joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e4a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1394
call fcn.10062960
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.10061046
mov dword [esp + 0x139c], 0xffffffff
mov esi, 1
mov dword [esp + 0x1c], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [esp + esi*4 + 0x1c], eax
inc esi
cmp esi, 0x270
jl 0x1005e4d0
cmp ebx, 0x80000000
mov dword [esp + 0x18], 0x270
lea eax, [ebx - 0x80000000]
lea ecx, [ebx - 0x80000000]
cmovae ecx, eax
lea esi, [edi - 0x80000000]
cmp edi, 0x80000000
mov dword [esp + 0x14], ecx
lea eax, [edi - 0x80000000]
cmovae esi, eax
sub esi, ecx
cmp esi, 0xffffffff
jne 0x1005e536
lea ecx, [esp + 0x18]
call fcn.1005f8d0
mov edx, eax
jmp 0x1005e579
lea ebx, [esi + 1]
mov dword [esp + 0x10], ebx
jmp 0x1005e543
lea ebx, [esi + 1]
xor edi, edi
xor eax, eax
test esi, esi
je 0x1005e559
lea ecx, [esp + 0x18]
call fcn.1005f8d0
mov edi, eax
or eax, 0xffffffff
xor edx, edx
div ebx
mov ecx, eax
mov ebx, edx
xor edx, edx
mov eax, edi
div dword [esp + 0x10]
cmp eax, ecx
jb 0x1005e571
cmp ebx, esi
jne 0x1005e540
mov eax, edi
xor edx, edx
div dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, edx
pop edi
cmp ecx, 0x80000000
pop esi
lea edx, [ecx - 0x80000000]
lea eax, [ecx - 0x80000000]
cmovae eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005ebf0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
xor eax, eax
movups xmm0, xmmword [str.0123456789abcdef]
mov al, byte [0x100a1440]
lea esi, [ebx + 1]
push esi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x24], al
call fcn.10061c92
push edi
push esi
push eax
mov dword [ebp - 0x10], eax
call fcn.10070864
add esp, 0x10
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push 0
push ebx
mov ebx, dword [ebp - 0x10]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x10
push eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edi, dword [ebp - 0xc]
xor esi, esi
test edi, edi
je 0x1005ecc7
xor edx, edx
nop dword [eax]
movzx ecx, byte [ebp + esi - 0x20]
lea edx, [edx + 2]
mov eax, ecx
inc esi
shr eax, 4
and ecx, 0xf
movzx eax, byte [ebp + eax - 0x34]
mov byte [ebp + edx - 0x5a], al
movzx eax, byte [ebp + ecx - 0x34]
mov byte [ebp + edx - 0x59], al
cmp esi, edi
jb 0x1005eca0
lea ecx, [ebp - 0x58]
mov edx, 0x20
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005ecd2
sub ecx, esi
cmp ecx, edx
jbe 0x1005ecfd
nop
lea eax, [ebp - 0x58]
mov byte [ebp + edx - 0x58], 0
inc edx
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005ecf0
sub eax, esi
cmp edx, eax
jb 0x1005ece0
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10070864
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 1
push ebx
call fcn.10061b63
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005ed40
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push edi
mov edi, edx
mov ebx, ecx
xor eax, eax
push 0x80
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1005ee3e
lea ecx, [ebp - 0x88]
xor edx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005ed77
sub ecx, esi
je 0x1005edad
cmp byte [ebp + edx - 0x88], 0x5c
jne 0x1005ed94
mov byte [ebp + edx - 0x87], 0
lea eax, [ebp - 0x88]
inc edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005eda0
sub eax, esi
cmp edx, eax
jb 0x1005ed82
push 0x105
lea eax, [ebp - 0x40c]
push eax
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x105
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
pop esi
test eax, eax
je 0x1005ee3e
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x1005ee3e
push 0x309
push dword [ebp - 4]
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x304]
push str._s_d_d
push eax
call fcn.10050480
push edi
push 0
push ebx
call fcn.10063ea0
lea edx, [ebp - 0x304]
add esp, 0x20
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1005ee25
sub edx, ecx
lea ecx, [ebp - 0x304]
push edi
push ebx
call fcn.1005ebf0
add esp, 8
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005ef80
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
mov al, dl
mov byte [ebp - 1], al
movsx eax, al
push esi
mov esi, dword [ebx + 8]
push edi
movd xmm0, eax
lea edi, [ecx + 2]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movaps xmmword [ebp - 0x20], xmm0
test esi, esi
jne 0x1005eea3
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1005ee97
sub esi, ecx
mov dword [ebx + 8], esi
lea eax, [esi + 1]
push eax
call fcn.10061c92
mov ecx, eax
add esp, 4
xor edx, edx
mov dword [ebp - 0xc], ecx
mov byte [ecx + esi], 0
test esi, esi
jle 0x1005ef6c
cmp esi, 0x40
jb 0x1005ef41
lea eax, [edi - 1]
add eax, esi
cmp ecx, eax
ja 0x1005eed9
lea eax, [ecx - 1]
add eax, esi
cmp eax, edi
jae 0x1005ef41
mov eax, esi
and eax, 0x8000003f
jns 0x1005eee7
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm1, xmmword [ebp - 0x20]
mov dword [ebp - 8], esi
mov esi, edi
sub dword [ebp - 8], eax
sub esi, ecx
mov dword [ebp - 0x10], esi
mov eax, ecx
mov esi, dword [ebx + 8]
mov ecx, dword [ebp - 0x10]
movups xmm0, xmmword [ecx + eax]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [edi + edx + 0x10]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [edi + edx + 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [edi + edx + 0x30]
add edx, 0x40
pxor xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
cmp edx, dword [ebp - 8]
jl 0x1005ef00
mov ecx, dword [ebp - 0xc]
cmp edx, esi
jge 0x1005ef6c
sub edi, dword [ebp - 0xc]
add ecx, edx
sub esi, edx
mov dl, byte [ebp - 1]
nop
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x1005ef50
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
pop ebp
jmp 0x1005ee50
Function at 0x1005f8d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x1005f92e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x1005f8f0
mov eax, dword [edi]
jmp 0x1005fa19
cmp eax, 0x4e0
jb 0x1005fa19
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x1005f950
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x1005f9a0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007768b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007733c

Function at 0x10077696
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100774c6

Function at 0x1007914d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100790cf
Function at 0x4014eb
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x28], 1
push eax
push 0x104
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
xor edi, edi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x40155a
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret

Function at 0x401588
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x403040
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4015a2
pop esi
ret
push edi
push 2
push 0xffffffffffffffd0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov edi, dword [esp + 0x1c]
push 0xc
pop ecx
xor eax, eax
push esi
push 0x30
rep stosd dword es:[edi], eax
push 1
pop edi
push edi
push dword [esp + 0x28]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x30
je 0x4015d4
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x4015e1
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
push dword [esp + 0x1c]
shr ecx, 2
push dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x10
cmp eax, 0xffffffff
je 0x401632
push dword [esp + 0x10]
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x40163e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
jmp 0x401640
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x43b64d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
add ebx, 0x4a9cf3bc
inc esi
call fcn.0043b69b
inc esi
xor dword [eax], edi
push ebx
pop esi
inc esi
inc eax
add esi, 1
sub ebx, 0x36cb26b7
add esi, 0x640b0dac
cmp eax, ecx
jne fcn.0043b64d
add ebx, 0x1dd29295
add esi, 0x20f4086c
inc esi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..retplne
mov ebx, 0x40de38
nop
nop
mov ecx, 0x24f82598
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2dd1185e
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x432002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x7c924414
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x17d02339
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x440f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3a000]
push edi
jmp 0x440f9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440f90
mov eax, 1
add ebx, ebx
jne 0x440fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440fa8
jne 0x440fc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440fa8
xor ecx, ecx
sub eax, 3
jb 0x440fd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44104a
mov ebp, eax
add ebx, ebx
jne 0x440fe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x440ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x441014
inc ecx
add ebx, ebx
jne 0x441000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x440ff5
jne 0x441011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440ff5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x441034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x441025
jmp 0x440f96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x441034
add edi, ecx
jmp 0x440f96
pop esi
mov edi, esi
mov ecx, 0x2c3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x441052
cmp byte [edi], 0
jne 0x441052
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x441057
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x4410c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x413bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x41428]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x441084
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41430]
or eax, eax
je 0x4410c0
mov dword [ebx], eax
add ebx, 4
jmp 0x4410a1
call dword [esi + 0x4142c]
mov ebp, dword [esi + 0x41434]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4410fa
sub esp, 0xffffff80
jmp 0x407d20
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4a5f4d4d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x10456d34
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x7ffe5476
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
stc
call 0x7ffe5482
pop edx
and al, 0xff
xor dx, dx
cld
add edx, 0xd5e0
xor ecx, ecx
and bh, 0xff
mov cl, 0x1e
push es
pop ds
xor byte [ecx + edx], 0x59
loop 0x7ffe5498
clc
push dword fs:[0x24]
pop dword [edx + 0xa]
clc
push eax
pop eax
mov cl, 0xff
and al, 0xff
push edx
loop 0x7ffe54b0
stc
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
push eax
pop eax
cld
mov dword [edx + 0x1b], ecx
add al, 0
mov dword [edx + 0x100], ecx
cld
mov dword [eax + 0x2c], esp
push 0
clc
inc esi
dec esi
push 0
inc esi
dec esi
push 0
cld
push 0
push 0x30
inc esi
dec esi
cld
push 0x20
add al, 0
push 0
nop
push 0
add edx, 0xffff7f37
and bh, 0xff
push edx
push eax
pop eax
push edx
nop
push 0
call dword [edx + 0x820c]
inc esi
dec esi
stc
add esp, 0x3f8
and al, 0xff
xor eax, eax
clc
inc eax
ret 0xc
Function at 0x415f40
Capabilities:
Encode data using xor

Disassembly:
wait
cmc
dec ebp
lodsb al, byte [esi]
and ecx, esp
outsd dx, dword [esi]
fld qword [ebx - 0x6ab205aa]
popal
mov word [ebp - 0x22e666a5], es
cmpsd dword [esi], dword es:[edi]
dec ebx
cwde
mov ss, ebp
fcomp dword [edx - 0x5871419e]
vhsubps xmm1, xmm4, xmmword [ebx + 0x1d818207]
into
and cl, bh
fiadd word [eax + 0x70]
movsb byte es:[edi], byte [esi]
inc esi
pop edx
push edx
xchg dword [0xc2b4ea74], ecx
xchg esp, eax
and edi, edx
sbb byte [ecx - 0x43f9bcd1], dh
dec edx
cdq
cmpsd dword [esi], dword es:[edi]
loope 0x415fb2
sahf
mov dl, 0x1b
pop ecx
je 0x415f84
inc esp
notrack jmp 0x416005
fisttp word [eax]
xor esi, ecx
xor byte [esi + 0x70], 0xf8
add dword [ebp - 0x42], ecx
cmc
lahf
cmc
sub edx, eax
xchg esi, eax
dec esi
loope 0x415f87
push 0x197e9b3f
push cs
dec eax
invalid
in al, 0x4a
dec esi
sal byte [ecx - 0xca64f10], cl
push esp
sahf
inc edx
shr byte [eax + 0x43], 0xcd
jno 0x416017
and al, 0x3f
cmpsd dword [esi], dword es:[edi]
jecxz 0x41607c
sti
xchg ecx, eax
cld
adc bl, dh
aas
fild dword [eax - 0x7205c20a]
outsd dx, dword [esi]
cmc
push ss
fisub dword [ebx - 0x7e3f4f37]
pushfd
add dword [ebp - 0xbcf527b], esp
daa
outsb dx, byte [esi]
xlatb
lodsb al, byte [esi]
imul edx, ebx, 0x640b2bc9
or al, 0x66
std
and al, 0x99
sub al, 0x35
sbb eax, 0x8c2164a4
retf
mov ch, byte [eax]
sub ah, bl
add al, ah
inc esi
adc ebx, dword [eax + esi*8 + 0x32]
into
stosd dword es:[edi], eax
imul edx, dword [edi + 0x6a8d354b], 0x7aabe860
push es
js 0x416045
sbb dword [esi - 0x1b], ebp
cmpsd dword [esi], dword es:[edi]
push 0xffffffffffffffbe
dec eax
nop
push 0xffffffffffffff93
mov esi, 0xb7dc5d2f
mov ebx, 0xbc08c80b
pop edx
wait
or eax, 0x713495e7
mov esp, 0xe70d9b5a
xchg ebp, eax
xor al, 0x71
push ecx
mov dword [0x382ac34d], eax
int 0xb4
movsd dword es:[edi], dword [esi]
push cs
push ebx
jp 0x416075
jno 0x4160a2
lodsb al, byte [esi]
sbb esi, dword [ecx + 0x25b6a0e7]
mov ah, ch
push eax
adc esp, dword [eax + 0x79]
invalid
Function at 0x4024d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040e0ab

Function at 0x402500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402559
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402559
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40254a
cmp esi, edx
jae 0x402559
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402538
cmp esi, edx
jae 0x402559
cmp word [esi], 0
je 0x402559
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x408080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov edx, edi
mov dword [ebp - 4], ecx
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x408094
sub edx, ecx
sar edx, 1
imul eax, edx, 6
add eax, 2
push eax
call fcn.0040abe1
mov esi, eax
pop ecx
test esi, esi
je 0x40816f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
cmp eax, 1
jne 0x4080f8
xor eax, eax
mov ecx, esi
mov word [esi], ax
sub ecx, edi
movzx eax, word [edi]
mov word [ecx + edi], ax
lea edi, [edi + 2]
test ax, ax
jne 0x4080d1
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4080e5
sub ecx, edx
sar ecx, 1
add ecx, ecx
jmp 0x40814f
cmp eax, 2
jne 0x408138
mov ecx, edi
mov byte [esi], bl
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x408104
sub ecx, edx
sar ecx, 1
push ebx
imul eax, ecx, 6
push ebx
inc eax
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40812f
jmp 0x40814d
mov edx, edi
mov ecx, esi
call fcn.00407d83
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408146
sub ecx, edx
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x408168
push ebx
lea eax, [ebp + 0xc]
push eax
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
push esi
call fcn.0040abdc
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8