joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ec7c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415f82
and dword [ebp - 0x14], 0
cmp dword [0x46b150], 0
mov dword [ebp - 0x18], eax
jne 0x41ed2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41edd7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41edd7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46b150], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46b154], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46b158], eax
call edi
push eax
call esi
mov dword [0x46b160], eax
test eax, eax
je 0x41ed2f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46b15c], eax
mov eax, dword [0x46b15c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ed88
cmp dword [0x46b160], ecx
je 0x41ed88
push eax
call esi
push dword [0x46b160]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ed88
test ebx, ebx
je 0x41ed88
call edi
test eax, eax
je 0x41ed7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41ed7f
test byte [ebp - 8], 1
jne 0x41ed88
or dword [ebp + 0x10], 0x200000
jmp 0x41edbb
mov eax, dword [0x46b154]
cmp eax, dword [ebp - 0x18]
je 0x41edbb
push eax
call esi
test eax, eax
je 0x41edbb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41edbb
mov eax, dword [0x46b158]
cmp eax, dword [ebp - 0x18]
je 0x41edbb
push eax
call esi
test eax, eax
je 0x41edbb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b150]
call esi
test eax, eax
je 0x41edd7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41edd9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004106c7
leave
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0xd8e60f9
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x6083350e
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x408bf0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0xffffffff
jne 0x408c01
xor eax, eax
pop esi
pop ecx
ret 8
mov eax, dword [esi + 0x30]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea edi, [esi + 0x20]
lea ecx, [esp + 8]
push edi
push ecx
mov ecx, dword [esi + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408c4b
mov edx, dword [esi + 0x30]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0xc]
lea eax, [esp + 8]
push 1
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
pop edi
mov eax, 1
pop esi
pop ecx
ret 8

Function at 0x408cf0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0xffffffff
jne 0x408daf
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
and edi, 0xff
push edi
push 0x467658
push eax
call fcn.00428a3e
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esi + 4], edi
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x408daf
push 1
mov ecx, esi
call fcn.00408b10
test eax, eax
je 0x408daf
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00408b30
test eax, eax
je 0x408daf
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 5
push eax
call edi
test eax, eax
je 0x408daf
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0xc]
push 6
push ecx
call edi
test eax, eax
je 0x408daf
mov eax, dword [esp + 0x28]
test eax, eax
je 0x408db9
mov edx, dword [esi + 0xc]
push 3
push edx
call edi
test eax, eax
jne 0x408dc5
pop edi
xor eax, eax
pop esi
add esp, 8
ret 0x18
mov eax, dword [esi + 0xc]
push 4
push eax
call edi
test eax, eax
je 0x408daf
mov ecx, esi
call fcn.00408bb0
test eax, eax
je 0x408daf
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x18], eax
call edi
push esi
push 0
push 0x4089e0
mov dword [esi + 0x1c], eax
call fcn.0042918b
mov ecx, dword [esi + 0x1c]
add esp, 0xc
mov dword [esi + 0x10], eax
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c], 0xffffffff
pop edi
mov eax, 1
pop esi
add esp, 8
ret 0x18
Function at 0x40f180
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x426
call fcn.00448572
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0xdcdb9c
push 0
push 0x467938
push 0x467930
mov esi, eax
call ebp
push 0
push eax
mov eax, dword [esi + 0x1c]
push 0x14e
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xdcdb9c
push 0
push 0x467f28
push 0x467f20
call ebp
push eax
lea ecx, [edi + 0x290]
call fcn.004025b0
push 0xdcdb9c
push 0
push 0x468b34
push 0x467930
call ebp
mov dword [0xc6f9a8], eax
mov eax, dword [0xdbdad0]
test eax, eax
jne 0x40f236
push 1
push 0x468b2c
call fcn.0043a1d2
add esp, 8
test eax, eax
je 0x40f236
push 1
push eax
mov ecx, 0xdbda80
call fcn.00416410
mov ecx, 0xdbda80
call fcn.00416540
mov ecx, 0xdbda80
test ecx, ecx
jne 0x40f24e
mov edx, dword [0xdbda78]
push 0
push 2
mov ecx, dword [edx + 4]
add ecx, 0xdbda78
call fcn.00404490
mov eax, dword [0xdbda78]
mov bl, 6
mov ecx, dword [eax + 4]
test byte [ecx + 0xdbda7c], 1
jne 0x40f2b5
mov eax, dword [0x17cdcb8]
push 0xa
lea ecx, [ecx + 0xdbda78]
lea eax, [eax + eax*2]
lea esi, [eax + eax*4]
shl esi, 4
add esi, 0xc6fab4
call fcn.00415ed0
push eax
push 0xf0
push esi
mov ecx, 0xdbda78
call fcn.00416070
mov eax, dword [0xdbda78]
mov ecx, dword [eax + 4]
test byte [ecx + 0xdbda7c], bl
jne 0x40f2a9
inc dword [0x17cdcb8]
mov ecx, dword [eax + 4]
test byte [ecx + 0xdbda7c], 1
je 0x40f261
mov eax, dword [0xdbdb60]
test eax, eax
jne 0x40f2f1
push 1
push 0x468b24
call fcn.0043a1d2
add esp, 8
test eax, eax
je 0x40f2f1
push 1
push eax
mov ecx, 0xdbdb10
call fcn.00416410
mov ecx, 0xdbdb10
call fcn.00416540
mov edx, 0xdbdb10
test edx, edx
jne 0x40f30d
mov eax, dword [0xdbdb08]
push 0
mov ecx, dword [eax + 4]
add ecx, 0xdbdb08
mov edx, dword [ecx + 4]
or edx, 2
push edx
call fcn.00415eb0
mov eax, dword [0xdbdb08]
mov ecx, dword [eax + 4]
test byte [ecx + 0xdbdb0c], 1
jne 0x40f372
mov eax, dword [0x17cdcb4]
push 0xa
lea ecx, [ecx + 0xdbdb08]
lea eax, [eax + eax*2]
lea esi, [eax + eax*4]
shl esi, 4
add esi, 0xc98af4
call fcn.00415ed0
push eax
push 0xf0
push esi
mov ecx, 0xdbdb08
call fcn.00416070
mov eax, dword [0xdbdb08]
mov ecx, dword [eax + 4]
test byte [ecx + 0xdbdb0c], bl
jne 0x40f366
inc dword [0x17cdcb4]
mov ecx, dword [eax + 4]
test byte [ecx + 0xdbdb0c], 1
je 0x40f31e
push 0x468b18
push 0x41e
mov ecx, edi
call fcn.00448572
mov ecx, eax
call fcn.00448631
push 1
lea ecx, [edi + 0x74]
call fcn.004025b0
push 0xdcdb9c
push 0
push 0x468b0c
push 0x468b04
call ebp
mov esi, eax
lea edx, [esp + 0x10]
push esi
push 0x468af0
push edx
call fcn.00428a3e
inc esi
push 0xdcdb9c
push esi
push 0x468b0c
push 0x468b04
call fcn.00409020
add esp, 0x1c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0040a690
mov ecx, dword [edi + 0x1c]
push 0
push 0x1f4
push 0xa
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x41daa0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
mov dword [esi + 0x88c], ebx
mov dword [esi + 0x890], eax
call fcn.0041db20
mov ecx, dword [esp + 0x10]
push 0
push 8
push 0
push 0
push 0x28e8
push ecx
mov ecx, esi
call fcn.00408cf0
mov edi, eax
test edi, edi
je 0x41db0c
mov byte [esi + 0x87c], 1
push ebx
mov ecx, esi
call fcn.0041db70
cmp dword [esi + 0xcb0], 0xffffffff
jne 0x41db0c
mov byte [esi + 0xcbc], 0
push esi
push 0
push 0x41e210
call fcn.0042918b
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x41dc10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
mov eax, dword [ecx + 0x870]
push ebx
push ebp
push esi
lea esi, [ecx + 0x870]
push edi
or eax, dword [esi + 4]
jne 0x41dc37
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x41dcc1
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, dword [esp + 0x2c]
push ecx
push edx
push 0
push eax
call fcn.0042a140
push 0
push 0x3e8
push edx
push eax
call fcn.0042a0d0
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
mov esi, edx
call ebp
test eax, eax
je 0x41dcc1
xor ecx, ecx
xor edx, edx
test esi, esi
jl 0x41dcc1
jg 0x41dc7b
test edi, edi
jbe 0x41dcc1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
sub eax, ecx
mov ecx, esi
sbb ecx, edx
mov dword [esp + 0x24], ecx
jne 0x41dc94
cmp eax, 5
jb 0x41dc98
push 1
call ebx
lea edx, [esp + 0x10]
push edx
call ebp
test eax, eax
je 0x41dcc1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub ecx, edx
mov edx, dword [esp + 0x14]
sbb edx, eax
cmp edx, esi
jl 0x41dc81
jg 0x41dcc1
cmp ecx, edi
jb 0x41dc81
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x41e1c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
call ebx
mov ebp, eax
mov eax, dword [esi + 0x880]
cmp eax, dword [esp + 0x14]
jae 0x41e201
test edi, edi
jne 0x41e201
call ebx
mov ecx, dword [esp + 0x18]
sub eax, ebp
cmp eax, ecx
jbe 0x41e1f3
mov edi, 1
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x880]
cmp ecx, eax
jb 0x41e1de
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
pop ebx
sete al
ret 8

Function at 0x41fd10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push ebx
and eax, 0xff
push esi
mov ecx, eax
mov esi, dword [esp + 0x14]
and eax, 7
and esi, 0xff
shl eax, 0x1d
mov ebx, eax
mov eax, dword [esp + 0x10]
and eax, 0xff
xor edx, edx
shl eax, 8
add eax, esi
mov esi, dword [esp + 0x18]
shr ecx, 3
shl eax, 8
imul ecx, ecx, 0xa221288
and esi, 0xff
push edi
add eax, esi
mov esi, 0x20
mov edi, 0x18
test al, 1
je 0x41fd68
or edx, esi
shl esi, 1
shr eax, 1
dec edi
jne 0x41fd62
or edx, ebx
pop edi
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov eax, edx
pop esi
mov byte [ecx + 3], al
pop ebx
shr eax, 8
mov byte [ecx + 2], al
shr eax, 8
mov byte [ecx + 1], al
shr eax, 8
mov byte [ecx], al
ret
Function at 0x420310
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [esi + 0x150]
push 0x258
push eax
mov dword [esi + 0x118], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x420341
mov dword [esi + 0x118], edi
pop edi
mov al, 1
pop esi
ret 4
push 0x46a188
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
ret 4

Function at 0x4207b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push esi
push 0
push 0x420270
call fcn.0042918b
add esp, 0xc
mov dword [esi + 0x148], eax
pop esi
ret

Function at 0x430b58
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x46ba48
cmp edx, dword [eax]
je 0x430b7a
add eax, 8
inc ecx
cmp eax, 0x46bad8
jl 0x430b6b
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x46ba48]
jne 0x430ca8
mov eax, dword [0x17cfdbc]
cmp eax, 1
je 0x430c82
test eax, eax
jne 0x430bab
cmp dword [0x46b214], 1
je 0x430c82
cmp edx, 0xfc
je 0x430ca8
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x430be2
lea eax, [ebp - 0x1a4]
push 0x45b0c0
push eax
call fcn.0042e510
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0042da90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x430c25
lea eax, [ebp - 0x1a4]
push eax
call fcn.0042da90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x45b0bc
push edi
call fcn.00428940
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x45b0a0
push eax
call fcn.0042e510
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0042e520
lea eax, [ebp - 0xa0]
push 0x45b09c
push eax
call fcn.0042e520
push dword [esi + 0x46ba4c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0042e520
push 0x12010
lea eax, [ebp - 0xa0]
push 0x45b074
push eax
call fcn.004330c0
add esp, 0x2c
pop edi
jmp 0x430ca8
lea eax, [ebp + 8]
lea esi, [esi + 0x46ba4c]
push 0
push eax
push dword [esi]
call fcn.0042da90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x445233
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x445255
cmp dword [edi + 0x3c], 0
jne 0x445255
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0044dd7f
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00445282
pop edi
pop esi
pop ebx
ret 8
Function at 0x44688c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4468c4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0044923e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00449216
jmp 0x4468d0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x447e0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x447e4d
call fcn.0044dd7f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x447e4d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x447e44
xor eax, eax
jmp 0x447e55
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00447e5b
pop edi
pop esi
pop ebx
ret 4

Function at 0x44e589
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44e5b7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44e5d5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044e4ef
jmp 0x44e5d5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44e5d5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0044e4ef
test edi, edi
mov eax, edi
jne 0x44e5bf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x65d95e03
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x4d0621e6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000a840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 0x78
mov dword [ebp - 0x1c], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x1000a889
xor eax, eax
jmp 0x1000a931
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x1000a8a8
xor eax, eax
jmp 0x1000a931
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4 - 4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.1000a990
mov edx, dword [ebp + 0xc]
and edx, 0xfffffff
cmp eax, edx
jne 0x1000a91d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x2c]
movzx edx, word [ecx + eax*2 - 2]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
jmp 0x1000a931
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
je 0x1000a92e
cmp dword [ebp - 0xc], 0
je 0x1000a8d8
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d0f0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov eax, dword [str.0123456789abcdef]
mov dword [ebp - 0x38], eax
mov ecx, dword [0x100628e0]
mov dword [ebp - 0x34], ecx
mov edx, dword [0x100628e4]
mov dword [ebp - 0x30], edx
mov eax, dword [0x100628e8]
mov dword [ebp - 0x2c], eax
mov cl, byte [0x100628ec]
mov byte [ebp - 0x28], cl
push 0xf0000000
push 0x18
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1000d178
call fcn.1000a940
mov dword [ebp - 0x18], eax
push 0x5e500be2
mov ecx, dword [ebp - 0x18]
call fcn.1000a6b0
call eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x1000d2be
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x800c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1000d1c1
call fcn.1000a940
mov dword [ebp - 0x1c], eax
push 0x5e500be2
mov ecx, dword [ebp - 0x1c]
call fcn.1000a6b0
call eax
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 4]
jmp 0x1000d2be
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000d211
call fcn.1000a940
mov dword [ebp - 0x20], eax
push 0x5e500be2
mov ecx, dword [ebp - 0x20]
call fcn.1000a6b0
call eax
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 4]
jmp 0x1000d2be
mov dword [ebp - 0x14], 0x20
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x58]
push eax
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1000d28b
mov dword [ebp - 8], 0
jmp 0x1000d244
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jae 0x1000d27f
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0x58]
sar edx, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dl, byte [ebp + edx - 0x38]
mov byte [ecx + eax*2], dl
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0x58]
and ecx, 0xf
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov cl, byte [ebp + ecx - 0x38]
mov byte [eax + edx*2 + 1], cl
jmp 0x1000d23b
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov byte [eax + edx*2], 0
jmp 0x1000d2a5
call fcn.1000a940
mov dword [ebp - 0x24], eax
push 0x5e500be2
mov ecx, dword [ebp - 0x24]
call fcn.1000a6b0
call eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret