joyce8/EMBER2024-capa huggingface dataset:
Function at 0x552a60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx]
test bl, 1
je 0x552a7d
mov ebp, dword [edx + 8]
mov ebx, dword [edx + 4]
mov edx, ebp
jmp 0x552a80
inc edx
shr ebx, 1
cmp ebx, 4
mov eax, ebx
mov ebp, ebx
mov dword [esp], edx
jb 0x552ad8
mov esi, dword [esp]
lea ebp, [ebx - 4]
mov edx, ebx
mov eax, ebx
mov dword [esp + 8], ebx
nop word [eax + eax]
imul ebx, dword [esi], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add edx, 0xfffffffc
add esi, 4
mov edi, ebx
shr edi, 0x18
xor edi, ebx
imul edi, edi, 0x5bd1e995
xor eax, edi
cmp edx, 3
ja 0x552aa0
mov edx, dword [esp]
mov ebx, dword [esp + 8]
mov esi, ebp
and esi, 0xfffffffc
sub ebp, esi
lea edx, [edx + esi + 4]
cmp ebp, 1
je 0x552afe
cmp ebp, 2
je 0x552af0
cmp ebp, 3
jne 0x552b0e
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
mov ebp, dword [esp]
shl esi, 8
xor eax, esi
jmp 0x552b01
mov ebp, dword [esp]
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x552b11
mov ebp, dword [esp]
mov edi, dword [ecx + 4]
test edi, edi
je 0x552c14
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
lea eax, [edi - 1]
test eax, edi
mov dword [esp], eax
je 0x552b48
cmp esi, edi
mov edx, esi
jb 0x552b4c
mov eax, esi
xor edx, edx
div edi
jmp 0x552b4c
mov edx, esi
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x552c14
mov dword [esp + 8], edi
mov edi, dword [eax]
mov eax, 0
test edi, edi
je 0x552c16
mov dword [esp + 4], edx
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x552bd0
movzx edx, byte [edi + 8]
mov eax, edx
shr eax, 1
test dl, 1
mov ecx, eax
je 0x552b89
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jne 0x552bf1
lea ecx, [edi + 8]
inc ecx
test dl, 1
je 0x552b99
mov ecx, dword [edi + 0x10]
jne 0x552bfd
test ebx, ebx
je 0x552c10
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edx, byte [edi + ecx + 9]
cmp dl, byte [ebp + ecx]
jne 0x552bf1
inc ecx
cmp eax, ecx
jne 0x552bb0
jmp 0x552c10
mov ecx, dword [esp + 8]
mov edx, dword [esp]
test edx, ecx
je 0x552be7
cmp eax, ecx
jb 0x552be9
xor edx, edx
div ecx
mov eax, edx
jmp 0x552be9
and eax, edx
mov ecx, dword [esp + 4]
cmp eax, ecx
jne 0x552c14
mov edi, dword [edi]
test edi, edi
jne 0x552b70
jmp 0x552c14
test ebx, ebx
je 0x552c10
push ebx
push ebp
push ecx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x552bf1
mov eax, edi
jmp 0x552c16
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x553430
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx]
test bl, 1
je 0x55344d
mov ebp, dword [edx + 8]
mov ebx, dword [edx + 4]
mov edx, ebp
jmp 0x553450
inc edx
shr ebx, 1
cmp ebx, 4
mov eax, ebx
mov ebp, ebx
mov dword [esp], edx
jb 0x5534a8
mov esi, dword [esp]
lea ebp, [ebx - 4]
mov edx, ebx
mov eax, ebx
mov dword [esp + 8], ebx
nop word [eax + eax]
imul ebx, dword [esi], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add edx, 0xfffffffc
add esi, 4
mov edi, ebx
shr edi, 0x18
xor edi, ebx
imul edi, edi, 0x5bd1e995
xor eax, edi
cmp edx, 3
ja 0x553470
mov edx, dword [esp]
mov ebx, dword [esp + 8]
mov esi, ebp
and esi, 0xfffffffc
sub ebp, esi
lea edx, [edx + esi + 4]
cmp ebp, 1
je 0x5534ce
cmp ebp, 2
je 0x5534c0
cmp ebp, 3
jne 0x5534de
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
mov ebp, dword [esp]
shl esi, 8
xor eax, esi
jmp 0x5534d1
mov ebp, dword [esp]
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x5534e1
mov ebp, dword [esp]
mov edi, dword [ecx + 4]
test edi, edi
je 0x5535e4
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
lea eax, [edi - 1]
test eax, edi
mov dword [esp], eax
je 0x553518
cmp esi, edi
mov edx, esi
jb 0x55351c
mov eax, esi
xor edx, edx
div edi
jmp 0x55351c
mov edx, esi
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x5535e4
mov dword [esp + 8], edi
mov edi, dword [eax]
mov eax, 0
test edi, edi
je 0x5535e6
mov dword [esp + 4], edx
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x5535a0
movzx edx, byte [edi + 8]
mov eax, edx
shr eax, 1
test dl, 1
mov ecx, eax
je 0x553559
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jne 0x5535c1
lea ecx, [edi + 8]
inc ecx
test dl, 1
je 0x553569
mov ecx, dword [edi + 0x10]
jne 0x5535cd
test ebx, ebx
je 0x5535e0
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edx, byte [edi + ecx + 9]
cmp dl, byte [ebp + ecx]
jne 0x5535c1
inc ecx
cmp eax, ecx
jne 0x553580
jmp 0x5535e0
mov ecx, dword [esp + 8]
mov edx, dword [esp]
test edx, ecx
je 0x5535b7
cmp eax, ecx
jb 0x5535b9
xor edx, edx
div ecx
mov eax, edx
jmp 0x5535b9
and eax, edx
mov ecx, dword [esp + 4]
cmp eax, ecx
jne 0x5535e4
mov edi, dword [edi]
test edi, edi
jne 0x553540
jmp 0x5535e4
test ebx, ebx
je 0x5535e0
push ebx
push ebp
push ecx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x5535c1
mov eax, edi
jmp 0x5535e6
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x553c50
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx]
test bl, 1
je 0x553c6d
mov ebp, dword [edx + 8]
mov ebx, dword [edx + 4]
mov edx, ebp
jmp 0x553c70
inc edx
shr ebx, 1
cmp ebx, 4
mov eax, ebx
mov ebp, ebx
mov dword [esp], edx
jb 0x553cc8
mov esi, dword [esp]
lea ebp, [ebx - 4]
mov edx, ebx
mov eax, ebx
mov dword [esp + 8], ebx
nop word [eax + eax]
imul ebx, dword [esi], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add edx, 0xfffffffc
add esi, 4
mov edi, ebx
shr edi, 0x18
xor edi, ebx
imul edi, edi, 0x5bd1e995
xor eax, edi
cmp edx, 3
ja 0x553c90
mov edx, dword [esp]
mov ebx, dword [esp + 8]
mov esi, ebp
and esi, 0xfffffffc
sub ebp, esi
lea edx, [edx + esi + 4]
cmp ebp, 1
je 0x553cee
cmp ebp, 2
je 0x553ce0
cmp ebp, 3
jne 0x553cfe
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
mov ebp, dword [esp]
shl esi, 8
xor eax, esi
jmp 0x553cf1
mov ebp, dword [esp]
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x553d01
mov ebp, dword [esp]
mov edi, dword [ecx + 4]
test edi, edi
je 0x553e04
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
lea eax, [edi - 1]
test eax, edi
mov dword [esp], eax
je 0x553d38
cmp esi, edi
mov edx, esi
jb 0x553d3c
mov eax, esi
xor edx, edx
div edi
jmp 0x553d3c
mov edx, esi
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x553e04
mov dword [esp + 8], edi
mov edi, dword [eax]
mov eax, 0
test edi, edi
je 0x553e06
mov dword [esp + 4], edx
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x553dc0
movzx edx, byte [edi + 8]
mov eax, edx
shr eax, 1
test dl, 1
mov ecx, eax
je 0x553d79
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jne 0x553de1
lea ecx, [edi + 8]
inc ecx
test dl, 1
je 0x553d89
mov ecx, dword [edi + 0x10]
jne 0x553ded
test ebx, ebx
je 0x553e00
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edx, byte [edi + ecx + 9]
cmp dl, byte [ebp + ecx]
jne 0x553de1
inc ecx
cmp eax, ecx
jne 0x553da0
jmp 0x553e00
mov ecx, dword [esp + 8]
mov edx, dword [esp]
test edx, ecx
je 0x553dd7
cmp eax, ecx
jb 0x553dd9
xor edx, edx
div ecx
mov eax, edx
jmp 0x553dd9
and eax, edx
mov ecx, dword [esp + 4]
cmp eax, ecx
jne 0x553e04
mov edi, dword [edi]
test edi, edi
jne 0x553d60
jmp 0x553e04
test ebx, ebx
je 0x553e00
push ebx
push ebp
push ecx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x553de1
mov eax, edi
jmp 0x553e06
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002aaee
pop dword [ebp - 0xc]
mov eax, 0x598146dc
add eax, 0xb6816412
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x5fc2aff5
add dword [ebp - 0x1c], 0xee8f9556
mov dword [ebp - 0x18], 0xf0dbdd5b
add dword [ebp - 0x18], 0x41576eea
mov dword [ebp - 0x14], 0x54007e80
sub dword [ebp - 0x14], 0x7b43a52
mov dword [ebp - 0x10], 0xbbb44e14
add dword [ebp - 0x10], 0x444bb1ec
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xc24de6c7
sub eax, 0xb24b268f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x3eacf78a
add dword [ebp - 0x1c], 0x35c571cc
mov dword [ebp - 0x18], 0xa0e409fa
add dword [ebp - 0x18], 0xa088577b
mov dword [ebp - 0x14], 0x42737a0b
add dword [ebp - 0x14], 0x20fbf261
mov dword [ebp - 0x10], 0xac2cdecf
add dword [ebp - 0x10], 0x53d32131
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xdd81acdd
sub eax, 0xcd7eecb5
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x36770
push 0
call eax
mov ecx, 0xa49623ea
sub ecx, 0xa495dbed
mov esi, eax
mov edi, 0x4725e628
add edi, 0xc8ddafd8
add edi, dword [ebp - 0xc]
mov edx, 0x6562378b
add edx, 0xf189b5c5
add dword [ebp - 4], ebx
mov ebx, dword [edi]
sub dword [ebp - 8], 0xa5da090f
add ebx, edx
xor dword [ebp - 8], 0x9af641bd
mov dword [esi], ebx
add dword [ebp - 8], 0x91799225
add esi, 4
add edi, 4
loop 0x1002ac10
add eax, 0x4dadc017
sub eax, 0x4dacad50
xor ebx, ebx
add ebx, eax
add eax, 0x76dc5bf5
add eax, 0x8923a410
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408afe
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408afe
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408afe
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408afe
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408afe
mov dword [0x41203c], eax
call fcn.00408afe
test eax, eax
jge 0x402550
push 8
call fcn.00408afe
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408afe
pop ecx
push 1
call fcn.00408afe
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408afe
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408afe
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408afe
jmp 0x402495

Function at 0x408afe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x408b0d
pop dword [ebp - 0x4c]
mov eax, 0x4b932e4
add eax, 0xfb875829
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3c2fc
push 0
mov eax, 0xa0d4ee7e
sub eax, 0xa0940da6
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x53f1
xor edx, edx
add edx, eax
mov ebx, 0x1853183b
sub ebx, 0x1811dc77
add ebx, dword [ebp - 0x4c]
mov edi, 0xe1ca34a1
sub edi, 0x9311521f
add dword [ebp - 0x40], 0x4466ffea
mov esi, dword [ebx]
xor dword [ebp - 0x34], eax
xor esi, edi
add dword [ebp - 0x28], 0xf286a199
mov dword [edx], esi
add dword [ebp - 0x40], 0xab695a8a
add edx, 0xe788df37
sub edx, 0xe788df33
add ebx, 0x94d14c60
sub ebx, 0x94d14c5c
loop 0x408b68
add eax, 0x9fea0a57
add eax, 0x60173840
mov ebx, eax
add eax, 0xabff52fa
add eax, 0x5400ad0b
mov ecx, 0xb913878c
sub ecx, 0xb8d3878c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x425685
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e6cf
and dword [ebp - 4], 0
cmp dword [0x4501f0], 0
mov ebx, eax
jne 0x425736
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4257e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4257e7
push eax
call fcn.0041e65d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4501f0], eax
call esi
push eax
call fcn.0041e65d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4501f4], eax
call esi
push eax
call fcn.0041e65d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4501f8], eax
call esi
push eax
call fcn.0041e65d
pop ecx
mov dword [0x450200], eax
test eax, eax
je 0x425736
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e65d
pop ecx
mov dword [0x4501fc], eax
mov eax, dword [0x4501fc]
cmp eax, ebx
je 0x42578e
cmp dword [0x450200], ebx
je 0x42578e
push eax
call fcn.0041e6d8
push dword [0x450200]
mov esi, eax
call fcn.0041e6d8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42578e
test edi, edi
je 0x42578e
call esi
test eax, eax
je 0x425785
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425785
test byte [ebp - 0xc], 1
jne 0x42578e
or dword [ebp + 0x10], 0x200000
jmp 0x4257c7
mov eax, dword [0x4501f4]
cmp eax, ebx
je 0x4257c7
push eax
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4257c7
mov eax, dword [0x4501f8]
cmp eax, ebx
je 0x4257c7
push eax
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4501f0]
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4257e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405538
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x40553a
ret

Function at 0x4062e9
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + 0x301c]
mov edx, dword [ebp - 0x5e]
sahf
push edx
or al, 0x8d
xor al, 0xf
cmp edx, dword [esi + 0xc]
jne 0x406288
inc ebx
add al, 0xeb
adc dl, al
cmp al, 0xb
mov ecx, 0xbd0005
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
add ebx, 0x14
mov ecx, dword [ebp]
mov edi, es
adc al, 0x49
mov dword [eax], eax
xchg byte [edi + 0x4d], bl
cld
jne 0x40626f
ret 0xb3c
mov edi, dword [ebp - 8]
mov edx, dword [eax + 0xc]
and ecx, ecx
test edx, edx
jbe 0x4062e1
lea edx, [eax + edx]
stosd dword es:[edi], eax
je 0x4062c4
retf
dec edx
cmp ecx, edx
jae 0x4062de
lea edx, [eax + ecx*4 + 0x10]
mov esi, dword [edx + 4]
inc ecx
push ecx
xor cl, byte [ebx + 0x77830c61]
add al, 0x4e
or al, 0x83
ja 0x4062dd
dec esi
cmp ecx, esi
jb 0x40627a
pushfd
dec dword [eax + 0xc]
mov edx, dword [eax + 0x2f9f10]
xor esp, dword [ebp + eax*4 + 0x35]
invalid
invalid
jbe 0x406327
test dword [0xb08d3a76], esi
adc al, 0x10
add byte [eax], al
lea esi, [eax + 0x1014]
cmp dword [esi], edi
fisttp word [edx]
inc ecx
add esi, 4
pop ebx
test eax, 0x26ebf472
dec edx
cmp ecx, edx
sbb dword [ebx], ebx
lea edx, [esi + ebp*8 + 0xaf10cb]
mov esi, dword [edx + 4]
test al, 0x89
xor cl, byte [ebx + 0x108db0]
add byte [ebx - 0xdb1fb3e], al
push es
jb 0x40630d
call dword [ecx + 0x10]
adc byte [eax], al
add byte [ebx + 0x201490], cl
add al, 0x33
leave
mov edx, dword [eax + 0x4002014]
xor ecx, ecx
test edx, edx
mov edi, 0x18bf8d54
dec esi
add byte [eax], al
stosd dword es:[edi], eax
je 0x4062d5
inc ecx
add esi, 4
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x38e9645f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x413f6c43
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4193d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4193e3
pop dword [ebp - 0x3c]
mov eax, 0x2d8348a9
add eax, 0xd2be4b3a
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x53e39
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x3f862b96
sub ecx, 0x3f85d4b7
xor esi, esi
add esi, eax
mov edx, 0x488e00
add edx, dword [ebp - 0x3c]
mov edi, 0x4e9b296
mov dword [ebp - 0x24], 0x252373c2
mov ebx, dword [edx]
add ebx, edi
sub dword [ebp - 4], esi
mov dword [esi], ebx
xor dword [ebp - 0x10], 0xc6e4d87a
add esi, 0x5ab90737
add esi, 0xa546f8cd
add edx, 0x660983b5
add edx, 0x99f67c4f
loop 0x419433
add eax, 0xd94c1d85
add eax, 0x26b530ca
mov ebx, eax
add eax, 5
mov ecx, 0xb896005
sub ecx, 0xb496005
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402ac5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x446fb0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b59
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b16
cmp dword [ebp + 0x10], ebx
jne 0x402b4d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402ac5
test eax, eax
jne 0x402b28
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405c29
cmp eax, ebx
je 0x402b60
push ebx
push dword [0x446fb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b59
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x446fb0], ebx
jne 0x402b56
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b56
jmp 0x402b59