joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ebb79
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x4ebbef
test eax, eax
je 0x4ebbbb
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.004ccab0
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x4ebbbb
push 0x3a
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.004b74e0
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x4ebbeb
cmp edi, 0x40a
je 0x4ebbe2
cmp edi, 0x43f
je 0x4ebbe2
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ebbe7
mov eax, 0x20
cmp esi, eax
je 0x4ebbef
push 0x40
jmp 0x4ebba0
push ebx
push 0x45
push str.cryptoececx_meth.c
push 0x40
call fcn.004b8220
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4ebc25
push 0x47
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.004b74e0
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x4ebc3d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call fcn.0047c750
add esp, 0xc
jmp case.0x4ebd6e.1036
cmp edi, 0x40a
je 0x4ebc5d
cmp edi, 0x43f
je 0x4ebc5d
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ebc62
mov eax, 0x20
push 0x4f
push str.cryptoececx_meth.c
push eax
call fcn.004cbff0
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x4ebc95
push 0x51
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.004b74e0
add esp, 0x14
jmp 0x4ebce8
cmp ebp, 2
jne 0x4ebd28
cmp edi, 0x40a
je 0x4ebcbe
cmp edi, 0x43f
je 0x4ebcbe
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ebcc3
mov eax, 0x20
push eax
push esi
call fcn.004d3af0
add esp, 8
test eax, eax
jg 0x4ebcfe
push 0x56
push str.cryptoececx_meth.c
push esi
call fcn.004cc010
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x78
push str.cryptoececx_meth.c
push ebx
call fcn.004b8290
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x4ebd17
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x4ebd5c
cmp edi, 0x40b
jne 0x4ebd5c
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x4ebd5c
cmp edi, 0x40a
je 0x4ebd48
cmp edi, 0x43f
je 0x4ebd48
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ebd4d
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.0047c750
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x4ebd6e.1036
movzx ecx, byte [eax + 0x4ebdc8]
jmp dword [ecx*4 + 0x4ebdb4]
push esi
push ebx
call fcn.0053a680
jmp 0x4ebd97
push esi
push ebx
call fcn.0053a560
jmp 0x4ebd97
push esi
push ebx
call fcn.0052cd50
jmp 0x4ebd97
push esi
push ebx
call fcn.0052a8e0
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.004bc240
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x4fab25
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.004ca6a0
add esp, 0xc
test eax, eax
jne 0x4fab25
xor eax, eax
ret
push 0
push 0x62f834
call fcn.004c0e50
add esp, 8
test eax, eax
je 0x4fab22
push ebx
push 0
push 0x62f838
call fcn.004c0e50
add esp, 8
test eax, eax
je 0x4fabb2
mov eax, dword [0x62f844]
mov ecx, dword [0x62ac38]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.004fa8f0
mov esi, eax
add esp, 8
test esi, esi
je 0x4fab9a
push esi
call fcn.004fa7a0
add esp, 4
test eax, eax
jne 0x4fab87
push esi
call fcn.004f9bb0
add esp, 4
xor esi, esi
jmp 0x4fab9a
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
push esi
mov dword [esi + 0x58], ebx
call fcn.004f9c20
add esp, 0xc
mov dword [0x62f83c], esi
test esi, esi
pop esi
jne 0x4fabc3
push 0x62f838
call fcn.004c0ec0
add esp, 4
push 0x62f834
call fcn.004c0ec0
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x4fba10
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.0047dba0
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4fba85
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4fba85
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call fcn.00488645
add esp, 0x10
test eax, eax
jns 0x4fba68
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4fbbce
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4fba90
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0047ccb0
mov esi, esp
test esi, esi
jne 0x4fbab4
mov esi, str.no_stack_
jmp 0x4fbb3f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4fbae1
test edi, edi
je 0x4fbae1
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x4fbad0
xor eax, eax
test edi, edi
je 0x4fbb3f
cmp word [esi + eax*2], 0x25
jne case.0x4fbb04.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x4fbb04.43
movzx edx, byte [edx + 0x4fbc00]
jmp dword [edx*4 + 0x4fbbe8]
inc eax
add ecx, 2
jmp 0x4fbaf2
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x4fbb04.43
mov edx, 0x73
jmp 0x4fbb35
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x4fbb04.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x4fbae7
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.00479e79
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4fbbb8
call fcn.004fb8d0
test eax, eax
jle 0x4fbbb8
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4fbbce
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x4fbbce
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478c25
mov esp, ebp
pop ebp
ret
Function at 0x505b20
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
push 1
push edi
call fcn.004d32c0
mov ebx, eax
push ebx
push edi
call fcn.004d33b0
add esp, 0x10
test eax, eax
je 0x505b6e
push esi
push 2
push ebx
push eax
xor esi, esi
push esi
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x505b51
mov esi, ebx
lea eax, [esi*8]
push eax
push esi
push edi
call fcn.004d33f0
push edi
call fcn.004d3280
add esp, 0x10
pop esi
test eax, eax
jne 0x505b77
push edi
call fcn.004d3280
add esp, 4
pop edi
pop ebx
ret

Function at 0x513030
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x516260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x516288
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x516290
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x516274
test esi, esi
je case.0x51634e.2
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x5162d7
cmp esi, 1
jbe case.0x51634e.2
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x5162d7
cmp esi, 2
jbe case.0x51634e.2
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x5162d7
cmp esi, 3
jbe case.0x51634e.2
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle case.0x51634e.2
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x516300
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x516300
inc edx
inc eax
cmp edx, edi
jl 0x5162f3
lea eax, [edi - 1]
test eax, eax
js 0x51631f
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
mov edi, edi
cmp byte [ecx + esi], 0
jne 0x51631f
cmp byte [ecx], 0xff
jne 0x51631f
dec ecx
dec eax
jns 0x516310
cmp edx, eax
jl case.0x51634e.2
jle 0x516330
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x51634e.2
movzx ecx, byte [ecx + 0x5163c0]
jmp dword [ecx*4 + 0x5163a0]
mov esi, 7
jmp 0x516384
mov esi, 6
jmp 0x516384
mov esi, 5
jmp 0x516384
mov esi, 4
jmp 0x516384
mov esi, 3
jmp 0x516384
mov esi, 2
jmp 0x516384
mov esi, 1
test byte [esp + 0x10], al
jne case.0x51634e.2
and bl, al
cmp bl, al
jne case.0x51634e.2
lea eax, [esi + edx*8]
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x52ab90
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push ebp
lea ecx, [ebx + 0xc]
push esi
lea eax, [edx + 4]
sub ebx, edx
mov ebp, 4
mov esi, dword [eax - 4]
mov edx, dword [ecx - 0xc]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax - 4], esi
xor dword [ecx - 0xc], edx
mov esi, dword [eax]
mov edx, dword [ebx + eax]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax], esi
xor dword [ebx + eax], edx
mov esi, dword [eax + 4]
mov edx, dword [ecx - 4]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 4], esi
xor dword [ecx - 4], edx
mov esi, dword [eax + 8]
mov edx, dword [ecx]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 8], esi
xor dword [ecx], edx
add eax, 0x10
add ecx, 0x10
dec ebp
jne 0x52aba2
pop esi
pop ebp
pop ebx
ret
Function at 0x53a560
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x15c
call fcn.0047dba0
mov eax, dword [0x629214]
xor eax, esp
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x164]
push esi
mov esi, dword [esp + 0x164]
lea ecx, [esp + 0x11c]
push ecx
push 0x20
push eax
call fcn.00514090
mov dl, byte [esp + 0x147]
and byte [esp + 0x128], 0xf8
and dl, 0x3f
lea eax, [esp + 0x88]
or dl, 0x40
push eax
lea ecx, [esp + 0x12c]
mov byte [esp + 0x14b], dl
call fcn.00532620
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0xe0]
call fcn.0052f920
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x98]
call fcn.0052d660
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x74]
push edx
lea ecx, [esp + 0xc8]
call fcn.0052d660
push esi
lea ecx, [esp + 0x7c]
call fcn.0052d290
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x58]
call fcn.0052d290
mov cl, byte [esp + 0x30]
lea edx, [esp + 0x148]
shl cl, 7
xor byte [esi + 0x1f], cl
push 0x40
push edx
call fcn.004cc050
mov ecx, dword [esp + 0x190]
add esp, 0x34
pop esi
xor ecx, esp
call fcn.00478c25
add esp, 0x15c
ret
Function at 0x53a680
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x140
call fcn.0047dba0
mov eax, dword [0x629214]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x154]
push edi
mov ecx, 8
lea edi, [esp + 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x148]
and byte [esp + 0x12c], 0xf8
shr ecx, 0x18
and cl, 0x3f
or cl, 0x40
lea edx, [esp + 0x3c]
mov byte [esp + 0x14b], cl
push edx
lea ecx, [esp + 0x130]
mov dword [esp + 0x14], eax
call fcn.00532620
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebx, dword [esp + 0x78]
add ecx, eax
sub eax, dword [esp + 0x68]
mov dword [esp + 0xe0], ecx
mov ecx, dword [esp + 0x94]
add edx, ecx
mov dword [esp + 0xe4], edx
mov edx, dword [esp + 0x98]
add esi, edx
mov dword [esp + 0xe8], esi
mov esi, dword [esp + 0x9c]
add edi, esi
mov ebp, dword [esp + 0x8c]
mov dword [esp + 0xec], edi
mov edi, dword [esp + 0xa0]
add ebx, edi
mov dword [esp + 0xf0], ebx
mov ebx, dword [esp + 0xa4]
add ebx, dword [esp + 0x7c]
sub ecx, dword [esp + 0x6c]
sub edx, dword [esp + 0x70]
sub esi, dword [esp + 0x74]
sub edi, dword [esp + 0x78]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x7c]
mov dword [esp + 0xf4], ebx
mov ebx, dword [esp + 0xa8]
add ebx, dword [esp + 0x80]
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0xa8]
sub eax, dword [esp + 0x80]
mov dword [esp + 0xf8], ebx
mov ebx, dword [esp + 0xac]
add ebx, dword [esp + 0x84]
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0xac]
sub eax, dword [esp + 0x84]
mov dword [esp + 0xfc], ebx
mov ebx, dword [esp + 0xb0]
add ebx, dword [esp + 0x88]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0xb0]
sub eax, dword [esp + 0x88]
mov dword [esp + 0x100], ebx
mov ebx, dword [esp + 0xb4]
add ebp, ebx
sub ebx, dword [esp + 0x8c]
mov dword [esp + 0x128], eax
mov dword [esp + 0x104], ebp
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], edi
mov dword [esp + 0x12c], ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10c]
call fcn.0052f920
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xe8]
push edx
mov ecx, edx
call fcn.0052d660
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0xf0]
call fcn.0052d290
lea ecx, [esp + 0x140]
push 0x20
push ecx
call fcn.004cc050
mov ecx, dword [esp + 0x168]
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00478c25
add esp, 0x140
ret
Function at 0x54c2af
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0047dba0
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
mov dword [esp + 0xc], 0x10
mov eax, ebp
sub esi, ebp
mov edi, 4
jmp 0x54c2d0
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec edi
jne 0x54c2d0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0x10
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push edx
call fcn.004d1fb0
add esp, 0x14
pop edi
pop esi
pop ebp
test eax, eax
je 0x54c320
cmp dword [esp], 0x10
jne 0x54c320
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x58efd7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0047dba0
mov eax, dword [0x629214]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0x58f13a
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.004b02d0
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.004b03d0
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004b3b60
push ebp
call fcn.004b02d0
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.004b03d0
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.004b3b60
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0x58eff3
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.00478c25
add esp, 0xa0
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x240b3af9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5b0547c2
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x408900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x431860]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
lea eax, [ebp - 0x154]
push 0
push eax
mov dword [ebp - 0x158], 0x44
call fcn.00411940
add esp, 0xc
xor eax, eax
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x158]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov dword [ebp - 0x12c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
call fcn.004088e0
int3

Function at 0x408990
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x431860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x103
lea eax, [ebp - 0x12f]
push 0
push eax
mov bl, dl
mov esi, ecx
mov byte [ebp - 0x130], 0
call fcn.00411940
mov al, byte [0x42cfac]
movq xmm0, qword [str.pgH0BwW]
add esp, 0xc
mov byte [ebp - 0x1c], al
xor eax, eax
push str.X:.Trash_100
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
movq qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x130]
xorps xmm0, xmm0
push 0x104
push eax
movq qword [ebp - 0x13], xmm0
call fcn.0040e059
add esp, 0xc
lea eax, [ebp - 0x130]
push str.ctfmon.exe
push 0x104
push eax
call fcn.0040e331
lea edx, [ebp - 0x24]
add esp, 0xc
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x408a34
lea eax, [ebp - 0x14]
sub edx, ecx
push 0x10
push eax
lea ecx, [ebp - 0x24]
call fcn.004056c0
push 0x432f58
push esi
call fcn.0040e530
add esp, 0x10
cmp eax, esi
jne 0x408a65
test bl, bl
jne 0x408af4
push 0x42cd84
push esi
call fcn.0040e530
add esp, 8
lea ecx, [eax + 1]
lea edx, [ebp - 0x130]
call fcn.0040a9b0
test al, al
je 0x408af4
push ecx
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x130]
call fcn.0040b840
add esp, 4
test eax, eax
jne 0x408b04
push 0x40
push eax
lea eax, [ebp - 0x174]
push eax
mov dword [ebp - 0x178], 0x44
call fcn.00411940
add esp, 0xc
xor eax, eax
mov word [ebp - 0x148], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x178]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
push 0
mov dword [ebp - 0x14c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408b14
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040cdaf
mov esp, ebp
pop ebp
ret
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408900
call fcn.004088e0
int3
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0xaa4370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xaa438e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xacd074
push ecx
mov edi, eax
call fcn.00ab8198
mov esi, eax
add esp, 8
test esi, esi
jne 0xaa43cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00ab802e
push esi
call fcn.00ab7fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret