joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410629
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov byte [ebp - 0x1c], 0x49
cmp byte [ebp + 0xc], al
mov dword [ebp - 4], eax
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
je 0x41068f
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], al
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404b1b
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x427ee8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4717ae
call fcn.004555fc
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00457134
mov eax, 0x477c38
lea edi, [ebx + 0x10]
mov esi, eax
and dword [ebp - 4], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov edi, 0x4765e0
mov esi, 0x4765d8
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.0040250c
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.0040250c
mov eax, dword [ebp + 8]
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebx], 0x476808
mov dword [ebx + 0xc], eax
call fcn.00428076
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x427f7a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4717d6
call fcn.004555fc
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00457134
and dword [ebp - 4], 0
lea edi, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov esi, 0x4765d8
push 0
push eax
mov ecx, edi
mov dword [edi], 0x4765e0
mov dword [edi + 0x20], esi
call fcn.0040250c
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x4765e0
mov dword [ecx + 0x20], esi
call fcn.0040250c
mov esi, dword [ebp + 8]
mov dword [ebx], 0x476808
mov ecx, edi
mov byte [ebp - 4], 2
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [esi + 0x30]
push eax
call fcn.00402942
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
call fcn.00402942
add esi, 0x20
lea edi, [ebx + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x10]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x42ac49
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x42ac86
mov eax, dword [ecx + 0xd8]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x42ac64
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x40be65
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x40be87
mov eax, 0xfffffffd
jmp 0x40beff
mov ebx, dword [0x14]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x40becd
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x14]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x40bef5
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x40beff
mov esp, ebp
pop ebp
ret 4

Function at 0x410063
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret
Function at 0x66e02580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x66e025db
cmp byte [esi + ebx - 1], 0xa
je 0x66e025af
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x66e090a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x414a0fc5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6836690e
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4061d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42b03b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404304
call fcn.00406eec
push 4
mov dword [esp + 0x18], 0
call fcn.004083d1
mov edi, eax
add esp, 4
test edi, edi
je 0x406244
push ebx
call fcn.00406ce7
mov dword [edi], eax
call fcn.00406aa6
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406ead
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406238
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406ed5
pop ebx
jmp 0x406246
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408a4b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ed68]
jne 0x408a55
repz ret
jmp fcn.0040e45c
Function at 0x411aa8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42ed68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ab74
and dword [ebp - 0x14], 0
cmp dword [0x43365c], 0
mov dword [ebp - 0x18], eax
jne 0x411b5b
push 0x4037ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411c03
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037e0
push ebx
call edi
test eax, eax
je 0x411c03
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037d0
push ebx
mov dword [0x43365c], eax
call edi
push eax
call esi
push 0x4037bc
push ebx
mov dword [0x433660], eax
call edi
push eax
call esi
push 0x4037a0
push ebx
mov dword [0x433664], eax
call edi
push eax
call esi
mov dword [0x43366c], eax
test eax, eax
je 0x411b5b
push 0x403788
push ebx
call edi
push eax
call esi
mov dword [0x433668], eax
mov eax, dword [0x433668]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411bb4
cmp dword [0x43366c], ecx
je 0x411bb4
push eax
call esi
push dword [0x43366c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411bb4
test ebx, ebx
je 0x411bb4
call edi
test eax, eax
je 0x411bab
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411bab
test byte [ebp - 8], 1
jne 0x411bb4
or dword [ebp + 0x10], 0x200000
jmp 0x411be7
mov eax, dword [0x433660]
cmp eax, dword [ebp - 0x18]
je 0x411be7
push eax
call esi
test eax, eax
je 0x411be7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411be7
mov eax, dword [0x433664]
cmp eax, dword [ebp - 0x18]
je 0x411be7
push eax
call esi
test eax, eax
je 0x411be7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43365c]
call esi
test eax, eax
je 0x411c03
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411c05
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a4b
leave
ret
Function at 0x428410
Capabilities:
Get common file path

Disassembly:
sub esp, 0xe44
cmp dword [0x7b73fc], 0x37
jne 0x4284a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push 0
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea edx, [esp + 8]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea ecx, [esp + 0x644]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov edx, dword [0x7b83f0]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + esi]
mov edx, dword [0x7b7364]
mov byte [edx + esi], cl
add esp, 0xe44
ret
Function at 0x428730
Capabilities:
Accept command line arguments
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b73fc]
sub esp, 0xa8c
push ebx
push ebp
push esi
mov esi, dword [0x7b7364]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x428948
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], eax
jmp 0x428766
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x7b73fc], 0x1c
jne 0x42877d
lea eax, [esp + 0x44]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x42f2c4]
mov ebx, dword [0x42f2c0]
mov ebp, dword [0x42f2c8]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42f2cc]
mov dword [esp + 0x1c], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], 0x20
jmp 0x4287c6
mov eax, dword [esp + 0x1c]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, dword [esp + 0x2c]
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x18], edx
add ecx, ebp
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x7b7368], edi
mov eax, dword [esp + 0x18]
add dword [0x7b7368], eax
mov eax, dword [0x7b7368]
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, ecx
shl eax, 4
add eax, ebx
cmp dword [0x7b73fc], 0x1be
mov dword [esp + 0x10], eax
lea edi, [esi + ecx]
jne 0x428884
push 0
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
shr ecx, 5
add ecx, dword [esp + 0x30]
cmp dword [0x7b73fc], 0x979
mov dword [0x7b7370], 0xff6b3619
mov dword [0x7b7374], 0xffffffff
mov dword [esp + 0x18], ecx
jne 0x4288c5
push 0
lea ecx, [esp + 0x29c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
mov eax, dword [esp + 0x10]
xor eax, edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
add esi, 0x61c88647
dec dword [esp + 0x24]
jne 0x4287c0
cmp dword [0x7b73fc], 0x8d4
jne 0x4288fd
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], eax
cmp dword [0x7b73fc], 0x17
jne 0x428937
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea ecx, [esp + 0x48]
push ecx
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x20], esi
jne 0x428760
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8c
ret
Function at 0x441cb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x34000]
push edi
jmp 0x441cca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x441cd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x441cc0
mov eax, 1
add ebx, ebx
jne 0x441ce3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x441cd8
jne 0x441cf4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x441cd8
xor ecx, ecx
sub eax, 3
jb 0x441d08
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x441d7a
mov ebp, eax
add ebx, ebx
jne 0x441d13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x441d20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x441d44
inc ecx
add ebx, ebx
jne 0x441d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x441d25
jne 0x441d41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x441d25
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x441d64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x441d55
jmp 0x441cc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x441d64
add edi, ecx
jmp 0x441cc6
pop esi
mov edi, esi
mov ecx, 0xce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x441d82
cmp byte [edi], 6
jne 0x441d82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x441d87
lea edi, [esi + 0x3f000]
mov eax, dword [edi]
or eax, eax
je 0x441df6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x59944]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x59980]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x441db4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x59984]
or eax, eax
je 0x441df0
mov dword [ebx], eax
add ebx, 4
jmp 0x441dd1
call dword [esi + 0x59994]
mov ebp, dword [esi + 0x59988]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x441e2a
sub esp, 0xffffff80
jmp 0x403861
Function at 0x41d7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add al, 0x89
push ecx
add al, 0x8b
push eax
or byte [ebx + 0x51890c40], cl
or byte [esi - 0x77], dl
inc ecx
or al, 0xe8
in eax, 0x5c
add byte [eax], al
Function at 0x420ffc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4778cb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x4934c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov ecx, dword [0x47c288]
mov dword [esi + 0xc], ecx
mov edx, dword [0x47c28c]
mov dword [esi + 0x10], edx
mov ecx, dword [0x47c290]
mov dword [esi + 0x14], ecx
mov edx, dword [0x47c294]
mov dword [esi + 0x18], edx
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov dword [esi + 0x30], edi
cmp edi, ebx
je 0x4210d0
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push esi
push edi
call ecx
cmp eax, ebx
mov eax, dword [esi + 0x30]
jl 0x4210c1
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x30]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp + 8]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
cmp eax, ebx
jl 0x4210d0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [esi + 4]
push eax
mov eax, dword [edx + 0x20]
push ecx
call eax
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4210d0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp + 8], ebx
jmp 0x4210d0
cmp eax, ebx
je 0x4210d0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x30], ebx
push 8
call fcn.004697f9
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x421101
mov dword [ebx], 0x47e398
mov dword [ebx + 4], edi
test edi, edi
je 0x421103
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push edi
call ecx
jmp 0x421103
xor ebx, ebx
mov dword [esi + 0x28], ebx
lea eax, [esi + 0x34]
mov ecx, 0x96
mov dword [eax], 0
add eax, 0x10
dec ecx
jne 0x42110e
mov eax, dword [0x4961f8]
mov dword [esi + 0x994], eax
inc eax
mov dword [0x4961f8], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x441aac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov eax, 0x47d940
push esi
sub eax, 0xbc
push edi
mov dword [esp + 0x14], 0xbc
mov dword [esp + 0x1c], eax
jmp 0x441ad4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov esi, dword [eax + ecx]
mov eax, esi
mov dword [esp + 0x10], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x441ae4
sub eax, edx
mov edi, eax
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [esp + 0x18], edi
mov edx, edi
cmp edi, ecx
jb 0x441b24
movzx eax, byte [esi + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
mov esi, dword [esp + 0x10]
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x441b01
mov dword [esp + 0x18], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x441b92
lea ecx, [ecx]
cmp dword [eax + 0xc], edi
jne 0x441b8c
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x441b60
nop
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x441b84
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x441b4c
test ecx, ecx
je 0x441bd2
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x441b84
cmp ecx, 1
jbe 0x441bd2
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x441b84
cmp ecx, 2
jbe 0x441bd2
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x441bd2
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x441b3c
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, ebx
call fcn.0044312c
add esp, 8
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
mov esi, dword [edx + 0x10]
mov dword [ecx + esi], eax
mov edx, dword [edx + 0x10]
mov eax, dword [ecx + edx]
or byte [eax + 5], 0x20
add ecx, 4
mov dword [esp + 0x14], ecx
cmp ecx, 0x100
jl 0x441ad0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov cl, byte [eax + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x14]
movzx edx, cl
and edx, 3
not ebx
test bl, dl
je 0x441ba1
xor cl, 3
mov byte [eax + 5], cl
jmp 0x441ba1
Function at 0x4431fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [esp + 0xc], edi
mov edx, edi
cmp edi, ecx
jb 0x44323d
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x44321b
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4432a6
cmp dword [eax + 0xc], edi
jne 0x4432a0
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x443278
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x44329c
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x443264
test ecx, ecx
je 0x4432bf
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x44329c
cmp ecx, 1
jbe 0x4432bf
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x44329c
cmp ecx, 2
jbe 0x4432bf
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x4432bf
mov ebx, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x443252
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov eax, ebx
call fcn.0044312c
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov cl, byte [eax + 5]
movzx edx, byte [edx + 0x14]
movzx ebx, cl
not edx
and ebx, 3
test bl, dl
je 0x4432b8
pop edi
xor cl, 3
pop esi
mov byte [eax + 5], cl
pop ebx
mov esp, ebp
pop ebp
ret