joyce8/EMBER2024-capa huggingface dataset:
Function at 0xff118c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xff1196
pushal
call 0xff119c
pop ebp
sub ebp, 0x10
sub ebp, 0xbf118c
jmp 0xff11b2
mov eax, 0xbf118c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0x43ad247e
xor byte [eax], dl
inc eax
dec ecx
jne 0xff11c9
jmp 0xff11dc
cmc
mov bl, 0xf5
test dword [edx + 0x7e], 0xbfff7e7e
xchg byte [esi + 0x7e], bh
jle 0xff1268
mov bl, 0xc6
jnp 0xff126d
jle 0xff126f
les edx, [esi + 0x7e]
jle 0xff1274
mov dword [ebp + edi*2 + 0x72fff5b6], ebx
jle 0xff127d
jle 0xff127e
mov ebx, 0x825a1af3
idiv dword [edx + 0x5a]
sbb bl, byte [edx - 0x7e]
idiv dword [edx + 0x5a]
push ss
xchg esi, eax
xchg dword [esi + 0x7e], ebx
push ss
fisubr dword [ecx - 0x20]
jle 0xff129a
push edx
pop edx
push ss
jmp 0xff1287
imul esp, eax, 0x5a527f7e
pop edx
das
xchg esi, eax
jnp 0xff12f0
jle 0xff12f2
xchg edi, eax
daa
jl 0xff12f6
jle 0xff126d
sbb bl, byte [edx - 0x7e]
not dword [edx + 0x5a]
push edx
pop edx
adc bl, byte [edx + 0x7e]
or dword [ebx], 0x760b8172
or esi, dword [edx - 0x7f]
or esi, dword [esi - 0x6a]
or dword [ebx], 0x7efa9676
jle 0xff130d
xchg esi, eax
cli
jle 0xff130c
jle 0xff1285
cmc
ret
cwde
dec dword [edi - 0x67e0b223]
dec ebp
mov bh, 0xff
invalid
invalid
xchg esi, eax
jp 0xff128a
xchg edi, eax
ret
adc dword [edi + 0x2a], 0xbffd7c47
js 0xff12fc
mov edi, 0x7a94fd78
std
xchg esp, eax
jp 0xff12ff
xchg esi, eax
jnp 0xff129c
aad 0x81
add dword [ecx - 0xca5ad0b], 0xbc7a5a1a
jb 0xff1391
sbb bl, byte [edx + 0x7a]
sbb bl, byte [edx + 0x7a]
mov esp, 0xf52b7e72
sub esi, ebp
xchg edx, eax
sub byte [ecx], ch
sub esi, ebp
or esi, dword [edx - 0xb]
add esi, dword [esi - 0x7e]
int3
mov esi, 0xfb71ac7c
lodsb al, byte [esi]
jno 0xff138f
jnp 0xff1414
jle 0xff1416
hlt
lodsb al, byte [esi]
insd dword es:[edi], dx
mov bh, 0x7c
lodsb al, byte [esi]
jno 0xff140e
jnp 0xff1493
jle 0xff1494
jle 0xff1495
jle 0xff140c
hlt
push 0x71ac6c38
cld
mov al, byte [0x28818181]
cmc
mov dword [ebp - 0x75], edx
invalid
mov cs, word [ebp - 0x1a68df26]
add byte [ecx + 0x3878f481], 0x4d
invalid
fisub dword [eax]
xchg edi, eax
in eax, 0x80
add dword [ecx + 0x4d3878f4], 0x7f96beb7
jno 0xff14a0
mov bh, 0xbe
xchg esi, eax
jg 0xff1516
cli
jle 0xff1527
jle 0xff14aa
jmp [edi + 0x7e7e7e7c]
scasd eax, dword es:[edi]
jl 0xff152c
jle 0xff152e
cmc
xchg esi, eax
sub ch, dh
mov dword [ebp - 0x72], edx
invalid
mov eax, dword [0x5fa2a1a1]
idiv edx
aaa
sub dl, cl
popfd
aaa
sub ah, byte [0xa1a19591]
mov eax, dword [0xf62a798a]
mov eax, dword [0x20a5ee2a]
mov eax, dword [0x2a798aa1]
mul byte [ecx + 0x20a5ee2a]
sub ch, dh
movsd dword es:[edi], dword [esi]
and byte [ebx - 0x5f], bl
mov eax, dword [0x25aea1a1]
out 0xa1, eax
mov eax, dword [0x2077a2a1]
test ax, 0xa1a1
mov eax, dword [0xa1a94820]
mov eax, dword [0xa15820a1]
mov eax, dword [0x25aea1a1]
jne 0xff15b3
pop ebx
mov eax, dword [0xaea1a1a1]
and eax, 0xa1a1a1e7
mov byte [0xa9662077], al
mov eax, dword [0x4820a1a1]
test eax, 0x20a1a1a1
pop eax
mov eax, dword [0xaea1a1a1]
and eax, 0x5e5e5e75
pop esi
pop esi
invalid
sub cl, cl
mov esi, 0x89be094b
add dh, byte [ebp + 0x36353535]
retf
Function at 0x418010
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0x4c4064
mov dword [0x4c7acc], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [0x4c7acc]
add ecx, eax
test esi, esi
mov dword [0x4c7acc], ecx
je 0x418056
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x418060
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4c7acc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add dword [0x4c7acc], eax
call fcn.00418010
mov ecx, dword [0x4c7acc]
push str.shell32.lib
add ecx, eax
mov dword [0x4c7acc], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x10
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4180b6
or dword [esi], 0x2000000
push str.SetCurrentProcessExplicitAppUserModelID
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, esi
pop edi
pop esi
ret
Function at 0x44f5d1
Capabilities:
Encode data using xor

Disassembly:
bound eax, qword [edi + 0x7a]
jg 0x44f565
into
and al, 0xb9
cmp esp, eax
scasb al, byte es:[edi]
leave
wait
invalid
je 0x44f621
xor bh, ch
pop esi
mov eax, 0x225948a9
or eax, 0x54c203e2
push esp
push esp
loopne 0x44f559
add dword [edi], edx
popfd
inc ebx
inc ebp
mov word [edi - 0x74], ds
or bh, byte [esp + ebx*4]
sbb al, 0x68
loope 0x44f64a
dec esp
bound esi, qword [0xd22b130]
mov ebp, 0xaf619e5
add eax, 0x4e89b127
jbe 0x44f5c3
dec edi
wait
fld xword [ecx - 0x357995fd]
xor dh, al
ror esi, cl
lahf
inc ecx
dec ecx
or dword [edi - 0x1553970f], esp
sbb al, byte [edi - 0x423359e7]
invalid
ljmp 0xbdcc:0xa619871a
push esi
and byte [eax + 0x74], al
adc edi, esi
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
sub byte [esi], dh
and edi, dword [edx - 0x32]
mov eax, dword [0xabedf10a]
insd dword es:[edi], dx
inc eax
dec ebx
aam 0x69
dec edi
sub al, 0xd3
or dword [edx + 0x28], esp
xlatb
int3
or ecx, ecx
cmp al, 0x4c
int 0x20
loope 0x44f60b
out dx, al
rcl byte [edx + esi*2 - 0x4d44f302]
loopne 0x44f6a0
adc byte [ebx], ch
in al, dx
xchg esi, eax
cld
xchg ecx, eax
test eax, 0x34d75cfd
adc esp, esp
invalid
and ch, byte [eax + edi*8]
xlatb
inc edx
cld
paddsw mm5, mm7
fidivr dword es:[edi + 0x45e0bc08]
imul ecx, dword [ebp + 0x4d], 0x6691e8e2
insb byte es:[edi], dx
xchg ecx, eax
insb byte es:[edi], dx
xchg ebx, eax
lodsb al, byte [esi]
call 0x279daab5
mov al, byte [0x40c7f50a]
inc ecx
jge 0x44f68b
mov byte [esi - 0x5b554cee], dl
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
lodsd eax, dword [esi]
mov bh, 0x68
ja 0x44f6b6
pop ds
sbb bl, byte [ebp + ebp*2 + 0x4ba70cca]
xor ch, byte [edx + esi*4 + 0x323e47a3]
adc dword [edx + 0x17170ffa], esi
push eax
pop ss
push esp
sahf
imul edx, edx, 0xffffffda
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa9460fbe
mov al, bh
outsb dx, byte [esi]
inc ecx
salc
or eax, 0xd9bfface
push ss
sti
dec byte [ebp - 0x31]
cdq
push eax
pushal
invalid
Function at 0x474541
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + 0x31], dl
retf 0xb46
sub eax, 0xeb88e163
jns 0x4744db
mov dword [0xb36477c9], eax
imul dword [0x7c934058]
jle 0x47457b
or ecx, 0xffffff96
jb 0xf7d6ca25
add bh, 0x84
invalid
jle 0x47456c
mov eax, 0x801715c5
mov edx, 0x6cc68d05
xor eax, 0x8aca159b
cmp ch, byte [esi - 0x48]
and eax, 0x97464c77
adc eax, 0x6e3a8aca
mov eax, 0x464c7725
xchg edi, eax
pushal
idiv byte [ecx]
and al, byte [ebx - 0x628f095b]
pop ds
push cs
and dword [ebp + 0x1f9d70f6], 0xe
pop edi
inc edi
jp 0x474559
enter 0x378a, 0xffffffffffffff95
out dx, al
lodsb al, byte [esi]
or dh, byte [ecx]
cdq
add ebp, ebp
mov dl, 0xe6
jecxz 0x47459f
nop
lodsd eax, dword [esi]
mov ch, 0x75
jns 0x4745e1
popal
add byte [edi - 0x151d9794], ch
push 0x806566c3
dec ecx
sbb eax, 0x28a969e7
xchg ebx, eax
mov ebp, es
add dword [ecx + 0xa59ecfa], edx
jb 0x474636
scasd eax, dword es:[edi]
insb byte es:[edi], dx
push 0xc368eae2
or byte gs:[ecx + 0x1d], 0xe7
imul ebp, dword [ecx - 0x3a736cd8], 0xecfa9101
pop ecx
or dh, byte [edx + 0x7c]
sub dword [esi + 0x3d785b10], ecx
push edi
push ecx
insb byte es:[edi], dx
jmp 0x4745de
adc byte [ecx + 0xdf39af2], bh
stosd dword es:[edi], eax
xor dword [edx], 0x78
cld
sub al, bl
enter 0x39b8, 0xffffffffffffff8d
wait
cmp dword [ebp - 0x25978365], ecx
pop ss
jl 0x47464b
ficom dword [edi]
push cs
jno 0x47463f
sub bl, bl
xchg esp, eax
rol byte [ebx], 1
xchg dword [ebx], eax
stc
or bl, byte [ebp + 0x1a]
jns 0x47458c
pop ebp
sbb bh, byte [ecx - 0x69]
in eax, 0xd4
adc dword [ebx - 0x232bbe02], ebx
push edx
call dword [esi]
cdq
dec edx
cmovnp ebp, dword [eax + 3]
push ds
js 0x47462e
rol dword [esi - 4], 1
pop ebx
enter 0xffffffffffffef2e, 0x51
insd dword es:[edi], dx
cmp byte [ecx + ebx*4 - 0x68], cl
movsd dword es:[edi], dword [esi]
pushal
pushfd
add dword [ebx + esi*2 - 0x2d], esi
idiv dword [esi - 0x1271affe]
jno 0x4745cf
and bh, cl
leave
push ebx
and ah, byte [ebp + 0x5bffdb8c]
add esp, ebx
retf 0x4219
invalid
pop eax
cwde
push esi
pop eax
push cs
mov dword [0xe0801424], eax
mov al, 0x4a
loopne 0x4745f1
dec edx
invalid
pop eax
xor dword [edx], esp
sub eax, 0x773e8e9b
mov dh, 0x65
movsd dword es:[edi], dword [esi]
aad 4
jle 0x474642
pop esp
pop edx
ret
Function at 0x484601
Capabilities:
Encode data using xor

Disassembly:
or ebp, dword [edx + 8]
sar byte [esi + 0x2d], 1
lahf
mov cl, 0
stosb byte es:[edi], al
push edx
hlt
and edi, dword [edx]
enter 0xffffffffffffb31d, 0x72
loope 0x48464d
mov dh, bl
jne 0x484621
mov ch, 0x17
int 0x91
ja 0x484617
push edi
outsb dx, byte [esi]
inc edi
in al, dx
mov dl, 0x33
mov ecx, 0x53b02997
stosb byte es:[edi], al
out dx, eax
mov cl, 0x4f
push ecx
jae 0x48464f
lodsb al, byte [esi]
xchg ecx, eax
mov al, 0x31
push ebx
or dword [ebx + 0x71], esi
push ebx
fadd qword [esi - 0x47]
push ebx
mov ch, 0x73
jno 0x48468a
out 0x3b, eax
mov eax, gs
push eax
jae 0x4845d8
ret
bound esp, qword [eax + ebx*4 + 0x49]
inc esp
pop edx
inc ebp
push ebx
out 0x10, eax
je 0x484643
ljmp 0xb160:0x89635cb4
or esi, ebx
add eax, 0xcc7a951e
pop ebx
lodsb al, byte [esi]
adc al, 0x7b
sar dword [ebp + 0x57], cl
test al, 0x98
cmp al, 0x23
lodsb al, byte [esi]
sahf
mov ch, 0x51
xchg ecx, eax
pop esi
call 0xade8373
and dh, byte [eax + 0x33]
xchg esi, eax
or ah, byte [edx]
jo 0x4846ac
daa
xor eax, 0xcf0e548f
leave
test dword [edi + 0xd], edx
dec edi
push edx
xchg edx, eax
arpl word fs:[esp + ebp*4 - 0x755eaff6], dx
lds ecx, [ebx - 0x2b]
push edx
lodsb al, byte [esi]
or dl, byte [eax - 0x5f]
mov al, ch
dec ebx
aad 0x52
push eax
adc dword [edx - 0x6f], esp
jg 0x484657
jae 0x48461f
mov bh, byte [esi - 0x1e9ab665]
insb byte es:[edi], dx
push ebx
wait
or byte [edi - 0x3f71a293], bh
adc eax, 0x39088102
jno 0x484674
or dword [eax], 0xd6c37139
salc
jnp 0x4846f3
xchg esp, eax
xchg byte [ecx - 0x59], ch
pop ebx
invalid
invalid

Function at 0x492991
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x63da99
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x6e9060]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp edi, 0x207
jne 0x4929da
call 0x56260b
jmp 0x493114
cmp edi, 0x201
je 0x492a13
cmp edi, 0x202
je 0x492a0b
cmp edi, 0x204
invalid
Function at 0x4963c1
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0x7e
add byte [esi - 0x2cc75db], ch
in al, dx
push esi
lea eax, [0x5b04e61b]
add al, 0x5b
add al, 0x5b
pushal
daa
cmc
mov eax, dword cs:[0x33bb9336]
stc
sbb bh, 0xbc
xor dword cs:[edi - 0x7c], ecx
xor dword [esi], ebp
sti
add dword [ecx + 0x59b48ea4], 0xffffffc1
in al, dx
salc
xchg esi, eax
and al, 0x3d
add eax, 0x6fa5e06
lcall 0x8425, 0x34253db8
pop eax
pop esi
mov ch, 0xbf
in al, 0x36
mov dl, 0x8e
push esp
mov edi, 0x499cbe4d
adc al, 5
pop esp
mov esi, 0xb41cb5ec
cmp dword [ecx - 0x78], esi
mov eax, 0xb74aa4da
push ebp
adc dword [esi - 0x56fa1cc6], ebx
jle 0x4963b3
jge 0x496437
lodsd eax, dword [esi]
rcl byte [0x35df5a24]
mov dh, 0x23
xchg edx, eax
retf 0x3bb4
xor eax, 0xca9223b6
mov ah, 0x3b
adc ecx, ebx
mov ebp, 0xd122b469
and ebx, esi
xchg esi, eax
loop 0x4964a4
push ds
cmp cl, byte [ebp + 0x238e05ce]
xchg esp, eax
scasb al, byte es:[edi]
add eax, 0xae94238e
sub dl, byte [edx]
cmp eax, 0x68b02a60
xchg ebp, eax
test dword [ebx + 0x1d7776e], edi
aad 0xbf
outsb dx, byte [esi]
ja 0x496420
add dword [esi], edi
aad 0xbf
cwde
sub al, 0xda
mov eax, dword [0x6c8c30b4]
pop ds
pop esi
xchg esi, eax
push cs
movsb byte es:[edi], byte [esi]
push eax
shr byte [esi + 0x2d55c0cd], cl
push 0xa6791a2f
pushal
out 0x13, eax
xchg dword [eax], eax
cmc
outsb dx, byte [esi]
pop ecx
push cs
push esp
mov bl, 0xc4
cmp eax, 0xd6a4408e
sar byte [esi], cl
and eax, 0xfa120604
push ds
call 0x8753f9ec
jae 0x496446
jb 0x496449
mov al, 0xaf
or eax, 0xb59e72c6
push edx
mov byte [edx + 0x7a], al
add al, 0xf2
cmpsd dword [esi], dword es:[edi]
ret 0x8722
mov esi, 0x62e245c0
invalid
Function at 0x4bb5a1
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1668
push 0x4bb454
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c8d34], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c8d30], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c8d2c], ecx
shr eax, 0x10
mov dword [0x4c8d28], eax
push 1
call fcn.004bc643
pop ecx
test eax, eax
jne 0x4bb597
push 0x1c
call fcn.004bb659
pop ecx
call fcn.004bc400
test eax, eax
jne 0x4bb5a8
push 0x10
call fcn.004bb659
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004bc244
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c93f4], eax
call fcn.004bc112
mov dword [0x4c8d18], eax
call fcn.004bbec5
call fcn.004bbe0c
call fcn.004bbb1c
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004bbdb4
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4bb5f7
movzx eax, word [ebp - 0x2c]
jmp 0x4bb5fa
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004bbb49
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004bbc3c
pop ecx
pop ecx
ret
Function at 0x4bc6d9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4388
cmp edx, dword [eax]
je 0x4bc6fb
add eax, 8
inc ecx
cmp eax, 0x4c4418
jl 0x4bc6ec
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4388]
jne 0x4bc829
mov eax, dword [0x4c8d20]
cmp eax, 1
je 0x4bc803
test eax, eax
jne 0x4bc72c
cmp dword [0x4c42b4], 1
je 0x4bc803
cmp edx, 0xfc
je 0x4bc829
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc763
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd0c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd550
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc7a6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd550
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c19cc
push edi
call fcn.004bf420
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd0c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd0d0
lea eax, [ebp - 0xa0]
push 0x4c19ac
push eax
call fcn.004bd0d0
push dword [esi + 0x4c438c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd0d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf394
add esp, 0x2c
pop edi
jmp 0x4bc829
lea eax, [ebp + 8]
lea esi, [esi + 0x4c438c]
push 0
push eax
push dword [esi]
call fcn.004bd550
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2cf1408e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3c2158a5
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401db0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401efd
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401e44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401ef6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401e30
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401f3a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401f1a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401eef
sub eax, 0x40
and eax, 0xffffffbf
je 0x401eef
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401f04
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401e4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402400
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402455
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40244e
test esi, esi
je 0x40244e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402430
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402670
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4026a8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40269e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4026aa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402690
xor eax, eax
pop ebx
pop esi
ret
Function at 0x410b63
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x80000005
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x410b81
mov eax, 0x6ee4da
push eax
push 1
mov ebx, 0x4cd7c0
call fcn.004cd192
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410bab
mov eax, 0
jmp 0x410c1f
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x410c0c
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x410bf5
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x410be4
xor ecx, eax
xor edx, ebx
dec edi
jne 0x410bd5
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x41c218
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x41c23a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
mov dword [ebp - 4], 0
nop
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, 0x80000006
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, 0x80000005
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
nop
imul esi, esi, 0x88
nop
nop
push ebx
push ecx
push edx
mov eax, 0x80000005
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
imul edx, edx, 6
add esi, edx
nop
nop
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
push ebx
push ecx
push edx
mov eax, 0x80000006
cpuid
shr ecx, 0x10
imul ecx, ecx, 9
add esi, ecx
pop edx
pop ecx
pop ebx
nop
nop
nop
xor esi, 0x124254
mov dword [ebp - 4], esi
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
nop
nop
nop
mov eax, dword [ebp - 4]
jmp 0x41c375
mov esp, ebp
pop ebp
ret

Function at 0x41e0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x41e112
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 4], 0x2b7e9735
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, dword [ebp - 4]
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x41e18b
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x41e1d9
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8