joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
pop esp
jae 0x4153cc
inc ebp
rcr dword [eax], cl
invalid
outsd dx, dword [esi]
xor dword [edi], esi
xchg byte [eax - 0x11e1df31], dl
inc ebp
fidiv dword [ebx + 0x3a]
and byte [edi - 0xd], ah
rcr dword [ebx + 0x5d3ab87b], cl
jnp 0x41539a
cmp bl, byte [ebp + 0x2b]
sar dword [esi - 0x48cfd126], 1
jnp 0x41539a
cmp bl, byte [ebp + 0x2b]
sar dword [esi - 0x48cfd126], 1
dec ebx
cmp al, 0x72
fcompi st(1)
fcomp st(1)
test dword [edi], esp
ror dh, 1
invalid
Function at 0x45b132
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebx - 0x19b30e87], edi
fnstcw word [ebx + 0x30686b82]
frstor dword [esi + 0x4acd9b01]
shr bh, 0xf1
mov bh, 0x84
lcall 0xe834, 0xe9992e8a
mov byte [0x502a9d17], al
jns 0x45b19a
out dx, eax
xchg esp, eax
sti
sub dword [ebx], ecx
mov edi, 0x34e98d5b
jp 0x45b17a
xchg edi, eax
add byte [ecx - 0x20], ch
mov eax, 0xd4a76ab5
or byte [edx - 0x40], bl
rcr dword [edi - 0x31], cl
xor eax, 0xd563730e
sub al, bh
sub ch, ch
in eax, dx
inc edx
dec esi
jl 0x45b167
outsb dx, byte [esi]
cli
inc edx
pop ecx
in eax, 0x89
jns 0x45b147
inc eax
retf
push esi
inc esp
push es
jno 0x45b20f
imul esp, dword [edi - 0x629d1fe2], 0xffffffe3
xchg esp, eax
lahf
movsb byte es:[edi], byte [esi]
je 0x45b221
pushfd
dec ebx
jnp 0x45b217
sbb edx, edx
sbb ebp, edx
stosb byte es:[edi], al
sub dword [edx], ecx
invalid
xchg esi, eax
inc ebp
pop esp
imul ecx, ebx, 0x1f1f0cfa
pop ds
lodsb al, byte [esi]
pop ebx
mov word [edi], cs
movsd dword es:[edi], dword [esi]
hlt
lcall 0x84c9, 0x6121abe5
push eax
outsd dx, dword [esi]
inc eax
fisub dword [eax + 0x73fd349a]
wait
rcr byte [edx + 0x334d5e90], 1
adc ecx, dword [ebx + 0x701b671d]
add eax, dword [esi]
pop eax
hlt
Function at 0x494524
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0049d533
mov dword [esp + 0x28], 0
test esi, esi
jne 0x49456a
xor eax, eax
jmp 0x49456d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0049db68
lea eax, [edi + 0x7c]
test eax, eax
je 0x494588
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0049decd
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x4945c6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0049decd
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0049d24d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049dbe9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ea7ec
Capabilities:
Encode data using xor

Disassembly:
inc ebx
xor bh, byte [ebx]
cmp ecx, dword [ecx]
aam 0x3c
mov ecx, 0xd90cfe5a
cmp ecx, dword [ecx]
aam 0x3c
mov ecx, 0xd90cfe5a
pop esp
dec ebp
push es
xor eax, dword [edx + eax]
cwde
imul bh
pop edx
je 0x4ea7ea
pop ebp
pop esp
sub dword [edi], 0x6d
push 0xba7eab9f
invalid
Function at 0x4edca6
Capabilities:
Encode data using xor

Disassembly:
add al, 0x82
inc edi
dec esi
adc eax, 0xfde05498
test byte [edi], dl
and dword [edi - 0x40541aa0], edx
mov esp, 0xd3194200
cmp dword [edx + 0x72c47bc7], ebp
dec ebx
lea ebp, [eax + 0x5a]
xor cl, ch
outsd dx, dword [esi]
inc edx
adc ecx, dword [edi]
jbe 0x4edc48
in eax, 0xab
mov edi, 0x194200bc
sar dword [ecx], cl
stosb byte es:[edi], al
invalid
xchg ecx, eax
jecxz 0x4edcd2
dec esi
pop ebx
cmpsd dword [esi], dword es:[edi]
ret
dec edi
out 0x82, eax
and al, 0x9a
jb 0x4edc3a
mov esp, 0x251b0cd5
sal byte [esi + 0x17356323], cl
pop ebx
outsd dx, dword [esi]
and bh, dh
jno 0x4edc88
seta byte [esi]
insb byte es:[edi], dx
imul ebx, edx, 0x22c69fff
inc esi
and eax, 0x79b40aaf
dec ebx
push ds
pop ss
push dword [ebx - 0x7d]
pop esp
cwde
inc edi
mov dword [0xeb270401], eax
and ebp, esp
and esp, ebx
arpl word [edi], cx
bnd jmp 0x3464705f
sbb dword [eax + ebx*4 + 0x47], 0xffffffa3
add dword [edi], eax
jmp 0x4edcff
invalid

Function at 0x4eed90
Capabilities:
Encode data using xor

Disassembly:
pop ecx
insd dword es:[edi], dx
cld
inc edx
jp 0x4eedf5
add esi, dword [edx + 0x53b9d137]
xchg ebp, eax
das
mov dl, 4
mov ah, 0xec
invalid
inc edx
out dx, eax
jno 0x4eee6d
mov edi, 0x8d0dc227
xor dword [esi], ebp
cmpsb byte [esi], byte es:[edi]
test byte [ebx - 0x5e], 0xf3
retf
mov bh, 0x32
adc ch, byte [edi + edx*2 - 0x6dd5980d]
push ecx
call [edi + 0x781d17fa]
add byte [edi], al
aas
adc byte [edx + ebx*8 + 0x2c], cl
scasd eax, dword es:[edi]
xor eax, 0x50b5fcd7
mov bh, 0x83
push es
adc dword [ebp + 0x696255eb], edx
pop esi
inc ebp
mov dword [0xe9a5bac7], eax
mov bl, 0xed
sbb ecx, dword [ecx]
ror byte [esi], 0xc9
add byte [esi + ebp*8], dh
fild dword [edx]
xlatb
pop ds
movsb byte es:[edi], byte [esi]
mov dword [0xa619bb57], eax
cwde
aad 0x42
push 0x39
jne 0x4eeefb
jns 0x4eee4a
mov esi, 0xbb3570c8
outsb dx, byte [esi]
mov ah, 0xe5
invalid
and ebx, ebx
cmp dl, byte [esi]
xchg edx, eax
or esp, dword [ebx + 0x2095d262]
xor dword [ecx], ebp
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
invalid
in eax, 0x31
xor dword [edx - 0x2f38eddb], ebx
lahf
fucomp st(6)
xor dword [ecx], esi
lcall 0xdd9f, 0xd0c71225
out dx, al
loope 0x4eeede
xor dl, byte [esi + 0x54b07756]
imul ebx, eax, 0xffffffb3
sti
push ecx
sub bl, 0x4b
sub eax, 0xe6275e54
xor eax, 0xe313f364
adc edx, esp
loop 0x4eeefa
sahf
invalid
Function at 0x530c73
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
dec ecx
sti
fdiv st(7)
ficomp dword [ebp + 0x17]
push ds
xor al, 0x45
dec ecx
invalid
mov ebx, 0x9f350741
mov esi, edx
dec ecx
inc ebx
pop ebp
jg 0x530ce6
jne 0x530c2b
mov ds, eax
cmp byte [ebp - 0x6adb9752], al
inc eax
stc
sub eax, 0xec853754
int1
fistp qword [ecx - 0x28]
jmp 0x530cfd
inc ebx
cdq
lodsb al, byte [esi]
dec eax
cwde
jmp 0xa55f9bd4
sub byte [ecx + 0x11], dl
push ds
sub byte [edx - 0x4e], al
in eax, 0xc9
in al, 0x69
or ebx, ebp
inc edx
xchg edx, eax
salc
js 0x530cc3
pop edx
imul eax, dword [0x8a720e66], 0x7c
or dword [esi - 0x6e37c7b2], esp
push cs
push cs
jb 0x530c8b
jl 0x530d0c
cmpsb byte [esi], byte es:[edi]
dec esi
cmp al, cl
xchg ecx, eax
mov dl, 0x95
mov esi, 0x7272c967
leave
jb 0x530d81
mov dh, 0x99
sub ch, ch
xor esi, ebp
sub al, 0x84
add byte [edi], bl
sbb dword cs:[ebx - 0x268aba7f], ebx
xchg esp, eax
inc ebp
pop ds
add dword [ebp + 0x75], 0x1f4594d9
mov cl, 0x8b
mov ax, word [0xeb52d726]
xchg ecx, eax
in eax, dx
mov bh, 0xa0
aad 9
push esp
mov dword [edx - 0x27], ebp
push esi
add dword [esi + 0x1df9130d], edx
fisttp dword [edx - 0xa]
test byte [esi + 0x26], dl
aad 0xba
xchg byte [ecx - 0x36a768b4], bh
test ch, dh
dec ecx
and eax, 0x6823453
test eax, 0xf38250d2
pop es
jp 0x530cfe
jmp 0x530dba
mov edx, 0x26a6f696
sub byte [edi - 0x39876218], cl
xor al, 0x28
jge 0x530d1c
push edi
or al, 0xb4
cmpsb byte [esi], byte es:[edi]
push esi
push 0x36
pop es
aaa
cmp al, 4
leave
mov edx, 0x98c80fa9
push edi
invalid
outsd dx, dword [esi]
clc
scasb al, byte es:[edi]
mov esi, 0xdbf81853
or cl, bl
xor eax, 0xffffffa5
xor cl, byte [0x33299228]
dec eax
sbb byte [0x71689f4d], 0x5b
inc sp
cli
push eax
les esi, [edi - 0x57]
sahf
xchg edi, eax
or eax, 0xf66dc11a
invalid
jge 0x530d5e
call 0xe275a12
jl 0x530d6b
push ecx
popfd
inc esp
int1
adc eax, 0xaf96580c
mov fs, word [ebp + 0x306166aa]
push 0x36
xchg edi, eax
sbb byte es:[ebx], al
jle 0x530df2
sub al, ch
sbb dword [esi + 5], ecx
inc ebp
dec ecx
push es
invalid
stosd dword es:[edi], eax
sbb byte [ebp + 0x66989212], cl
xchg ecx, eax
xlatb
adc eax, dword [ebx - 0x61]
aad 0x8e
invalid

Function at 0x5baf04
Capabilities:
Encode data using xor

Disassembly:
adc bl, bl
mul dword [ecx + 0x79]
or al, 0xed
in eax, dx
in eax, dx
inc ebx
frstor dword [ebx - 0x47]
adc edi, ebp
xlatb
mov byte [0x5457bbc6], al
inc ecx
mov ebx, 0x8df4b4c7
out 0xa1, al
or al, 0xb4
scasd eax, dword es:[edi]
xor dword [edi + 0x5f], ebp
mov ah, 0xd1
lds esp, [ebp - 0x7276a724]
ja 0x5baf1e
movsb byte es:[edi], byte [esi]
sbb al, 0xc0
loope 0x5baefe
nop
lea edi, [ebx + 0x53]
jbe 0x5baf44
call 0x261a296b
lahf
dec edi
arpl word [ebp - 0x1422c6d2], bx
dec esi
sbb al, 0x4e
xchg edx, eax
loope 0x5baf61
inc ecx
pop ebp
and dh, byte [ecx + 0x5d]
inc ebp
xor al, 0xe5
out dx, al
add eax, 0xd0af0af8
in eax, 0x98
outsd dx, dword [esi]
fcompi st(6)
cmp byte [ebx], 0x3b
leave
test al, 0x9a
jb 0x5baf5c
fld dword [0x5142c4db]
xchg esp, eax
push 0x1c252e1e
xor al, 1
invalid
Function at 0x61341b
Capabilities:
Encode data using xor

Disassembly:
xlatb
pop ss
inc edi
add byte [eax], dh
xchg dword [ecx], esi
sub dword [ecx], edx
pop ss
sbb bh, ch
jb 0x6133ef
rol byte [edi - 0x11eb641f], 0xe2
rcl dword [eax - 0x63]
jecxz 0x61349a
xchg edi, ecx
or eax, dword [esi - 0x1a]
wait
pop es
inc edx
inc edx
das
pop edx
xchg byte [eax - 0x3838e19e], bl
test byte [eax - 0x38], 0xb0
adc byte [esi + 0x14f7140c], al
aas

Function at 0x614a68
Capabilities:
Encode data using xor

Disassembly:
test ecx, edi
mov ecx, 0x32cf8be5
pop es
dec esi
xchg esi, eax
jo 0x6149e4
int1
xchg byte [edi + 0x6a4170b1], dl
push esi
rol dword [eax + 0x1130e489], cl
xor al, 0x83
push ebx
push edi
jbe 0x6149a6
adc dword [ebx + 0x57], 0x76
pop es
popal
push ss
sbb byte [ebx + 0x10], ch
enter 0x56b9, 0xffffffffffffffb6
inc ecx
push esi
mov dh, 0x41
adc edi, 0x41
xchg ecx, eax
in al, 0x89
adc esp, 0xcb088222
test al, 0xf4
inc ecx
lodsd eax, dword [esi]
bound esi, qword [edi + 0x1a]
dec esi
jno 0x614a04
adc dword [edx], 0xd375f445
insd dword es:[edi], dx
push ss
xchg ebp, eax
jbe 0x61499a
adc dword [ebx + 0x66], ebx
jecxz 0x614a00
sar dword [edx + 0x15f09060], 0x3b
jbe 0x61497f
rcl byte [ecx + 0x47]
adc dword [ebx], edx
cmpsb byte [esi], byte es:[edi]
out 0, eax
dec edi
and bl, dh
mov ch, 0xe4
add esp, edx
jecxz 0x6149ee
lea eax, [edx + edx*2]
wait
wait
mov cl, 0xb5
loope 0x614a3c
ret 0xeab7
salc
mov esi, 0x406a7393
push 0x40
invalid
lahf
mov ebx, 0x13ca8ffa
xchg bh, dl
xlatb
jae 0x6149c6
pop esi
xlatb
scasb al, byte es:[edi]
push ebx
pop esp
js 0x614a96
push ebp
hlt
stc
mov edi, 0xe9f1bf37
jle 0x614a35
test al, 0x36
cmpsb byte [esi], byte es:[edi]
mov al, 0x55
sal byte [edi + 0x24cfd0c0], 1
xor eax, 0x455aad5d
jmp 0x614a8c
in al, 0x84
pop ebx
nop
sub byte [ebx + 0x4b4d44f6], dl
fisttp word [edi]
sbb byte [esi + 0x3b], dl
inc ebp
cmp byte [eax + 2], bh
mov ebp, 0x18d1ede9
daa
push ebx
div byte [edi - 0x6d58b110]
invalid

Function at 0x614c51
Capabilities:
Encode data using xor

Disassembly:
jmp 0x614cb3
fbld tbyte [esi - 0x17e571de]
adc al, 0x57
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x1ee63986
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x667e6164
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x13c276ac
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x704d1161
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
xor eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
or eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
or eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x3315496a
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7e4c39a0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x754437f5
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x794a0472
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x407040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x40711b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x4070b6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00406c80
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x407084
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4071d4
call fcn.004070c8
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x407173
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00406c80
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40712c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4071d4
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00406c80
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4071cf
jmp 0x4071d4
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407240
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x407324
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4072bf
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00406de0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40728d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4073dd
call fcn.004072d1
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x40737c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00406f10
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x407335
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4073dd
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00406f10
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4073d8
jmp 0x4073dd
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret