joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001562
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4cc
mov eax, dword [0x1003008]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x49c], eax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x494], bx
mov ecx, 0x123
lea edi, [ebp - 0x492]
rep stosd dword es:[edi], eax
push 0x247
stosw word es:[edi], ax
lea eax, [ebp - 0x494]
push esi
push eax
mov dword [ebp - 0x4a4], esi
call sub.ntdll.dll_wcsncpy
add esp, 0xc
push 0x248
push dword [ebp - 0x4a0]
lea eax, [ebp - 0x494]
push eax
call fcn.010014e1
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x4020
lea eax, [ebp - 0x4cc]
mov dword [ebp - 0x4bc], eax
push 3
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0x110000
lea eax, [ebp - 0x498]
push eax
mov dword [ebp - 0x4c4], 0x18
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4b8], 0x40
mov dword [ebp - 0x4b4], ebx
mov dword [ebp - 0x4b0], ebx
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jge 0x1001651
xor al, al
jmp 0x1001737
lea eax, [ebp - 0x488]
push esi
push eax
call sub.ntdll.dll_wcscpy
pop ecx
pop ecx
mov edi, 0x144
push edi
push 0x1001124
lea eax, [ebp - 0x488]
push eax
call fcn.010014e1
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 0x494], 1
mov dword [ebp - 0x490], ebx
call sub.ntdll.dll_wcslen
mov esi, dword [sym.imp.ntdll.dll_NtSetInformationFile]
pop ecx
shl eax, 1
mov dword [ebp - 0x48c], eax
push 0xa
add eax, 0x10
push eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x4ac]
push eax
push dword [ebp - 0x498]
call esi
test eax, eax
jl 0x1001729
push dword [ebp - 0x4a4]
lea eax, [ebp - 0x488]
push eax
call sub.ntdll.dll_wcscpy
pop ecx
pop ecx
push edi
push dword [ebp - 0x49c]
lea eax, [ebp - 0x488]
push eax
call fcn.010014e1
lea eax, [ebp - 0x488]
push eax
mov byte [ebp - 0x494], bl
mov dword [ebp - 0x490], ebx
call sub.ntdll.dll_wcslen
pop ecx
shl eax, 1
mov dword [ebp - 0x48c], eax
push 0xa
add eax, 0x10
push eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x4ac]
push eax
push dword [ebp - 0x498]
call esi
test eax, eax
jl 0x1001729
mov bl, 1
push dword [ebp - 0x498]
call dword [sym.imp.ntdll.dll_NtClose]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002355
leave
ret 0xc
Function at 0x100174b
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x1003008]
and word [ebp - 0x28c], 0
mov edx, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0xa1
lea edi, [ebp - 0x28a]
rep stosd dword es:[edi], eax
push 0x143
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x28c]
push eax
call sub.ntdll.dll_wcsncpy
add esp, 0xc
push 0x144
push 0x1001140
lea eax, [ebp - 0x28c]
push eax
call fcn.010014e1
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and dword [ebp - 0x2a8], 0
and dword [ebp - 0x29c], 0
and dword [ebp - 0x298], 0
push 0x4040
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2a4], eax
push 7
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x2ac]
push eax
push 0x10000
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 0x2ac], 0x18
mov dword [ebp - 0x2a0], 0x40
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
pop edi
jl 0x100184c
push 0xd
push 1
lea eax, [ebp - 0x28d]
push eax
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x294]
mov byte [ebp - 0x28d], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push dword [ebp - 0x294]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
call fcn.01002355
leave
ret 4
Function at 0x100185d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x1001178
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
xor ebx, ebx
push 3
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x10019d7
push 0x100115c
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, 0xc0000023
jne 0x10019ce
push edi
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push ebx
push dword [eax + 0x18]
call esi
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x10], edi
je 0x10019cd
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push edi
push 2
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x10019b9
mov eax, dword fs:[0x18]
push dword [edi + 8]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0xc], esi
je 0x10019b9
add edi, 0xc
jmp 0x100197b
push edi
call sub.ntdll.dll_wcslen
inc eax
push edi
push esi
mov dword [ebp - 4], eax
call sub.ntdll.dll_wcscpy
push esi
call sub.ntdll.dll__wcslwr
push dword [ebp + 8]
push esi
call sub.ntdll.dll_wcsstr
add esp, 0x18
test eax, eax
jne 0x1001975
push edi
push esi
call sub.ntdll.dll_wcscpy
mov eax, dword [ebp - 4]
pop ecx
pop ecx
lea esi, [esi + eax*2]
mov eax, dword [ebp - 4]
lea edi, [edi + eax*2]
cmp word [edi], bx
jne 0x100193f
mov word [esi], bx
sub esi, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
inc esi
inc esi
sar esi, 1
shl esi, 1
push esi
push dword [ebp - 0xc]
push 7
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov eax, dword fs:[0x18]
push dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [ebp - 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
pop esi
pop ebx
leave
ret 4
Function at 0x1001b2f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
xor ebx, ebx
mov dword [eax], ebx
cmp dword [esi + 0xc], ebx
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x1001b7f
cmp dword [esi + 4], ebx
jbe 0x1001b6c
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 0xc]
push dword [ecx + ebx*8]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
inc ebx
cmp ebx, dword [esi + 4]
jb 0x1001b50
mov eax, dword fs:[0x18]
push dword [esi + 0xc]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1001fa3
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x1003008]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x498]
push ecx
push 0x248
lea ecx, [ebp - 0x494]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
push eax
jmp 0x10020f9
cmp word [ebp - 0x494], 0x5b
jne 0x10020e0
lea edi, [ebp - 0x492]
mov ax, word [edi]
cmp ax, 0x20
je 0x1001ffa
cmp ax, 9
jne 0x1001ffe
inc edi
inc edi
jmp 0x1001feb
cmp word [edi], 0x5c
jne 0x1002006
inc edi
inc edi
push 0x5d
push edi
call sub.ntdll.dll_wcschr
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x100201b
mov word [eax], bx
jmp 0x1002024
push ebx
push edi
call sub.ntdll.dll_wcschr
pop ecx
pop ecx
add eax, 0xfffffffe
mov cx, word [eax]
cmp cx, 0x20
je 0x1002016
cmp cx, 9
je 0x1002016
mov eax, dword fs:[0x18]
push edi
mov ebx, eax
call sub.ntdll.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebx + 0x30]
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0
push dword [eax + 0x18]
call ebx
test eax, eax
mov dword [ebp - 0x49c], eax
je 0x1002145
push edi
push eax
call sub.ntdll.dll_wcscpy
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
pop ecx
pop ecx
jne 0x10020be
xor edi, edi
cmp eax, edi
je 0x10020a2
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0x30]
lea ecx, [ecx*8 + 0x50]
push ecx
push dword [esi + 0xc]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
jmp 0x10020b3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x50
push edi
push dword [eax + 0x18]
call ebx
cmp eax, edi
je 0x100212c
add dword [esi + 8], 0xa
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 0x49c]
mov dword [ecx + eax*8], edx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 0x498]
mov dword [ecx + eax*8 + 4], edx
inc dword [esi + 4]
lea eax, [ebp - 0x498]
push eax
push 0x248
lea eax, [ebp - 0x494]
push eax
push dword [ebp - 0x498]
call fcn.01001e08
test al, al
jne 0x1001fd7
push 0x1001eaa
push 8
push dword [esi + 4]
push dword [esi + 0xc]
call sub.ntdll.dll_qsort
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002355
leave
ret 4
mov eax, dword fs:[0x18]
push dword [ebp - 0x49c]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
jmp 0x100211d
Function at 0x10062ff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100c028]
jne 0x1006310
test ecx, 0xffff0000
jne 0x1006310
ret
jmp fcn.0100631a

Function at 0x10078d7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x1007914
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x10078f1
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007930
dec esi
je 0x1007929
dec esi
jne 0x1007935
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x401565
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x5e4, 0
sub ebp, 0x8e
lea ebx, [ebp - 0x42]
push ebx
xor eax, eax
push ebx
mov word [ebp - 0x42], ax
call dword [sym.imp.SHLWAPI.DLL_PathAddExtensionW]
lea eax, [ebp - 0x556]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x104
lea ebx, [ebp - 0x34e]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
push 0x104
lea eax, [ebp - 0x146]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ebx, [ebp - 0x556]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
lea eax, [ebp + 0x3e]
push eax
push eax
mov byte [ebp + 0x3e], 0
call dword [sym.imp.SHLWAPI.DLL_PathAddExtensionA]
xor eax, eax
push ebx
mov word [ebp + 0x7e], ax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp + 0x7e]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push 0
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
lea eax, [ebp - 0x146]
push eax
lea ebx, [esi - 3]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, ebx
lea esp, [ebp + 0x8e]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401e31
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
lea edx, [eax - 1]
mov ebx, eax
and edx, dword [0x403050]
mov eax, 0x403054
call fcn.00401db0
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x402da2
push edx
sub edi, fcn.0040254c
push edi
xor eax, eax
push fcn.0040254c
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401ef5
mov eax, fcn.0040254c
mov ebx, esi
mov edx, edi
call fcn.00401db0
mov edx, 0x1c000
mov eax, 0x403054
mov ebx, esi
call fcn.004013ed
jmp 0x401ef5
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x8de1cc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de1d2
pop ebp
sub ebp, 6
sub ebp, 0x4de1cc
jmp 0x8de230
jmp 0x8de239
mov eax, 0x4de1cc
add eax, ebp
add eax, 0x93
mov ecx, 0x61f
mov edx, 0xb6496c16
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de250
jmp 0x8de263
jl 0x8de2bb
jle 0x8de27d
push es
push ss
push ss
jle 0x8de282
fidivr dword [edx]
push ss
xchg edi, eax
out 0xba, al
out 0x2a, eax
adc byte [edi + 0x2ae7bae6], dl
adc byte [0x83e946d6], ah
sub dh, byte [edi]
inc esi
jmp 0x52c50d06
push edx
push ss
inc esi
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1610aedb
scasb al, byte es:[edi]
adc byte [esi], dl
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0x8de295
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0xd97e46d3
and dword [edi], ebx
push ss
jle 0x8de29e
mov edi, 0x3a171652
xor bh, byte [esi + 0x16]
push ss
push ss
push ss
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xa4c008], 0x8088405
inc edx
mov dword [ebx + 0xa4c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0xa3058e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa30595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0xa318f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0xa4e54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0xa4e54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0xa4d378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa318fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x6f78c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x6f78e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x6f78d0
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret

Function at 0x6f78f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x6f7912
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x17]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x6f7900
mov byte [esi + 6], 0
mov eax, esi
pop esi
ret