joyce8/EMBER2024-capa huggingface dataset:
Function at 0x117ec50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd60000]
push edi
or ebp, 0xffffffff
jmp 0x117ec72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x117ec79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x117ec68
mov eax, 1
add ebx, ebx
jne 0x117ec8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x117ec9c
jne 0x117ecbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x117ecbb
dec eax
add ebx, ebx
jne 0x117eca8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x117ec80
add ebx, ebx
jne 0x117ecb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x117ed0d
xor ecx, ecx
sub eax, 3
jb 0x117ecd3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x117ed42
sar eax, 1
mov ebp, eax
jmp 0x117ecde
add ebx, ebx
jne 0x117ecde
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x117ecac
inc ecx
add ebx, ebx
jne 0x117ecec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x117ecac
add ebx, ebx
jne 0x117ecf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x117ecee
jne 0x117ed0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x117ecee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x117ed2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x117ed1e
jmp 0x117ec6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x117ed2c
add edi, ecx
jmp 0x117ec6e
pop esi
mov edi, esi
mov ecx, 0x19
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x117ed4a
cmp byte [edi], 1
jne 0x117ed4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x117ed4f
mov ebp, dword [esi + 0xd9d564]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x117edaa
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4a1330
Capabilities:
Encode data using xor

Disassembly:
sub cl, al
sti
and dword ds:[edx - 0x5c], edx
xor dword [edi - 0x19], edi
push eax
inc eax
xor al, 0xd6
add ecx, ebp
inc eax
or byte [edi - 0x35], cl
mov ch, 0xb5
mov byte [0x54437977], al
fild dword [eax + 0x2c]
lea eax, [edx + 0x424efa56]
call 0xe38ebea1
jge 0x47f257
hlt
pushal
mov esi, section.UPX1
lea edi, [esi - 0x67000]
mov dword [edi + 0x82710], 0x2fb6265f
push edi
or ebp, 0xffffffff
jmp 0x4a135a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a1361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a1350
mov eax, 1
add ebx, ebx
jne 0x4a1373
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a1384
jne 0x4a1394
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a1394
dec eax
add ebx, ebx
jne 0x4a1390
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a1368
xor ecx, ecx
sub eax, 3
jb 0x4a13ac
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a141e
sar eax, 1
mov ebp, eax
jmp 0x4a13b7
add ebx, ebx
jne 0x4a13b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4a13c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4a13e8
inc ecx
add ebx, ebx
jne 0x4a13d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a13c9
jne 0x4a13e5
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a13c9
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a1408
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a13f9
jmp 0x4a1356
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a1408
add edi, ecx
jmp 0x4a1356
pop esi
mov edi, esi
mov ecx, 0x3f88
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a1426
cmp byte [edi], 0x23
jne 0x4a1426
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4a142b
lea edi, [esi + 0x9d000]
mov eax, dword [edi]
or eax, eax
je 0x4a149a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa23c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa24a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a1458
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa24a4]
or eax, eax
je 0x4a1494
mov dword [ebx], eax
add ebx, 4
jmp 0x4a1475
call dword [esi + 0xa24a8]
popal
jmp 0x47f254
Function at 0x41f320
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x41f342
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f349
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f338
mov eax, 1
add ebx, ebx
jne 0x41f35b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f350
jne 0x41f36c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f350
xor ecx, ecx
sub eax, 3
jb 0x41f380
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f3f2
mov ebp, eax
add ebx, ebx
jne 0x41f38b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f398
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f3bc
inc ecx
add ebx, ebx
jne 0x41f3a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f39d
jne 0x41f3b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f39d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f3dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f3cd
jmp 0x41f33e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f3dc
add edi, ecx
jmp 0x41f33e
pop esi
mov edi, esi
mov ecx, 0x202
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f3fa
cmp byte [edi], 6
jne 0x41f3fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41f3ff
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f477
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ffc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20000]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f42c
mov ecx, edi
jns 0x41f45b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20008]
or eax, eax
je 0x41f471
mov dword [ebx], eax
add ebx, 4
jmp 0x41f449
call dword [esi + 0x20004]
mov ebp, dword [esi + 0x2000c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41f4ab
sub esp, 0xffffff80
jmp 0x40290c

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov al, 0x45
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x28], al
mov al, 0x6c
xor ebx, ebx
push str.HeapFree
push str.kernel32.dll
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x1c], eax
mov al, 0x65
mov cl, 0x73
mov byte [ebp - 0x3b], al
mov byte [ebp - 0x35], al
mov byte [ebp - 0x31], al
mov byte [ebp - 0x34], cl
mov byte [ebp - 0x33], cl
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
push eax
push ecx
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x50
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x32], 0x48
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x70
mov byte [ebp - 0x2e], bl
call esi
push eax
call edi
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
lea edx, [ebp - 0x14]
push 0x426ce0
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x63
call fcn.0040ad62
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [ebp - 0x18]
push eax
call dword [ebp - 0x1c]
mov eax, 0x4011f2
ret
Function at 0x401590
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push str.VirtualAlloc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [ebp + 0x10]
xor edx, edx
push 0x426ce0
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x24]
mov dx, word [eax + 0x14]
push ecx
mov dword [ebp - 0x24], 0x50
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0x14], eax
call fcn.0040ad62
mov dword [ebp - 0x10], esp
inc eax
dec ebx
dec eax
inc ebx
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 6]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
jge 0x401701
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40167c
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x38]
test ebx, ebx
jle 0x4016ef
mov eax, dword [esi + 0xc]
mov edx, dword [ebp - 0x1c]
push 4
push 0x1000
add eax, edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0x18]
inc ecx
add esi, 0x28
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
jmp 0x401614
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov esi, dword [ebp - 0x1c]
push 4
push 0x1000
add ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea edx, [ebp - 0x28]
push 0x426ce0
push edx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0x55
call fcn.0040ad62
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov eax, ecx
add esi, edi
mov edi, dword [ebp - 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x4016db
and ecx, 3
rep movsb byte es:[edi], byte [esi]
ret
mov ecx, dword [ebp - 0x18]
inc ecx
add esi, 0x28
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
jmp 0x401614
mov eax, 0x401707
ret
Function at 0x401720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420770
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [ebp - 0x10], esp
push str.VirtualFree
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
nop
nop
nop
nop
nop
push str.VirtualProtect
push str.kernel32.dll
call esi
push eax
call edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [eax]
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x18], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x14]
push 0x426ce0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x40
call fcn.0040ad62
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [edi]
cmp word [ecx + 6], bx
jbe 0x401873
mov edx, dword [ebp - 0x18]
lea esi, [edx + 0x24]
mov eax, dword [esi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
and ecx, 1
and edx, 1
shr eax, 0x1f
nop
nop
nop
nop
test byte [esi + 3], 2
je 0x4017f5
mov eax, dword [esi - 0x14]
mov ecx, dword [esi - 0x1c]
push 0x4000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40185f
nop
nop
nop
nop
nop
lea edx, [edx + ecx*2]
lea eax, [eax + edx*2]
mov edx, dword [eax*4 + 0x474e1c]
mov eax, dword [esi]
test eax, 0x4000000
je 0x401813
or dh, 2
nop
nop
nop
nop
nop
nop
mov eax, dword [esi - 0x14]
test eax, eax
jne 0x401838
mov ecx, dword [esi]
test cl, 0x40
je 0x40182e
mov ecx, dword [edi]
mov eax, dword [ecx + 0x20]
jmp 0x401838
test cl, 0x80
je 0x401838
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
nop
nop
nop
nop
nop
nop
test eax, eax
jbe 0x40185f
mov eax, dword [esi - 0x1c]
lea ecx, [ebp + 8]
push ecx
push edx
mov edx, dword [esi - 0x14]
push edx
push eax
call dword [ebp - 0x1c]
test eax, eax
jne 0x40185f
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi]
xor edx, edx
inc ebx
add esi, 0x28
mov dx, word [ecx + 6]
cmp ebx, edx
jl 0x4017c1
mov eax, 0x401879
ret
Function at 0x401d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4207b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [ebp - 0x10], esp
push str.HeapFree
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x20], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov al, 0x45
mov cl, 0x72
mov byte [ebp - 0x3b], al
mov byte [ebp - 0x38], al
mov al, 0x6c
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], al
mov byte [ebp - 0x26], al
mov al, 0x65
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], al
mov byte [ebp - 0x24], cl
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
xor ebx, ebx
push eax
push ecx
mov byte [ebp - 0x3c], 0x4b
mov byte [ebp - 0x3a], 0x52
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x37], 0x4c
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2c], 0x56
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x25], 0x46
mov byte [ebp - 0x21], bl
call esi
push eax
call edi
push str.GetProcessHeap
push str.KERNEL32.dll
mov dword [ebp - 0x18], eax
call esi
push eax
call edi
mov dword [ebp - 0x1c], eax
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x14]
push 0x426ce0
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x44
call fcn.0040ad62
mov esi, dword [ebp + 8]
test esi, esi
je 0x401ed1
mov eax, dword [esi + 0x10]
test eax, eax
je 0x401e6c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [eax + 0x28]
add ecx, ebx
inc eax
dec ebx
dec eax
inc ebx
mov edx, dword [esi + 4]
push 0
push 0
push edx
call ecx
mov dword [esi + 0x10], 0
nop
nop
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x401eab
mov eax, dword [esi + 0xc]
xor edi, edi
test eax, eax
jle 0x401e9b
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 8]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x401e93
push eax
call ebx
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x401e85
inc eax
dec ebx
dec eax
inc ebx
mov ecx, dword [esi + 8]
push ecx
call fcn.00401100
add esp, 4
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x401ec1
push 0x8000
push 0
push eax
call dword [ebp - 0x18]
nop
nop
nop
nop
nop
nop
push esi
push 0
call dword [ebp - 0x1c]
push eax
call dword [ebp - 0x20]
mov eax, 0x401ed7
ret
Function at 0x401fb0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using xxtea

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
cmp ebx, 1
push edi
jle 0x4020c1
mov eax, 0x34
mov edi, dword [esp + 0x1c]
cdq
idiv ebx
xor ecx, ecx
add eax, 6
mov dword [esp + 0x14], eax
xor eax, eax
mov al, byte [edi + ebx - 1]
jmp 0x401fe5
mov ebx, dword [esp + 0x20]
sub ecx, 0x61c88647
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x10], ecx
shr ebp, 2
lea ecx, [ebx - 1]
and ebp, 3
test ecx, ecx
jbe 0x402059
xor ecx, ecx
mov bl, al
mov cl, byte [esi + edi + 1]
mov edx, ecx
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov ebx, eax
shr ebx, 5
shl cl, 2
xor bl, cl
mov ecx, esi
and ecx, 3
add dl, bl
mov ebx, dword [esp + 0x24]
xor ecx, ebp
mov cl, byte [ebx + ecx*4]
mov bl, byte [esp + 0x1c]
xor cl, al
mov al, byte [esp + 0x10]
xor al, bl
mov bl, byte [esi + edi]
add cl, al
xor dl, cl
mov ecx, dword [esp + 0x20]
add bl, dl
mov al, bl
mov byte [esi + edi], bl
and eax, 0xff
inc esi
dec ecx
cmp esi, ecx
jb 0x402000
xor ecx, ecx
mov bl, al
mov cl, byte [edi]
and esi, 3
mov edx, ecx
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov ebx, eax
shr ebx, 5
shl cl, 2
xor bl, cl
mov ecx, dword [esp + 0x24]
xor esi, ebp
add dl, bl
mov bl, byte [ecx + esi*4]
mov ecx, dword [esp + 0x10]
xor bl, al
mov al, cl
xor al, byte [esp + 0x1c]
add bl, al
mov eax, dword [esp + 0x20]
xor dl, bl
mov bl, byte [edi + eax - 1]
add bl, dl
mov edx, dword [esp + 0x14]
mov byte [edi + eax - 1], bl
mov al, bl
and eax, 0xff
dec edx
mov dword [esp + 0x14], edx
jne 0x401fe1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ebx, 0xffffffff
jge 0x4021c4
mov eax, 0x34
mov edi, dword [esp + 0x1c]
cdq
neg ebx
idiv ebx
mov dword [esp + 0x20], ebx
add eax, 6
mov ebp, eax
mov dword [esp + 0x14], eax
imul ebp, ebp, 0x9e3779b9
xor eax, eax
mov dword [esp + 0x10], ebp
mov al, byte [edi]
jmp 0x4020f9
mov ebx, dword [esp + 0x20]
shr ebp, 2
lea esi, [ebx - 1]
and ebp, 3
test esi, esi
jbe 0x40215c
xor ecx, ecx
mov edx, eax
mov cl, byte [esi + edi - 1]
mov bl, cl
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov bl, al
shr ecx, 5
shl bl, 2
xor cl, bl
mov ebx, dword [esp + 0x24]
add dl, cl
mov ecx, esi
and ecx, 3
xor ecx, ebp
mov cl, byte [ebx + ecx*4]
mov bl, byte [esp + 0x1c]
xor cl, bl
mov bl, byte [esp + 0x10]
xor bl, al
add cl, bl
mov bl, byte [esi + edi]
xor dl, cl
sub bl, dl
mov al, bl
mov byte [esi + edi], bl
and eax, 0xff
dec esi
jne 0x402106
mov ebx, dword [esp + 0x20]
xor ecx, ecx
mov edx, eax
mov cl, byte [edi + ebx - 1]
and esi, 3
mov bl, cl
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov bl, al
shr ecx, 5
shl bl, 2
xor cl, bl
mov bl, byte [esp + 0x1c]
add dl, cl
mov ecx, dword [esp + 0x24]
xor esi, ebp
mov ebp, dword [esp + 0x10]
add ebp, 0x61c88647
mov cl, byte [ecx + esi*4]
xor cl, bl
mov bl, byte [esp + 0x10]
xor bl, al
mov dword [esp + 0x10], ebp
add cl, bl
mov bl, byte [edi]
xor dl, cl
mov ecx, dword [esp + 0x14]
sub bl, dl
mov al, bl
mov byte [edi], bl
and eax, 0xff
dec ecx
mov dword [esp + 0x14], ecx
jne 0x4020f5
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x417ffd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41803f
call fcn.0041dcde
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41803f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x418036
xor eax, eax
jmp 0x418047
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041804d
pop edi
pop esi
pop ebx
ret 4
Function at 0x1000aded
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [0x1004fd68]
add edx, 0xffffd94f
mov dword [0x1004fd64], edx
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
jmp 0x1000ae92
mov eax, dword [ebp - 0x20]
add eax, 0xffffe7d7
mov dword [0x1004fd64], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1000af19
jmp 0x1000aebb
mov eax, 1
mov dword [0x1004fd64], 0xb63
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x28], eax
jne 0x1000aebb
mov eax, dword [ebp - 0x28]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000af2e
jmp 0x1000aebb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, eax
add edx, 0xffffe3e9
mov esi, dword [ebp - 0x14]
cmp word [esi + ecx*2], 0
mov edi, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], edi
je 0x1000aedf
jmp 0x1000aec2
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000ae73
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x34], eax
jl 0x1000ae92
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [0x1004fd64], ecx
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
jne 0x1000aebb
mov dword [0x1004fd68], 0x7a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1000ae30
jmp 0x1000aebb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000ae7d
jmp 0x1000aebb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1000ae52
jmp 0x1000aebb