi, dword [ebp - 0x10]
push 1
xor esi, esi
pop ebx
mov dword [edi + 0x50], eax
cmp dword [0x4108d0], esi
lea eax, [ebp - 0x22c]
mov word [ebp - 0x22c], si
push eax
je 0x40831b
jmp section..htext
call fcn.00408635
cmp ebx, esi
je 0x408371
push esi
push 2
push 2
push esi
push 1
lea eax, [ebp - 0x22c]
push 0xc0000000
push eax
call fcn.00408f0e
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408371
lea eax, [ebp - 0x10]
push esi
push eax
push dword [ebp - 0x18]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408367
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0x10], eax
je 0x40836a
mov dword [ebp - 0xc], esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.004075bc
pop ecx
xor esi, esi
push 0x410838
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc], esi
pop ebx
jne 0x4083b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push 1
push 0x4000000
push 0x30316f79
mov dword [ebp - 0x24], 3
call fcn.0040ac4a
add esp, 0x10
pop edi
pop esi
leave
ret
Function at 0x4022e0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x144
mov ecx, 0x41
xor eax, eax
push ebp
push esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x154]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
je 0x4023bf
dec eax
je 0x402371
dec eax
jne 0x402421
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x23
push 0
call fcn.004038d0
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
call edi
cmp byte [esp + eax + 0xb], 0x5c
je 0x402347
mov byte [esp + eax + 0xc], 0x5c
mov byte [esp + eax + 0xd], 0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402421
mov eax, dword [esp + 0x158]
mov byte [eax], 0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x144
ret
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0xc]
push edx
call edi
cmp byte [esp + eax + 0xb], 0x5c
je 0x402399
mov byte [esp + eax + 0xc], 0x5c
mov byte [esp + eax + 0xd], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402421
mov ecx, dword [esp + 0x158]
pop edi
pop esi
xor eax, eax
mov byte [ecx], 0
pop ebp
add esp, 0x144
ret
lea edx, [esp + 0xc]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0xc]
push eax
call edi
cmp byte [esp + eax + 0xb], 0x5c
je 0x4023e3
mov byte [esp + eax + 0xc], 0x5c
inc eax
lea esi, [esp + eax + 0xc]
push str.Temp
push esi
call ebp
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402415
mov edx, dword [esp + 0x158]
pop edi
pop esi
xor eax, eax
mov byte [edx], 0
pop ebp
add esp, 0x144
ret
push 0x409368
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.2402220047327336203234920
call edi
dec eax
cmp eax, 8
jl 0x402365
mov al, byte [eax + str.2402220047327336203234920]
cmp al, 0x30
jl 0x402365
cmp al, 0x39
jg 0x402365
movsx esi, al
sub esi, 0x30
and esi, 0x80000003
jns 0x40245b
dec esi
or esi, 0xfffffffc
inc esi
push str.2402220047327336203234920
add esi, 4
call edi
sub eax, esi
dec eax
xor ecx, ecx
lea edx, [eax + str.2402220047327336203234920]
mov al, byte [edx]
test al, al
je 0x40248d
test esi, esi
jle 0x40248d
add al, al
inc al
dec esi
mov byte [esp + ecx + 0x110], al
inc edx
inc ecx
cmp ecx, 0x40
jb 0x402470
lea eax, [esp + ecx + 0x111]
push 0x409364
push eax
mov byte [esp + ecx + 0x118], 0x2e
call ebp
lea ecx, [esp + 0xc]
push ecx
call edi
mov edx, 0x104
lea ecx, [esp + 0xc]
sub edx, eax
lea eax, [esp + 0x110]
push edx
push eax
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [esp + eax + 0x14]
push edx
call esi
mov ecx, dword [esp + 0x158]
lea eax, [esp + 0xc]
push 0x103
push eax
push ecx
call esi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x144
ret
Function at 0x402530
Capabilities:
Rebuild import table

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x88
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x40b9a4], eax
je 0x402785
mov ecx, 0x22
xor eax, eax
lea edi, [esp + 0x10]
push 0x30
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push str.2402220047327336203234920
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [0x40b9a4]
mov edx, dword [0x40ba14]
mov eax, dword [0x40ba18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Load
push ecx
mov dword [esp + 0x48], 0x40ba1c
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], fcn.00404530
mov dword [esp + 0x58], fcn.00404740
mov dword [esp + 0x5c], fcn.00404840
mov dword [esp + 0x60], fcn.00404870
mov dword [esp + 0x64], fcn.00403f00
mov dword [esp + 0x68], fcn.00403ff0
mov dword [esp + 0x6c], fcn.00404070
mov dword [esp + 0x70], fcn.00404080
mov dword [esp + 0x74], fcn.004040a0
mov dword [esp + 0x78], fcn.00404200
mov dword [esp + 0x7c], fcn.00404260
mov dword [esp + 0x80], fcn.004042f0
mov dword [esp + 0x84], 0x404390
mov dword [esp + 0x88], 0x4043f0
mov dword [esp + 0x8c], fcn.00404420
mov dword [esp + 0x90], fcn.00404490
mov dword [esp + 0x94], fcn.00401280
mov dword [esp + 0x98], fcn.004021c0
mov dword [esp + 0x9c], fcn.00402fc0
call esi
mov edx, dword [0x40b9a4]
push 0x409384
push edx
mov ebp, eax
call esi
mov edi, eax
mov eax, dword [0x40b9a4]
push str.Stop
push eax
call esi
mov ecx, dword [0x40b9a4]
push str.Unload
push ecx
mov ebx, eax
call esi
mov esi, eax
mov al, byte [0x409080]
cmp al, 0xb9
jne 0x40269e
push 0x50
push 0x409080
push 0x409080
call fcn.00403ae0
add esp, 0xc
test ebp, ebp
jne 0x4026b9
mov edx, dword [esp + 0xa4]
push edx
push str.Load
push 0x409080
jmp 0x402759
test edi, edi
jne 0x4026d4
mov edx, dword [esp + 0xa4]
push edx
push 0x409384
push 0x409080
jmp 0x402759
test ebx, ebx
jne 0x4026ec
mov edx, dword [esp + 0xa4]
push edx
push str.Stop
push 0x409080
jmp 0x402759
test esi, esi
jne 0x402704
mov edx, dword [esp + 0xa4]
push edx
push str.Unload
push 0x409080
jmp 0x402759
lea edx, [esp + 0x10]
push edx
push 0x88
call ebp
test eax, eax
je 0x40272a
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
push eax
push ecx
call edi
call esi
jmp 0x40276e
cmp byte [0x4090d0], 0xb9
jne 0x402747
push 0x6c
push 0x4090d0
push 0x4090d0
call fcn.00403ae0
add esp, 0xc
mov edx, dword [esp + 0xa4]
push edx
push str.Load
push 0x4090d0
mov eax, dword [esp + 0xa8]
push 0x83
push eax
call fcn.00404840
add esp, 0x14
mov ecx, dword [0x40b9a4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x40b9a4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
Function at 0x404330
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40436f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40436f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40436f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40436f
cmp dword [ecx + 0x74], 0xe
jbe 0x40436f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407aa9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0041a640
mov eax, dword [0x423940]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0040c9ea
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x407aeb
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x407c47
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041a590
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x427c30]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00410042
mov ecx, dword [esi*4 + 0x427c30]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x407c40
cmp eax, dword [ecx + edi + 0x24]
jne 0x407c40
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407c40
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00410042
add esp, 0x14
test edx, edx
jl 0x407c40
jg 0x407bb6
test eax, eax
jb 0x407c40
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x407c40
jl 0x407bd0
cmp dword [ebp - 0x1008], eax
ja 0x407c40
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x407bee
test ebx, ebx
je 0x407c27
cmp ecx, edi
jae 0x407c27
mov al, byte [ecx]
cmp al, 0xd
jne 0x407c08
lea eax, [edi - 1]
cmp ecx, eax
jae 0x407c14
cmp byte [ecx + 1], 0xa
jne 0x407c14
inc ecx
jmp 0x407c14
movzx eax, al
movsx eax, byte [eax + 0x423b88]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x407bee
cmp edx, ebx
jne 0x407bee
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x407c45
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404665
leave
ret

Function at 0x40dda5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c620
push 0x41c618
push str.FlsAlloc
push 0x1f
call fcn.0040dc64
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ddd9
push dword [ebp + 8]
mov ecx, esi
call dword [0x41b120]
call esi
jmp 0x40dddf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x4100be
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x427c30]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4100fe
cmp byte [ebx], 0xa
jne 0x4100fe
or byte [edi + eax + 0x28], 4
jmp 0x410103
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x410202
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4101e5
inc eax
cmp dl, 0xd
je 0x41012f
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x410155
cmp eax, ecx
jae 0x410163
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x410117
jmp 0x410202
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4101e0
cmp dword [ebp - 0x10], 0
je 0x4101e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x427c30]
test byte [eax + edi + 0x28], 0x48
je 0x4101ba
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4101a5
mov byte [esi], dl
jmp 0x4101b6
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x427c30]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x410202
cmp byte [ebp - 1], 0xa
jne 0x4101c9
cmp esi, ebx
jne 0x4101c9
mov byte [esi], 0xa
jmp 0x410201
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00410060
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x410202
mov byte [esi], 0xd
jmp 0x410201
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x427c30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4101ff
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x410202
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41020b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x427c30]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x410251
cmp word [ebx], dx
jne 0x410251
or byte [eax + edi + 0x28], 4
jmp 0x410256
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4103b9
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x410399
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x410297
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4102cd
cmp eax, edx
jae 0x4102db
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x410272
jmp 0x4103b9
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410394
cmp dword [ebp - 0x18], 0
je 0x410394
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x427c30]
test byte [eax + edi + 0x28], 0x48
je 0x41036a
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41032e
mov word [esi], cx
jmp 0x410365
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x427c30]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x427c30]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x427c30]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4103b9
pop eax
cmp word [ebp - 4], ax
jne 0x41037a
cmp esi, ebx
jne 0x41037a
mov word [esi], ax
jmp 0x4103b6
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00410060
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4103b9
push 0xd
pop eax
jmp 0x410375
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x427c30]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4103b3
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4103b9
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x7e6e4d29
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7eac3e16
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407601
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x407610
pop dword [ebp - 0xc]
mov eax, 0x407610
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x36340
push 0
mov eax, 0xacda2037
sub eax, 0xac993f5f
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xd0655b69
add ecx, 0x2f9ae040
xor esi, esi
add esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0xc]
mov edx, 0xac2918e7
sub edx, 0x6ffd1ebd
xor dword [ebp - 8], ecx
mov ebx, dword [edi]
add dword [ebp - 4], 0x46d96f67
sub ebx, edx
mov dword [ebp - 8], 0x515daa79
mov dword [esi], ebx
xor dword [ebp - 8], 0x5d33de7b
add esi, 0xdaa6b634
sub esi, 0xdaa6b630
add edi, 0xc9ac3ffd
sub edi, 0xc9ac3ff9
loop 0x407666
add eax, 0x44926c83
add eax, 0xbb6e74f4
xor ebx, ebx
add ebx, eax
add eax, 0xd542c3cf
sub eax, 0xd542c3ca
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x402174
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
invalid

Function at 0x402551
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte es:[ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004015f3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004015a8
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004015e3
inc edx
retf

Function at 0x402e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsd dword es:[edi], dword [esi]
mov ebp, 0xfffff8
mov byte [ebp - 0x742], 2
and byte [ebp - 0x741], 0
mov byte [ebp - 0x740], 0xb1
mov byte [ebp - 0x73f], 0x92
mov byte [ebp - 0x73e], 0x9c
mov byte [ebp - 0x73d], 0x99
mov byte [ebp - 0x73c], 0xb1
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.004015f3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004015a8
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.004015e3
or byte [ebp - 0x3b], cl
pop ecx
lea eax, [ebp - 0x6f4]
push eax
call fcn.004015f3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004015a8
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
invalid
inc dword [eax]