joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d7c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5d7c5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x5d7c63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x5d7cfb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x5d7ca9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x5d7d0a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x5d7cbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x5d7cd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x5d7c90
jmp 0x5d7cd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x5d7c90
cmp edi, ebx
jge 0x5d7cf0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x5d7c94
jmp 0x5d7cf4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x5d7c9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x5d7d92
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x5d7d92
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x5d7d44
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x5d7d30
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x5d7d92
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x5d7d50
dec eax
mov ecx, 1
xor esi, esi
jmp 0x5d7dac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x5d7c5b
test edx, edx
mov dword [esp], ecx
js 0x5d7de0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x5d7df0
inc ebp
dec edx
cmp edi, ebp
jne 0x5d7dc0
mov edx, 0xffffffff
jmp 0x5d7df2
xor edi, edi
jmp 0x5d7df5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x5d7da0
and ebp, 3
je 0x5d7e28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x5d7e10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x5d7e2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x5d7da0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x5d7e40
jmp 0x5d7da0
Function at 0x5d8990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x5d89f5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x5d89b0
mov eax, 0x270
jmp 0x5d8acf
cmp eax, 0x4e0
jb 0x5d8acf
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x5d8a10
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x5d8a60
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0x5eb020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0x5eb060
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0x5eb0e0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0x5eb121
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x5eb110
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x5eb151
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x5eb140
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0x5eb181
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x5eb170
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0x5eb1b0
movzx eax, byte [esp + 0x48]
test al, al
je 0x5eb22d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x5eb220
jmp 0x5eb231
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.005dae40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x613794]
mov ecx, 0xae6ce794
xor ecx, dword [0x61379c]
add eax, ecx
inc eax
jmp eax
Function at 0x8d0060
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x8d0080
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x8d0e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x8d0e80
mov eax, dword [esp]
mov edx, dword [0x61965c]
test edx, edx
je 0x8d0ef8
xor ebx, ebx
mov ecx, dword [0x619660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x8d0ed0
inc ebx
cmp edx, ebx
jne 0x8d0ec0
jmp 0x8d0ef8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x8d0ef8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x619664]
call fcn.008cea80
add esp, 0x20
test edi, edi
je 0x8d0f02
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x8d0f0e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x8d11d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x8d11f0
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x698232ac]
xor ecx, eax
mov ebx, ecx
and ebx, 0x5f
add ebx, ebx
xor ecx, 0xa0
sub ebx, ecx
mov byte [esp + eax + 0x698232ac], bl
inc eax
cmp eax, 0x967dcd58
jne 0x8d1270
mov eax, dword [esp]
mov edi, dword [0x61965c]
test edi, edi
je 0x8d12e5
xor ebx, ebx
mov ebp, dword [0x619660]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x8d12c1
inc ebx
cmp edi, ebx
jne 0x8d12b0
jmp 0x8d12e5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x8d12e5
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x619664]
call fcn.008cea80
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a8c5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f80a
and dword [ebp - 4], 0
cmp dword [0x454778], 0
mov ebx, eax
jne 0x43a976
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43aa27
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x447120
push edi
call esi
test eax, eax
je 0x43aa27
push eax
call fcn.0042f798
mov dword [esp], 0x447110
push edi
mov dword [0x454778], eax
call esi
push eax
call fcn.0042f798
mov dword [esp], 0x4470fc
push edi
mov dword [0x45477c], eax
call esi
push eax
call fcn.0042f798
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x454780], eax
call esi
push eax
call fcn.0042f798
pop ecx
mov dword [0x454788], eax
test eax, eax
je 0x43a976
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f798
pop ecx
mov dword [0x454784], eax
mov eax, dword [0x454784]
cmp eax, ebx
je 0x43a9ce
cmp dword [0x454788], ebx
je 0x43a9ce
push eax
call fcn.0042f813
push dword [0x454788]
mov esi, eax
call fcn.0042f813
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43a9ce
test edi, edi
je 0x43a9ce
call esi
test eax, eax
je 0x43a9c5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43a9c5
test byte [ebp - 0xc], 1
jne 0x43a9ce
or dword [ebp + 0x10], 0x200000
jmp 0x43aa07
mov eax, dword [0x45477c]
cmp eax, ebx
je 0x43aa07
push eax
call fcn.0042f813
pop ecx
test eax, eax
je 0x43aa07
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43aa07
mov eax, dword [0x454780]
cmp eax, ebx
je 0x43aa07
push eax
call fcn.0042f813
pop ecx
test eax, eax
je 0x43aa07
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x454778]
call fcn.0042f813
pop ecx
test eax, eax
je 0x43aa27
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43aa29
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3a8451a4
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x57fa2b57
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x7a3cec
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a3cf6
pushal
call 0x7a3cfc
pop ebp
sub ebp, 0x10
sub ebp, 0x3a3cec
jmp 0x7a3d12
mov eax, 0x3a3cec
add eax, ebp
add eax, 0x4c
ror byte [eax + eax], 0
add byte [eax], al
add byte [ecx + 0x5f7], bh
mov ecx, 0x5f7
mov edx, 0xae0ef5c8
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a3d29
jmp 0x7a3d3c
inc ebx
add eax, 0xc8f44143
enter 0x49c8, 9
xor al, cl
enter 0xffffffffffffcbc8, 5
jo 0x7a3d1a
enter 0xffffffffffffc8c8, 0x72
loopne 0x7a3d1c
enter 0x3fc8, 0x2a
retf
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x639a7354
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x46ab6963
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40f0e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40f11e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40f116
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40f120
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40f106
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40f200
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40f231
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40f231
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40f231
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x76f66c66
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xe580342
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40644e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406472
xor eax, eax
test eax, eax
je 0x406485
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406485
xor ecx, ecx
jmp 0x406488
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40656f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4065a6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406580
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x40657b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065d7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4065b9
pop edi
not eax
pop esi
ret 0xc

Function at 0x40891f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x4085d8
push ecx
pop edi
call fcn.00408940
sub edi, 0x2aa017b3
dec edi
xor dword [ebx], eax
mov edi, edi
inc ebx
add edi, ecx
cmp ebx, esi
jne fcn.0040891f
mov ecx, edi
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x401000
Capabilities:
Encode data using xor
Query environment variable
Read file on windows

Disassembly:
jmp 0x401002
test eax, eax
jne 0x401011
cmp eax, 0
jne 0x4011b1
je 0x401017
cmp ecx, 0
je 0x401017
ret
xor ecx, ecx
mov eax, dword [esp - 0x2c]
cmp eax, 0
je 0x401029
cmp eax, 0x408
je 0x401029
mov ebp, esp
mov eax, dword [sym.imp.WINMM.dll_PlaySoundW_4]
call eax
sub esp, 0x40
mov esi, section..data
push 0x208
push esi
push 0x4011f0
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov edi, eax
mov ecx, eax
mov eax, ecx
xor ebx, ebx
mov edx, 2
mov eax, ebx
mul edx
mov dl, byte [eax + esi]
mov byte [ebx + esi], dl
inc ebx
loop 0x401053
mov eax, edi
mov ecx, 0x2c
push esi
pop edx
add edx, eax
add edx, ecx
mov ebx, 0x401180
add ebx, ecx
sub ebx, 1
mov ebx, dword [ebx]
mov dword [edx], ebx
loop 0x40106c
mov edx, esi
add edx, eax
mov eax, 0x5c
mov byte [edx], al
xor edx, edx
push 0
push esi
call dword [sym.imp.kernel32.dll__lopen]
mov dword [ebp - 0x24], eax
push 0
push 0x500
push 0x40000
call dword [sym.imp.kernel32.dll_HeapCreate]
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
push 0
push esp
push 0x100
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebx + 0x66]
cmp eax, 0x35413632
je 0x4010e8
cmp eax, 0x3344377b
je 0x4010e8
cmp eax, 0x7b3e4449
je 0x4010e8
cmp eax, 0xa3a3af0a
je 0x4010e8
jmp 0x401174
mov ebx, 0x400000
mov ebx, dword [ebx + 0x3c]
add ebx, 0x400000
mov esi, dword [ebx + 0x158]
mov edi, esi
push 0
push esi
push 0x40000
call dword [sym.imp.kernel32.dll_HeapCreate]
mov esi, eax
mov eax, dword [ebx + 0x154]
add eax, 0x400000
mov ebx, eax
add ebx, 4
mov eax, edi
push eax
mov eax, esi
push eax
push ebx
push eax
test eax, eax
jne 0x401130
mov dword [ebp - 0x2c], esi
call dword [ebp - 0x2c]
mov ebx, dword [esp + 0xc]
mov ecx, ebx
push dword [esp + 4]
pop ebx
mov eax, ebx
add eax, 0x40
mov edx, eax
add edx, ecx
sub edx, 1
mov eax, edx
push ebx
push dword [eax]
pop ebx
rol bl, 1
mov edx, 0xf4
mov al, bl
xor al, dl
push eax
pop ebx
mov eax, dword [esp + 0xc]
mov edx, ecx
add eax, edx
dec ecx
mov byte [eax - 1], bl
pop ebx
test ecx, ecx
jne 0x40113b
mov esp, ebp
jmp esi
mov esp, ebp
pop eax
cmp eax, 0
jne 0x40117d
ret
int3
mov eax, dword [0x40202c]
call eax
ret