joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c5ca
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.0040401b
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x401e20
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004086d3
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x42a324
push eax
call fcn.0040878f
push edi
push esi
call fcn.00405662
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040632c
mov esp, ebp
pop ebp
ret 4
Function at 0x40e2b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040deed
push eax
push esi
push dword [ebp + 8]
call fcn.0040dea2
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040deed
push eax
push esi
push dword [ebp + 8]
call fcn.0040dea2
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040dedd
and al, 0xfd
fidiv dword [ecx]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0040dedd
stosd dword es:[edi], eax
mov dl, 0xab
or cl, byte [ebp - 0x837b]
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x40e4dc
Capabilities:
Inspect section memory permissions

Disassembly:
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x40e4ee
and eax, 0xffff
push eax
jmp fcn.0040e4f2
add ecx, 2
push ecx

Function at 0x40e4f2
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x40e482
cmp dword [eax + 0xc], ebx
je 0x40e525
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0040dedd
mov edi, 0x39c32460
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x40e513
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040dea2
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x40e6cc
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x40e4d3
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x40e474
call fcn.0040dedd
Function at 0x40e52a
Capabilities:
Inspect section memory permissions

Disassembly:
ror dword [ebp + 0x5f], 0x8e
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x40e591
add eax, esi
cmp dword [eax], ebx
je 0x40e591
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40e58c
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40e576
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40e57e
cmp edx, ebx
jne 0x40e6cc
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40e54d
add eax, dword [eax + 4]
jmp 0x40e53a
mov dword [ebp + 0xc], ebx
jmp 0x40e59c
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40e5b4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40e5d2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40e630
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40e617
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40e620
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40e62a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40e60c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40e596
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40e67d
dec eax
je 0x40e674
sub eax, 3
je 0x40e66b
mov dword [ebp - 4], 0x40
jmp 0x40e69a
mov dword [ebp - 4], 4
jmp 0x40e680
mov dword [ebp - 4], 0x20
jmp 0x40e680
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40e6cc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40e64c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040dedd
or eax, 0xff5a9269
jne 0x40e6d7
push 1
push esi
call edi
mov eax, esi
jmp 0x40e6d8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41252d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123ac
Function at 0x4025b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
push esi
push edi
mov eax, dword [ebx]
mov edi, dword [ebx + 4]
xor edi, eax
mov dword [ebp - 0xc], eax
mov eax, edi
mov ecx, edi
and eax, 0xfffffffc
mov esi, edi
add eax, 4
and cl, 3
cmovne esi, eax
mov ecx, esi
call fcn.0040304d
mov dword [ebp - 4], eax
test eax, eax
je 0x40262e
shr esi, 2
lea edx, [ebx + 8]
xor ebx, ebx
and dword [ebp - 8], ebx
lea ecx, [edx + esi*4]
mov esi, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp edx, ecx
cmova esi, dword [ebp - 8]
test esi, esi
je 0x402622
mov ecx, eax
sub ecx, edx
mov eax, dword [edx]
xor eax, dword [ebp - 0xc]
inc ebx
mov dword [ecx + edx], eax
lea edx, [edx + 4]
cmp ebx, esi
jb 0x402612
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40262b
mov dword [eax], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40263a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
xor ebx, ecx
mov dword [ebp - 0xc], ecx
push edi
mov dword [ebp - 0x14], ebx
lea esi, [ebx + 1]
mov eax, esi
mov edx, esi
and eax, 0xfffffffc
add eax, 4
and dl, 3
cmovne esi, eax
lea ecx, [esi + esi]
call fcn.0040304d
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x4026e5
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
add eax, 8
shr esi, 2
lea ecx, [eax + esi*4]
mov esi, edi
mov edx, ecx
sub edx, eax
add edx, 3
shr edx, 2
cmp eax, ecx
cmova edx, dword [ebp - 4]
test edx, edx
je 0x4026df
mov ebx, eax
xor edi, edi
mov ecx, dword [ebx]
lea ebx, [ebx + 4]
xor ecx, dword [ebp - 0xc]
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc edi
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp edi, edx
jb 0x4026a3
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4026ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
xor eax, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
lea edi, [eax + 1]
mov eax, edi
mov edx, edi
and eax, 0xfffffffc
add eax, 4
and dl, 3
cmovne edi, eax
mov ecx, edi
call fcn.0040304d
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x402780
and dword [ebp - 4], 0
add ebx, 8
shr edi, 2
xor eax, eax
mov edx, esi
lea ecx, [ebx + edi*4]
mov edi, ecx
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, ecx
cmova edi, eax
test edi, edi
je 0x402779
mov esi, dword [ebp - 4]
mov ecx, dword [ebx]
lea ebx, [ebx + 4]
xor ecx, dword [ebp - 8]
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc esi
mov byte [edx - 1], cl
cmp esi, edi
jb 0x402750
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov byte [esi + eax], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402aaf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0xc], 0
xor edx, edx
mov dword [ebp - 0x34], 0x3676bd17
mov dword [ebp - 0x30], 0x2e9ae770
mov dword [ebp - 0x2c], 0xd249bc14
mov dword [ebp - 0x28], 0x9b08c6ec
mov dword [ebp - 0x24], 0xda1383a9
mov dword [ebp - 0x20], 0xd6ca5acc
mov dword [ebp - 0x1c], 0xab07daa1
mov dword [ebp - 0x18], 0xbd4e1c6
mov dword [ebp - 0x14], 0x751bdae2
mov dword [ebp - 0x10], 0x7a2fa82c
mov dword [ebp - 8], 0x193
mov eax, dword [ebp - 8]
push ebx
push 0x50
mov ebx, ecx
pop ecx
div ecx
push 0x49
mov dword [ebp - 8], eax
xor edx, edx
shl dword [ebp - 8], 3
or dword [ebp - 8], 0xf59d6c8a
shl dword [ebp - 8], 0xd
imul eax, dword [ebp - 8], 0x45
pop ecx
push 0x7e
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x52bd
mov eax, dword [ebp - 8]
div ecx
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
div ecx
push 0x72
mov dword [ebp - 8], eax
xor edx, edx
xor dword [ebp - 8], 0x599c2
mov dword [ebp - 4], 0x621e
xor dword [ebp - 4], 0xd63fda2d
or dword [ebp - 4], 0x67fc2b7b
mov eax, dword [ebp - 4]
pop ecx
div ecx
mov dword [ebp - 4], eax
add dword [ebp - 4], 0x2cb3
or dword [ebp - 4], 0x33f0279a
add dword [ebp - 4], 0xe3c3
add dword [ebp - 4], 0xffff53a4
xor dword [ebp - 4], 0x33fd6f23
mov dword [ebp - 4], 0xc236
imul eax, dword [ebp - 4], 0x6e
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x28
mov dword [ebp - 4], eax
add dword [ebp - 4], 0xffff4cfd
or dword [ebp - 4], 0x7fdf76f7
imul eax, dword [ebp - 4], 0x34
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0xf965ffdc
cmp byte [ebx], 0
je 0x402c79
push esi
push edi
mov edi, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 4], 0x621e
xor dword [ebp - 4], 0xd63fda2d
or dword [ebp - 4], 0x67fc2b7b
mov eax, dword [ebp - 4]
div ecx
push 0x72
mov dword [ebp - 4], eax
add dword [ebp - 4], 0x2cb3
or dword [ebp - 4], 0x33f0279a
add dword [ebp - 4], 0xe3c3
add dword [ebp - 4], 0xffff53a4
xor dword [ebp - 4], 0x33fd6f23
mov cl, byte [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], 0xc236
imul eax, dword [ebp - 4], 0x6e
shl esi, cl
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x28
mov dword [ebp - 4], eax
add dword [ebp - 4], 0xffff4cfd
or dword [ebp - 4], 0x7fdf76f7
imul eax, dword [ebp - 4], 0x34
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0xf965ffdc
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
movsx eax, byte [ebx]
mov dword [ebp - 8], eax
add dword [ebp - 8], esi
shl edx, cl
add dword [ebp - 8], edx
sub dword [ebp - 8], edi
inc ebx
pop ecx
cmp byte [ebx], 0
jne 0x402bd5
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402e39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
xor esi, esi
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
mov edi, dword [eax + ebx + 0x78]
add edi, ebx
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 0x14], eax
add ecx, ebx
mov eax, dword [edi + 0x24]
add eax, ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, esi
cmp dword [edi + 0x18], esi
jbe 0x402ec5
mov ecx, dword [ecx + eax*4]
add ecx, ebx
call fcn.00402aaf
xor eax, 0x4b09396a
cmp eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
je 0x402e9c
mov ecx, dword [ebp - 0xc]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [edi + 0x18]
jb 0x402e77
jmp 0x402ec5
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
movzx eax, word [ecx + eax*2]
mov esi, dword [esi + eax*4]
add esi, ebx
cmp esi, edi
jb 0x402ec5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx + 0x7c]
add eax, edi
cmp esi, eax
jae 0x402ec5
mov ecx, esi
call fcn.00402f05
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402ece
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov edi, dword [eax + 0xc]
mov ebx, ecx
add edi, 0xc
mov esi, dword [edi]
jmp 0x402ef6
mov ecx, dword [esi + 0x30]
call fcn.00402c81
xor eax, 0x765810a8
cmp eax, ebx
je 0x402f00
mov esi, dword [esi]
cmp esi, edi
jne 0x402ee3
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x18]
jmp 0x402efc

Function at 0x4030ab
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 4], eax
push edi
cmp edx, 0x40
jb 0x4031a5
call fcn.004031ac
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x4031a5
push esi
push 0x40
push 0x3000
push dword [edi + 0x50]
mov edx, 0x72d89f20
mov ecx, 0xf926f6da
push 0
push 0x95
call fcn.00402f91
pop ecx
call eax
mov esi, eax
test esi, esi
je 0x4031a0
movzx ecx, word [edi + 0x14]
lea eax, [edi + 0x18]
mov edx, dword [ebp - 4]
add eax, ecx
movzx ecx, word [edi + 6]
push ebx
push dword [edi + 0x54]
imul ebx, ecx, 0x28
mov ecx, esi
mov dword [ebp - 8], eax
add ebx, eax
call fcn.00403029
pop ecx
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jae 0x40316c
sub ebx, ecx
mov edi, dword [ebp - 4]
lea eax, [ecx + 0x10]
xor edx, edx
mov dword [ebp - 0xc], eax
push 0x28
lea eax, [ebx - 1]
mov ebx, dword [ebp - 0xc]
pop ecx
div ecx
inc eax
mov dword [ebp - 8], eax
mov ecx, dword [ebx]
cmp dword [ebx - 8], ecx
mov edx, dword [ebx + 4]
cmovb ecx, dword [ebx - 8]
add edx, edi
push ecx
mov ecx, dword [ebx - 4]
add ecx, esi
call fcn.00403029
dec dword [ebp - 8]
lea ebx, [ebx + 0x28]
pop ecx
jne 0x403147
mov edi, dword [ebp - 0x10]
mov edx, edi
mov ecx, esi
call fcn.0040328a
mov edx, edi
mov ecx, esi
call fcn.004031d5
pop ebx
test eax, eax
jne 0x4031a0
push 0x8000
push eax
push esi
push 8
mov edx, 0xb1fbe63d
mov ecx, 0xf926f6da
call fcn.00402f91
pop ecx
call eax
xor esi, esi
mov eax, esi
pop esi
jmp 0x4031a7
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4031ac
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4031b9
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4031b6
mov edx, 0x10b
xor ecx, ecx
cmp word [eax + 0x18], dx
cmovne eax, ecx
ret
Function at 0x406cdd
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ecx]
xor ebx, ebx
shr eax, 2
push edi
xor edi, edi
lea eax, [esi + eax*4]
mov ecx, eax
sub ecx, esi
add ecx, 3
shr ecx, 2
cmp esi, eax
cmova ecx, ebx
test ecx, ecx
je 0x406d0c
xor dword [esi], edx
inc edi
lea esi, [esi + 4]
cmp edi, ecx
jb 0x406d02
pop edi
pop esi
pop ebx
ret
Function at 0x1003f863
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003f2f3

Function at 0x10050d79
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10050c8d
Function at 0x402e68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
add esp, 0xfffffff4
push 0x104
call fcn.004039cc
mov edi, eax
add esp, 0xfffffff8
push dword [0x40901c]
push edi
call sub.msvcrt.dll_strcpy
add esp, 0x20
add esp, 0xfffffff8
push ebx
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push dword [0x40901c]
push edi
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff8
push dword [0x409018]
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push esi
push edi
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffffc
push 0x10
push 0
lea ebx, [ebp - 0x10]
push ebx
call sub.msvcrt.dll_memset
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 0xfffffffc
push edi
call fcn.0040387c
add esp, 0x20
add esp, 0xfffffff4
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x412d7a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412bf9

Function at 0x4170c3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416a31

Function at 0x4170ce
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416c6c

Function at 0x43b634
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub edx, edx
call fcn.0043b676
add esi, edx
add edx, 0xd5fd19f0
and edx, esi
xor dword [ecx], eax
sub esi, 0xc87513cd
mov esi, edx
sub esi, 0xc1682983
add ecx, 1
sub esi, 0x2cf04d4
cmp ecx, edi
jne fcn.0043b634
sub edx, 0x7df58ab7
inc edx
ret
Function at 0x41c663
Capabilities:
Encode data using xor

Disassembly:
and al, 0
add byte [0x894bf650], al
jle 0x41c649
mov byte [esi + 0xd], 0
push 0xe
add ah, byte [esi + 0x59]
mov ecx, dword [esi - 0x18]
cmp ch, byte [edi]
and al, 0
pop edx
call 0xea4059b8
lea edx, [esi]
dec esp
add byte [ecx - 0x173e7c01], cl
call 0x577351be
call 0x577351be
xor edi, edi
dec esi
sbb byte [ebp - 4], cl
js 0x41c6ae
lea eax, [esi + edi]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
push ebx
call 0x3024831
outsb dx, byte [esi]
xor byte [ebx - 0x7517ef83], al
cmp dword [ebp + 0x10], 0xffffffe8
mov cl, byte [edi - 0x14]
or al, 0x53
push ebx
push eax
sar byte [eax + 0x19], 0x7e
or cl, byte [ebp + 0x4d8b017b]
cld
cmp edi, esi
jle 0x41c670
cmp edi, esi
jg 0x41c6ae
and cl, byte [eax + eax - 0x18]
leave
mov dword [esi], edi
jmp 0x41c637
invalid

Function at 0x421c9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ecx, word [edi]
cmp di, word [esi - 0x1247bf1]
loope 0x421c89
dec dword [edi]
mov bh, 0xc
cmp byte [edi], cl
mov bh, 7
movzx ecx, word [eax + edi]
movzx eax, word [edi]
sub ecx, eax
adc eax, 0x4d48d14c
clc
jne 0x421ca8
add edi, esi
cmp word [eax + edi], cx
jne 0x421c7e
jmp 0x421ca8
cmp word [edi], cx
xor byte [esp + esi*4 - 0x7bf00002], al
jnp 0x421cc0
add edx, esi
add eax, esi
movzx ecx, word [edx]
jmp 0x3ba91be5
mov esi, 0xc033bb75
push es
add byte [ebx - 0x1c74a21b], cl
invalid
invalid

Function at 0x4223ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [eax], al
not dword [0x8c2f890]
test eax, eax
je 0x4223dc
push eax
call dword [section..data]
mov dword [0x4bbf0140], eax
add ah, cl
inc esp
add dword [eax], edx
in al, dx
dec esp
and al, 0x3c
call 0x18259d1
call dword [0xa048d100]
dec ebx
add cl, ch
loopne 0x422422
inc ebp
mov ch, byte [edx + 2]
cmovge edx, dword [eax]
sal byte [eax + ecx + 0x3b], 0xb0
xor bh, 0x85
leave
je 0x422421
dec esp
push ebp
inc ebp
sub edx, edi
movzx eax, word [edx + edi]
mov word [edi], ax
pop es
add edi, 2
enter 0xffffffffffffc18b, 3
dec ecx
jne 0x4223f3
test ecx, ecx
je 0x422421
dec ecx
je 0x422421
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x58f7529b
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x688c4424
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100029b9
Capabilities:
Create tcp socket

Disassembly:
push 6
push 1
push 2
call sub.WS2_32.dll_socket
pop edx
mov edx, dword [esp - 4]
jmp edx