joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422c0c
Capabilities:
Delete directory
Delete file

Disassembly:
push edi
xor ecx, ecx
mov edi, esp
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor ecx, ecx
push ebp
push esi
push edi
push 0x422ce5
push dword fs:[ecx]
xor esi, esi
mov dword fs:[ecx], esp
xor edx, edx
lea ecx, [edi - 4]
mov eax, esi
call fcn.00422b48
mov eax, dword [edi - 4]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
inc esi
cmp esi, 0x12
jne 0x422c2b
or bl, bl
je 0x422ca2
mov eax, 0x1a
call fcn.00422b38
mov ebp, eax
add ebp, 0x14
sub ebp, 0x14
jl 0x422ca2
mov esi, 0x14
inc ebp
lea ecx, [edi - 8]
xor edx, edx
mov eax, esi
call fcn.00422b48
mov eax, dword [edi - 8]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [esi + 0x1e]
lea ecx, [edi - 0xc]
xor edx, edx
call fcn.00422b48
mov eax, dword [edi - 0xc]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
inc esi
dec ebp
jne 0x422c69
lea ecx, [edi - 0x14]
xor edx, edx
mov eax, 1
call fcn.00422b48
lea edx, [edi - 0x10]
mov eax, dword [edi - 0x14]
call fcn.00405c8c
mov eax, dword [edi - 0x10]
call fcn.00403af4
push eax
call sub.kernel32.dll_RemoveDirectoryA
pop edx
pop ecx
pop ecx
xor eax, eax
mov dword fs:[eax], edx
push 0x422cec
lea eax, [edi - 0x14]
mov edx, 5
call fcn.004036b8
ret

Function at 0x42307c
Capabilities:
Compare security identifiers

Disassembly:
push edi
push esi
push ebx
add esp, 0xfffffff0
lea eax, [esp + 4]
mov byte [esp], 0
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4230c0
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4230c0
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
or ebx, ebx
je 0x423157
mov eax, 0x400
call fcn.00402830
lea edi, [esp + 8]
mov ebx, eax
push edi
push 0x400
push ebx
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov edi, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
or edi, edi
je 0x423150
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4287d0
call sub.advapi32.dll_AllocateAndInitializeSid
mov edi, dword [ebx]
dec edi
test edi, edi
jl 0x423146
inc edi
xor esi, esi
mov eax, dword [ebx + esi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
or eax, eax
je 0x423142
mov byte [esp], 1
jmp 0x423146
inc esi
dec edi
jne 0x423129
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, ebx
call fcn.00402860
mov al, byte [esp]
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x423450
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ae4
xor eax, eax
push ebp
push 0x4234c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a9b4
mov edx, dword [ebp - 8]
mov eax, 0x42a0dc
call fcn.004036e8
xor eax, eax
mov dword [0x42a0d8], eax
push 0
push 0x423364
call sub.user32.dll_EnumWindows
mov ebx, dword [0x42a0d8]
pop eax
pop edx
xor edx, edx
pop ecx
mov dword fs:[edx], eax
push 0x4234c8
mov edx, 2
lea eax, [ebp - 8]
call fcn.004036b8
ret

Function at 0x4234d0
Capabilities:
Terminate process

Disassembly:
push esi
xor esi, esi
push edi
push ebx
push ecx
mov edi, eax
test edi, edi
jns 0x4234e1
call fcn.00402d14
push edi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
or edi, edi
jns 0x4234f9
call fcn.00402d14
mov ebx, edi
or ebx, ebx
push esp
jns 0x423505
call fcn.00402d14
push ebx
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x423528
or edi, edi
mov eax, dword [esp]
push eax
jns 0x42351c
call fcn.00402d14
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb esi, esi
inc esi
or edi, edi
jns 0x423531
call fcn.00402d14
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
pop esi
pop ebx
pop edi
pop esi
ret
Function at 0x44bcc0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x18
mov dl, byte [0x65e037]
mov cl, byte [0x65e030]
xor dl, cl
and cl, byte [str._sE]
mov eax, dword [0x65e024]
push ebx
mov byte [0x65e030], cl
or cl, 2
shr cl, 1
and ecx, 0xff
push ebp
mov dword [esp + 8], ecx
mov ebp, dword [0x65e028]
fild dword [esp + 8]
push esi
mov esi, dword [0x65e020]
push edi
xor ebx, ebx
fdivr qword [0x65e040]
lea edi, [esi + eax*2]
mov esi, ebp
mov bl, dl
and esi, 3
mov dword [esp + 0x14], 0
mov byte [0x65e037], dl
mov dword [0x65e020], edi
imul esi, ebx
add eax, esi
fadd qword [0x65b740]
lea ecx, [eax + eax]
mov dword [0x65e024], eax
or ecx, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [0xa5ef38]
fstp qword [0x65ebd0]
fild qword [esp + 0x10]
cmp ecx, edi
fadd qword [0x65e040]
fstp qword [0x65e040]
je 0x44bd6c
xor edi, ecx
mov dword [0x65e020], edi
mov cl, byte [0x65e036]
mov esi, dword [esp + 0x2c]
xor cl, dl
mov edx, ebp
mov byte [0x65e036], cl
mov ecx, dword [0x65e02c]
shr edx, 1
add ecx, edx
mov dword [0x65e02c], ecx
and ecx, 7
imul ecx, ebx
add ebp, ecx
mov ecx, esi
cmp ecx, 0x7d000000
mov dword [0x65e028], ebp
jae 0x44bfa8
mov dl, byte [0x65e031]
mov cl, byte [0x65e035]

Function at 0x4949a0
Capabilities:
Encode data using xor

Disassembly:
into
lodsd eax, dword [esi]
ficomp dword [esi + ebp*4 + 0x3b]
sar ecx, 1
mov byte [0x661a836f], al
adc eax, 0x3fefe5ec
inc ebp
bound ebp, qword [0xfc6951a8]
pop esi
ja 0x4949af
xor byte [ebp - 0x47], ah
aad 0x4b
adc dword [esi*8 - 0x517207f3], edi
mov esp, 0x82adf33f
ror byte [esi + eax*8 + 0x22], 1
mov ch, 0x9e
mov byte [ebp + eax*2 - 0x4c], cl
inc ebp
dec ebp
sti
inc ebx
cld
in al, dx
jbe 0x4949bd
xor al, 0x5a
jne 0x494a05
mov ah, 0x2a
loopne 0x494965
sar dword [ecx + 0x4513cd3c], cl
int 0x13
inc ebp
pop edi
cdq
push esi
dec edi
jbe 0x494a03
push eax
push eax
in eax, dx
outsb dx, byte [esi]
xor edx, ebp
push edi
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
mov ds, word [ebx - 0x45]
mov ebp, ecx
inc ebx
adc al, 0xdb
jnp 0x4949bc
ljmp 0xbb5b:0x8ea4ab57
inc edx
xchg cl, cl
aad 0x9c
mov dl, 0xc0
and dword [edi - 0x15], edi
test al, 0x91
inc ebp
push ss
push ebx
movsd dword es:[edi], dword [esi]
hlt
stc
invalid
aam 0xa4
adc ebp, esi
pop esi
inc edx
adc dword [edi], esi
invalid
Function at 0x52a6b0
Capabilities:
Encode data using xor

Disassembly:
dec edi
cmp eax, ebx
wait
ret 0x6b30
insd dword es:[edi], dx
xor eax, 0x321fbb0d
cmp esp, ebx
mov byte [edi + 0x2c1d9e51], 0xbe
sub al, 0xbe
sub al, 0xbe
daa
cmc
mov byte [0x2df036e4], al
insd dword es:[edi], dx
dec esi
xor al, 0x30
scasd eax, dword es:[edi]
jp 0x52a6a3
daa
sub esi, esp
js 0x52a66f
mov ecx, ecx
invalid

Function at 0x60eb70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [0x65e020]
mov cl, byte [0x65e037]
mov al, byte [0x65e030]
push ebx
push esi
mov esi, dword [0x65e024]
xor cl, al
xor ebx, ebx
lea edx, [edx + esi*2]
mov bl, cl
mov dword [0x65e020], edx
mov edx, dword [0x65e028]
and edx, 3
push edi
imul edx, ebx
add esi, edx
mov dl, byte [str._sE]
and al, dl
mov byte [0x65e037], cl
mov byte [0x65e030], al
or al, 2
shr al, 1
and eax, 0xff
mov dword [0x65e024], esi
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fdivr qword [0x65e040]
fadd qword [0x65b740]
fstp qword [0x65ebd0]
mov ebx, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [0x65e024]
xor ebx, ebx
mov dword [ebp - 8], ebx
lea ecx, [eax + eax]
mov eax, dword [0x65e020]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [0xa5ef38]
fild qword [ebp - 0xc]
cmp ecx, eax
fadd qword [0x65e040]
fstp qword [0x65e040]
je 0x60ec28
xor eax, ecx
mov dword [0x65e020], eax
mov edx, dword [ebp - 4]
mov cl, byte [0x65e037]
mov edi, dword [0x65e028]
mov dword [ebp - 8], ebx
mov eax, dword [edx + 0x30]
mov dl, byte [0x65e036]
xor dl, cl
mov dword [ebp - 4], eax
mov eax, dword [0x65e02c]
mov byte [0x65e036], dl
mov edx, edi
shr edx, 1
add eax, edx
xor edx, edx
mov esi, eax
mov dl, cl
and esi, 7
mov ecx, dword [ebp - 4]
imul esi, edx
Function at 0x4014f0
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ecx
add esp, 0xffffff80
call fcn.00401700
mov dword [ebp - 0x74], 0xc3
lea edx, [ebp - 0x70]
mov eax, 0
mov ecx, 0x18
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x40000
mov eax, dword [sym.imp.KERNEL32.dll_HeapCreate]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40159f
mov dword [esp + 8], 0x64
mov dword [esp + 4], 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40159f
mov dword [esp + 8], 0x64
lea eax, [ebp - 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call 0x4015ad
mov eax, dword [ebp - 0x10]
call eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x4015bf
cmp dword [ebp + 0xc], 0
jne 0x4015c9
mov eax, 0
jmp 0x401657
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], eax
jae 0x401622
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
add eax, edx
cmp dword [ebp + 8], eax
jae 0x401622
mov eax, dword [ebp + 0x10]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea edx, [eax - 1]
mov eax, dword [ebp + 0xc]
add eax, edx
mov dword [ebp - 8], eax
jmp 0x401613
mov edx, dword [ebp - 8]
lea eax, [edx - 1]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
movzx edx, byte [edx]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
lea edx, [eax - 1]
mov dword [ebp + 0x10], edx
test eax, eax
jne 0x4015fc
jmp 0x401654
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x401647
mov edx, dword [ebp - 0x10]
lea eax, [edx + 1]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 1]
mov dword [ebp - 0xc], ecx
movzx edx, byte [edx]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
lea edx, [eax - 1]
mov dword [ebp + 0x10], edx
test eax, eax
jne 0x401630
mov eax, dword [ebp + 8]
leave
ret

Function at 0x4018c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402630
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402630
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401920
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40606c]
test esi, esi
jle 0x401a40
mov eax, dword [0x406070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401954
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4019d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401940
mov dword [esp], ebx
call fcn.00402310
mov edi, eax
test eax, eax
je 0x401a67
mov eax, dword [0x406070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402450
mov edx, dword [0x406070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a47
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4019d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4019e0
add dword [0x40606c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4019d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004018c0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40195e
mov eax, dword [0x406070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004018c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004018c0
lea esi, [esi]
nop

Function at 0x401f80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406080]
sub esp, 4
test ebx, ebx
je 0x401fd5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401fce
test esi, esi
je 0x401fce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fb0
mov dword [esp], 0x406088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402310
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402335
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402340
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402335
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402388
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40237e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40238a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402370
xor eax, eax
pop ebx
pop esi
ret

Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x8e11e0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e11e6
pop ebp
sub ebp, 6
sub ebp, 0x4e11e0
jmp 0x8e1244
jmp 0x8e124d
mov eax, 0x4e11e0
add eax, ebp
add eax, 0x93
mov ecx, 0x629
mov edx, 0x48ed17b8
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e1264
jmp 0x8e1277
sar al, cl
sar byte [eax - 0x2f474758], 1
mov eax, 0x39b89474
dec eax
push es
aam 0x5d
inc edx
cmp dword [eax + 6], ecx
aam 0x5d
inc edx
mov edi, dword [eax - 0x18]
inc edi
sub eax, 0xb8fce984
call 0x31c187d0
test byte [eax + 0x7939b8b8], bh
inc eax
mov eax, 0x75bbb8b8
add byte [esi + 0x2b8b8b8], bh
nop
mov eax, 0x5a4fb8b8
mov ebx, 0xb4393370
mov eax, 0x7dbbb8b8
call 0xb21dfa94
mov eax, 0xfc6239d0
mov eax, 0xd09c94b9
mov eax, 0x50b8b8b8
mov ebp, 0x51b8b8b8
nop
mov eax, 0x33edb8b8
push esp
xor edi, dword [0xb8b8b8b0]
xor ebp, dword [0xb8b8b8b4]
xor esi, dword [0xb8b8b8a8]
jns 0x8e1344
mov edx, 0x7a3bba89
mov esp, 0x4c3db7f1
inc edi
inc edi
inc edi
in eax, 0x7a
mov ah, 0xb8
xor esi, dword [esp + ebx*4]
mov esp, 0xd0b8b8b8
out 0x8f, eax
mov cl, 0xb8
sar byte [ecx], 1
invalid
mov eax, 0xb8f030b7
mov eax, 0xa433deb8
cmp dword [eax], 0x3cb75043
mov byte [0x38b8b8b8], al
inc ebx
push ecx
mov bh, 0x3c
test eax, 0xdeb8b8b8
cmp dword [ebx + 0x47], eax
popfd
mov bh, 0x3c
lodsd eax, dword [esi]
mov eax, 0x51f9b8b8
je 0x8e13b7
inc edi
inc edi
xchg ecx, eax
hlt
mov edx, 0xbab8b8b8
push 0xffffffffffffffb7
cmp eax, 0xb8b8b8bd
xor ch, byte [esi - 0x48955502]
cmp esp, dword [eax + 0x47]
inc edi
inc edi
mov edx, 0xbd3db76a
mov eax, 0xae32b8b8
invalid
Function at 0x3000607d
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x300080b4]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.3000607d
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [0x300080b4]
jne 0x30005f68
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x401ce6
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
inc edi
imul eax, dword [ecx + 0x567a5db9], 0x20780526
aaa
xor al, 0x31
js 0x401d57
and al, byte [ebx - 0x16]
cmp eax, 0xe51e2c25
cwde
xor al, 0x1d
arpl dx, si
mov eax, dword [0x1ec4b733]
push cs
lcall 0xa530, 0x7457005b
or al, 0x31
cli
sbb eax, 0x5b226c47
invalid
xor esi, dword [edi - 0x65f1e13c]
pop ebx
add byte [edi + 0x74], dl
xor byte [ebp + 0x1dfa310c], ah
inc edi
insb byte es:[edi], dx
and bl, byte [ebx - 0x10]
lds ecx, [edx + esi + 0x39c692ad]
dec esi
invalid
invalid
mov dword [edi], 0xbec599af
mov dword [ebp + 0x61cfb0c4], 0x495cd8d0
cmp dword [edi + eax*4], ebx
lfs ebp, [ebp + 0x4b81168b]
jbe 0x401d06
adc al, 0xce
shr dword [ebx], 0x8a
jnp 0x401d87
sbb dword [edi], eax
stosb byte es:[edi], al
push es
out 0x81, eax
imul eax, dword [edx + 0x23], 0x5b7e5bf6
pop ebx
or dword [eax - 0x1d], edx
movsb byte es:[edi], byte [esi]
out 0x35, eax
jl 0x401d1c
cmp al, 0xa5
jge 0x401ddd
or ah, ch
imul esi, dword [ebx], 0x2c
xchg esi, eax
fstp qword [esi + ebp]
xor byte [edi + 0x49120a6f], bl
sal edx, 0x43
inc ebx
mov ecx, 0x8179598
pop edi
push cs
cwde
xchg ebp, eax
pop ss
or byte [edi + 0xe], bl
dec edx
dec ebp
mov ecx, 0xe9a52071
jno 0x401d96
inc esi
loop 0x401d92
out dx, al
outsb dx, byte [esi]
mov edx, 0xeeead9ee
dec ebx
ja 0x401d73
mov ds, eax
in eax, 0xb8
shl byte [edx], 1
cmp eax, 0xd692c078
nop
cmp bh, byte [edi]
out 0xd8, al
enter 0xffffffffffffb77b, 0x59
xchg ecx, eax
cli
inc eax
adc dword [ebx - 0x398a942b], 0xf0a12af2
cdq
int 0x9d
aad 0x6b
jne 0x401da7
sub ah, byte [ecx - 0x62326610]
jge 0x401db4
jnp 0x401e5c
cmpsd dword [esi], dword es:[edi]
push ds
pop ebx
jg 0x401da4
stc
aaa
adc al, cl
add cl, cl
inc ecx
invalid
mov byte [esi], ah
rcl byte [ecx + 0x17], 0x83
invalid
invalid
mov esp, 0xaa80a5ce
jl 0x401e32
movsd dword es:[edi], dword [esi]
sub byte [edx - 0x75502e84], 0xc4
scasd eax, dword es:[edi]
mov al, ah
adc dh, bl
js 0x401e19
cmp dh, byte [eax + 0x53676ece]
fild qword [edi + 2]
out 0x50, eax
sahf
jp 0x401ef3
cmpsb byte [esi], byte es:[edi]
mov dl, 0xe6
test al, 0xf4
jge 0x401e5a
iretd
invalid