joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c382
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46c3ba
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046a439
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046a411
jmp 0x46c3c6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46da73
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46dab5
call fcn.004737ed
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46dab5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46daac
xor eax, eax
jmp 0x46dabd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046dac3
pop edi
pop esi
pop ebx
ret 4

Function at 0x473d1d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x473d4b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x473d69
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00473c83
jmp 0x473d69
mov eax, dword [esi + 0x14]
test eax, eax
je 0x473d69
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00473c83
test edi, edi
mov eax, edi
jne 0x473d53
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100019a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10035be8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10036658]
cmp eax, dword [ecx + 4]
jle 0x100019f8
push 0x10036658
call fcn.1000a31f
add esp, 4
cmp dword [0x10036658], 0xffffffff
jne 0x100019f8
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x10036658
mov dword [0x10036654], eax
call fcn.1000a2e0
add esp, 4
mov edx, dword [0x10036654]
push esi
lea esi, [edx + 0x1000]
cmp edx, esi
je 0x10001a23
nop dword [eax]
lea ecx, [edx + 0x1c]
call fcn.10001990
test eax, eax
je 0x10001a27
add edx, 0x20
cmp edx, esi
jne 0x10001a10
xor eax, eax
pop esi
ret
mov eax, edx
pop esi
ret

Function at 0x10001a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
cmp byte [edi], 0xe9
jne 0x10001a51
lea ecx, [edi + 5]
add ecx, dword [edi + 1]
call fcn.10001a30
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.100019a0
mov ebx, eax
xor esi, esi
mov dword [ebp - 4], ebx
nop
lea ecx, [esi + edi]
call fcn.10001750
add esi, eax
cmp esi, 5
jl 0x10001a60
test esi, esi
jle 0x10001a91
mov ecx, ebx
mov edx, esi
mov ebx, edi
sub ebx, ecx
nop dword [eax + eax]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001a80
mov ebx, dword [ebp - 4]
lea ecx, [esi + ebx]
lea eax, [edi - 5]
mov byte [ecx], 0xe9
sub esi, ecx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
mov eax, dword [ebp - 0xc]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100020b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [eax + 0x40]
mov edx, eax
and edx, 7
mov cl, byte [edx + ebx]
mov byte [eax + edi], cl
inc eax
sub esi, 1
jne 0x100020c0
mov ebx, 0x100
mov edx, esi
and edx, 0x3f
movzx eax, byte [edx + edi]
movzx eax, byte [eax + 0x10031118]
movzx ecx, byte [eax + 0x10031118]
movzx eax, byte [esi + 0x10031218]
inc esi
movzx eax, byte [eax + 0x10031218]
xor ecx, eax
mov al, byte [ecx + 0x10031218]
mov byte [edx + edi], al
sub ebx, 1
jne 0x100020d6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10003040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x10003059
jmp 0x1000306b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x100030b0
call fcn.10003040
cmp dword [ebp - 4], 0x103
jne 0x100030c1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100030d0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c94
call fcn.1000b330
mov eax, dword [0x10034070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x2c90], ecx
jmp 0x10003102
jmp 0x10003114
lea eax, [ebp - 0x2c8c]
mov dword [ebp - 0x2c8c], 0x2880
push eax
lea eax, [ebp - 0x2c88]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x10003149
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1ad
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x2af4], 0
lea eax, [ebp - 0x2c88]
jne 0x10003198
nop dword [eax + eax]
cmp byte [eax + 0x195], 0
jne 0x10003198
cmp byte [eax + 0x196], 0
jne 0x10003198
cmp byte [eax + 0x197], 0
jne 0x10003198
cmp byte [eax + 0x198], 0
jne 0x10003198
cmp byte [eax + 0x199], 0
jne 0x10003198
mov eax, dword [eax]
cmp byte [eax + 0x194], 0
je 0x10003160
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x408]
push 0x3e8
push eax
call fcn.10002120
add esp, 0x24
lea eax, [ebp - 0x408]
push 0x3e8
push eax
push 0x3e8
push dword [ebp - 0x2c90]
push 0
call fcn.10011a3c
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.1000a1ad
mov esp, ebp
pop ebp
ret
Function at 0x10005fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100245e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10034070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100061c4
cmp byte [ebx + 0x3d], 0
je 0x100061c4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10006039
xor al, al
jmp 0x100061c6
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10005c20
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100060aa
sub eax, 1
je 0x100060ae
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x10006176
xor bl, bl
jmp 0x10006178
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x100060e6
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.1001140d
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x100060a3
cmp byte [ebx + 0x3d], 0
je 0x10006176
test esi, esi
jne 0x10006064
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
sub ecx, edi
cmp ecx, 8
jbe 0x1000616c
lea esi, [edi + 8]
cmp esi, 0xfffffffe
ja 0x1000616c
cmp edx, esi
jae 0x10006154
push edi
push esi
lea ecx, [ebp - 0x28]
call fcn.10001ec0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
test esi, esi
je 0x10006064
cmp edx, 0x10
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
cmovae ecx, eax
mov eax, dword [ebp - 0x18]
movq qword [ecx + eax], xmm0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x28]
mov byte [eax + esi], 0
jmp 0x1000605e
test esi, esi
jne 0x10006129
cmp edx, 0x10
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x28]
cmovae ecx, eax
mov byte [ecx], 0
jmp 0x1000605e
push str.string_too_long
call fcn.100073bc
mov bl, 1
cmp edx, 0x10
jb 0x100061c0
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x100061b7
test byte [ebp - 0x28], 0x1f
je 0x10006193
call fcn.1000f671
mov ecx, dword [eax - 4]
cmp ecx, eax
jb 0x1000619f
call fcn.1000f671
sub eax, ecx
cmp eax, 4
jae 0x100061ab
call fcn.1000f671
cmp eax, 0x23
jbe 0x100061b5
call fcn.1000f671
mov eax, ecx
push eax
call fcn.1000a1f1
add esp, 4
mov al, bl
jmp 0x100061c6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a1ad
mov esp, ebp
pop ebp
ret
Function at 0x10006820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100244b6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10034070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000a1be
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100076c7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007210
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [ebp + 0xc], edi
jbe 0x10007274
push ebx
push esi
movzx esi, byte [ecx + 1]
movzx eax, byte [ecx]
movzx edx, byte [esi + ecx + 2]
add edx, eax
movzx eax, dl
mov bl, byte [eax + ecx + 2]
mov byte [ecx], bl
mov dl, byte [esi + ecx + 2]
movzx eax, bl
movzx eax, byte [eax + ecx + 2]
movzx eax, byte [eax + ecx + 2]
inc eax
movzx eax, al
mov dh, byte [eax + ecx + 2]
movzx eax, bl
mov al, byte [eax + ecx + 2]
mov byte [esi + ecx + 2], al
movzx eax, byte [ecx]
mov byte [eax + ecx + 2], dl
mov eax, dword [ebp - 4]
inc byte [ecx + 1]
xor byte [eax + edi], dh
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x10007221
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10007ea9
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x10024860
call fcn.1000ab23
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10007fc6
cmp byte [ebx + 0x3e], 0
je 0x10007fc6
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.1000aac3
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x10007ef5
xor al, al
jmp 0x10007fc8
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.10005c20
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x10007f25
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.1000aac3
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x10007f5a
sub eax, 1
je 0x10007f5e
dec eax
sub eax, 1
je 0x10007fb4
xor bl, bl
jmp 0x10007fb6
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x10007f6e
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x10007f96
cmp eax, 0x10
jae 0x10007f7d
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1001140d
add esp, 0x10
cmp esi, eax
jne 0x10007f56
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x10007fb4
test esi, esi
jne 0x10007f19
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10005cf0
jmp 0x10007f13
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10001b60
mov al, bl
jmp 0x10007fc8
mov al, 1
call fcn.1000aade
ret
Function at 0x1000879c
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x100248dd
call fcn.1000ab23
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x100087c1
xor eax, eax
jmp 0x1000893a
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x100087ed
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x100087ed
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x1000893a
cmp dword [esi + 0x4c], 0
je 0x10008937
mov ecx, esi
call fcn.100081a1
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x10008820
push dword [esi + 0x4c]
push edi
call fcn.10007910
pop ecx
pop ecx
test al, al
je 0x10008937
movzx ebx, di
jmp 0x10008937
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.10005c20
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x10008858
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.1000aac3
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x1000892b
cmp eax, 1
jg 0x10008906
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x100088a1
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x100088ce
cmp eax, 0x10
jae 0x100088b0
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.1001140d
add esp, 0x10
cmp edi, eax
jne 0x10008901
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x100088d1
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x100088fb
test edi, edi
jne 0x1000884c
cmp dword [ebp - 0x18], 0x20
jae 0x10008925
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.10005cf0
jmp 0x10008846
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x10008925
cmp eax, 3
jne 0x1000892b
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.10007910
pop ecx
pop ecx
test al, al
je 0x10008925
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10001b60
mov ax, bx
call fcn.1000aade
ret 4

Function at 0x10019718
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100193db

Function at 0x10019723
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001955c
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3bd77b58
nop
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x730c2025
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40228b
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x402400
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, str._1d_:_DSuygac
push 0x6f
pop ebx
push ebx
push ebp
call fcn.00404087
xor byte [esi + edi], 0xba
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xb
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x9c
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xe3
push ebx
push ebp
call fcn.00404087
xor byte [esi + edi], 0x2c
push ebx
push ebp
call fcn.00404087
xor byte [esi + edi], 0xd2
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xa7
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xf6
add esp, 0x40
push ebx
push ebp
call fcn.00404087
xor byte [esi + edi], 0x82
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xa4
push ebx
push ebp
call fcn.00404087
sub byte [esi + edi], 0x80
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xd2
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x26
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x84
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xef
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x11
add esp, 0x40
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x9b
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xa7
push ebx
push ebp
call fcn.00404087
xor byte [esi + edi], 0x28
push ebx
push ebp
call fcn.00404087
xor byte [esi + edi], 0x76
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xcc
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x2a
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x8b
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xe9
add esp, 0x40
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xd0
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x1c
push ebx
push ebp
call fcn.00404087
xor byte [esi + edi], 0xa2
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0xe2
push ebx
push ebp
call fcn.00404087
add byte [esi + edi], 0x33
add esp, 0x28
inc esi
cmp esi, dword [esp + 0x18]
jb 0x4022a7
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x4025dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x45e014]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402654
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.0040164b
test esi, esi
je 0x402641
cmp dword [esp + 0x38], 3
jbe 0x402641
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004026cf
pop ecx
pop ecx
test eax, eax
je 0x402641
cmp eax, dword [esp + 0x38]
je 0x40266c
lea ecx, [esp + 0x14]
add edi, 4
call fcn.0040213d
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x40260d
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040601d
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.0040213d
jmp 0x402656

Function at 0x4026cf
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, dword [esp + 0x1c]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x4026f4
mov esi, dword [esi]
mov dword [esp + 0x18], esi
shr edi, 2
test edi, edi
je 0x402755
mov ebp, esi
mov esi, edi
push str.GYAUs87atedyuw3
push 0x45efb0
call fcn.00401150
push eax
call fcn.00401551
push 4
lea eax, [esp + 0x2c]
push ebp
push eax
call fcn.00406df0
imul ecx, dword [esp + 0x34], 0x5bd1e991
add esp, 0x18
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x1c], eax
sub esi, 1
jne 0x4026ff
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x40277e
sub eax, 1
je 0x402774
sub eax, 1
jne 0x40278c
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop ecx
ret