joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039af3
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x1005b668
call fcn.1004c758
sub esp, 0x24
mov ecx, dword [ebp + 0x10]
and dword [ebp - 0x18], 0
push ebx
push esi
mov eax, dword [ecx + 4]
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
mov dword [ebp - 0x10], esp
movzx edx, word [eax + 0x14]
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x18], eax
jge 0x10039c3a
mov eax, dword [ebp - 0x14]
push 0x1005f78c
cmp dword [eax + 0x10], 0
jne 0x10039b88
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x36
call fcn.1004e787
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x10039b82
mov esi, dword [ebp - 0x14]
push 4
push 0x1000
push edi
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x1c]
push eax
call dword [0x101d116c]
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.1004c960
add esp, 0xc
mov eax, 0x10039c27
ret
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x28], 0x43
call fcn.1004e787
mov eax, dword [ebp - 0x14]
push 4
push 0x1000
push dword [eax + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
push eax
call dword [0x101d116c]
mov dword [ebp - 0x20], eax
mov eax, 0x10039bc2
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a

Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.1005f0f2
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.1005f0f2
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1005f0f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1005f101
pop dword [ebp - 0x4c]
mov eax, 0x1005f101
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x5a5a3
push 0
mov eax, 0x3a4d2ed6
add eax, 0xd5b2e24e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x51f61af2
sub ecx, 0x51f5d074
xor ebx, ebx
add ebx, eax
mov edx, 0x279484c7
sub edx, 0x178a78c7
add edx, dword [ebp - 0x4c]
mov edi, 0x9ba33aa0
add edi, 0x7d5d99bf
add dword [ebp - 0x30], 0x6128f34c
mov esi, dword [edx]
xor dword [ebp - 0x48], ecx
xor esi, edi
add dword [ebp - 0xc], 0xa1eeea0e
mov dword [ebx], esi
add ebx, 0x4e2fe87c
add ebx, 0xb1d01788
add edx, 4
loop 0x1005f15d
add eax, 0x889b91cc
sub eax, 0x889a7501
xor ebx, ebx
add ebx, eax
add eax, 0x99c6ef98
sub eax, 0x99c6ef93
mov ecx, 0xee9e334c
sub ecx, 0xde9e334c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x4402dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4402ec
pop dword [ebp - 0x20]
mov eax, 0xa994d931
sub eax, 0xa950d645
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x4abfd
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xcd198484
add ecx, 0x32e6ae0c
xor edx, edx
add edx, eax
mov ebx, 0x475e00
add ebx, dword [ebp - 0x20]
mov edi, 0x3c86a68f
xor dword [ebp - 0x10], ecx
mov esi, dword [ebx]
sub dword [ebp - 0x18], 0xfbdc5fc8
sub esi, edi
sub dword [ebp - 0xc], 0xfe3ea19d
mov dword [edx], esi
add dword [ebp - 8], eax
add edx, 0x8ba9b789
sub edx, 0x8ba9b785
add ebx, 0xbffe0d6c
add ebx, 0x4001f298
loop 0x44033c
add eax, 0x961cd2c9
add eax, 0x69e3ea4a
xor ebx, ebx
add ebx, eax
add eax, 0x87baa2b
add eax, 0xf78455da
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x440b7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
and dword [ebp - 4], esi
push ebx
call dword [sym.imp.kernel32.dll_lstrlenA]
mov ecx, dword [0x46b874]
mov dword [ebp + 8], eax
cmp ecx, 0xffffffff
jne 0x440bb8
push edi
push ebx
push 0x46c6e8
call main
mov esi, eax
test esi, esi
js 0x440c0f
xor esi, esi
jmp 0x440c0f
test eax, eax
je 0x440c0f
push 0
lea edx, [ebp - 4]
sub eax, edi
push edx
push eax
lea eax, [edi + ebx]
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x440bed
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440beb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440bff
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp edi, eax
jae 0x440c0f
mov ecx, dword [0x46b874]
jmp 0x440bbc
push esi
push 0x310
push str.c:_agent_work138_s_srclibsdutillogutil.cpp
call fcn.004038f5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x1480058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14801a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x148007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x148006a
add dl, dl
jne 0x1480089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x14800dc
xor eax, eax
add dl, dl
jne 0x1480096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x148017d
add dl, dl
jne 0x14800a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14800b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14800bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14800c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x14800d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1480075
mov eax, 1
add dl, dl
jne 0x14800ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14800f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x14800e1
sub eax, ebx
mov ebx, 1
jne 0x1480128
mov ecx, 1
add dl, dl
jne 0x148010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1480119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1480105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1480075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x148013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x148014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1480136
cmp eax, 0x7d00
jae 0x148016d
cmp eax, 0x500
jb 0x1480168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1480075
cmp eax, 0x7f
ja 0x1480170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1480075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x148019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1480075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40111e
Capabilities:
Terminate process

Disassembly:
call section..text
push 0x5c
push 0x406428
call fcn.00401556
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x409050
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x4044f8
xor esi, esi
inc esi
mov eax, dword [0x40904c]
cmp eax, esi
je 0x404517
mov eax, dword [0x40904c]
test eax, eax
jne 0x401226
mov dword [0x40904c], esi
push 0x4062c4
push 0x4062bc
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x4045b2
mov eax, dword [0x40904c]
cmp eax, esi
jne 0x4011d1
push 0x4062b8
push 0x406298
call fcn.004df000
pop ecx
pop ecx
mov dword [0x40904c], 2
cmp dword [ebp - 0x20], ebx
jne 0x4011de
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x409054], ebx
jne 0x404524
mov eax, dword [sym.imp.MSVCR80.dll__wcmdln]
cmp dword [eax], ebx
je 0x4045b2
mov eax, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x40121a
cmp cx, 0x22
je 0x40454f
inc eax
inc eax
jmp 0x401200
cmp cx, bx
je 0x401231
cmp dword [ebp - 0x1c], ebx
je 0x401231
jmp 0x40120c
mov dword [0x409144], esi
jmp 0x4011ad
movzx ecx, word [eax]
cmp cx, bx
je 0x401df0
cmp cx, 0x20
ja 0x401df0
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x401231
test byte [ebp - 0x40], 1
jne 0x404546
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call 0x401e22
mov dword [0x409118], eax
cmp dword [0x409060], ebx
jne 0x40458f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
call fcn.00402273
ret 0x10
cmp eax, esi
jne 0x404507
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401174
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401160
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x4011ad
push 0x409054
call fcn.00404f3d
pop ecx
test eax, eax
je 0x4011ea
push ebx
push 2
push ebx
call dword [0x409054]
jmp 0x4011ea
movzx ecx, word [ebp - 0x3c]
jmp 0x401dfd
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x401216
cmp dword [0x409144], ebx
jne 0x40459d
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x409118]
jmp 0x4045be
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00401457
ret
Function at 0x402ea9
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004064d5
xor ebx, ebx
cmp eax, ebx
jne 0x402f8c
test byte [ebp + 0x10], 2
je 0x402f0a
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x402f71
lea eax, [ebp - 0x214]
push 0x105
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x402f46
test edi, edi
jne 0x402f71
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.00402ea9
test eax, eax
jne 0x402f4f
lea eax, [ebp - 0x214]
push 0x105
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x402f1f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406a35
test eax, eax
jne 0x402f81
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x402f8c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x402f8c
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x403371
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x40339c
mov ecx, dword [0x42a2b8]
push esi
add eax, ecx
push esi
push eax
mov dword [0x420ef4], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403479
cmp eax, esi
jl 0x403473
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp + 8]
add dword [0x420ef4], 4
call fcn.00403479
mov ebx, eax
cmp ebx, esi
jl 0x403471
cmp dword [ebp + 0x10], esi
jne 0x40343f
cmp dword [ebp + 8], esi
jle 0x403471
mov esi, 0x414ef0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403401
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.0040620a
test eax, eax
je 0x40343b
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x420ef4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4033f0
jmp 0x403471
push 0xfffffffffffffffe
jmp 0x403465
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40344a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403468
push 0xfffffffffffffffd
pop eax
jmp 0x403473
mov ebx, dword [ebp - 4]
add dword [0x420ef4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x4044db
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x404516
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4044fd
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40450e
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x404518
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4044f3
xor eax, eax
pop edi
pop esi
ret

Function at 0x40603f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.004044ab
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.0040440c
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x406413
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.0040449b
outsd dx, dword [esi]
loopne 0x40642a
inc dword [eax - 0x27c894]
mov ch, 0x60
cld
invalid
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ed0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x31803b05
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1ac9349d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43196e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x43197d
pop dword [ebp - 0x20]
mov eax, 0xcbca5a73
sub eax, 0xcb8740f6
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x396c0
push 0
mov eax, 0x73f723c8
add eax, 0x8c4c5c68
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x42db
xor ebx, ebx
add ebx, eax
mov esi, 0x44c600
add esi, dword [ebp - 0x20]
mov edi, 0xc32bf27b
sub edi, 0x88597291
add dword [ebp - 0xc], 0xe918a6c0
mov edx, dword [esi]
add dword [ebp - 0x1c], esi
xor edx, edi
add dword [ebp - 8], 0x3d923d0b
mov dword [ebx], edx
sub dword [ebp - 0x1c], 0xf0d1eaf8
add ebx, 0x7d6678ff
add ebx, 0x82998705
add esi, 0x47c00d0f
add esi, 0xb83ff2f5
loop 0x4319d2
add eax, 0xfe3f
xor ebx, ebx
add ebx, eax
add eax, 0x313e080a
sub eax, 0x313e0805
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4