joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d4f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4166ab
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x41f650]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push 0
lea ecx, [ebp - 0x222]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x224]
push edx
call sub.OSUtil.dll_Ordinal_1
add esp, 4
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402420
mov dword [ebp - 4], 0
push str.9eMobileLauncher.exe
lea ecx, [ebp - 0x14]
call fcn.004088a0
push 1
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.004088e0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004024a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041479a
mov esp, ebp
pop ebp
ret

Function at 0x411dc0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
call fcn.00411e70
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x41f780], eax
cmp dword [0x41f780], 0
jne 0x411de8
xor al, al
jmp 0x411e2d
cmp dword [0x41f784], 0
je 0x411df5
xor al, al
jmp 0x411e2d
push 0
push 4
push 0
push 0x412390
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [0x41f784], eax
cmp dword [0x41f784], 0
jne 0x411e1f
xor al, al
jmp 0x411e2d
mov eax, dword [0x41f784]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop ebp
ret
Function at 0x414350
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x41f82c], 0
push esi
jne 0x4142be
call fcn.004141d2
test eax, eax
je 0x414301
mov eax, dword [0x41f82c]
cmp eax, 1
jne 0x4142df
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x414301
pop esi
ret
push eax
call dword [0x41f834]
test eax, eax
jne 0x414349
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x414305
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x41f82c]
call dword [0x41f834]
mov edi, eax
test edi, edi
je 0x41432a
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x414346
mov edi, esi
add esi, 0xff0
push edi
push dword [0x41f82c]
call dword [0x41f830]
add edi, 0x10
cmp edi, esi
jb 0x414332
mov eax, edi
pop edi
pop esi
ret
jmp 0x4142ab

Function at 0x41479a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f650]
jne 0x4147a4
repz ret
jmp fcn.00414e91
Function at 0x1017824c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101c2e00]
jne 0x10178256
repz ret
jmp fcn.101784fd

Function at 0x101788a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [0x101c2ddc], 0xea1
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x101c2ddc], 0x12cc
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10178902
mov eax, 0x19cd
mov ecx, dword [ebp - 0x18]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], eax
jge 0x10178939
mov eax, dword [ebp - 0x14]
mov ecx, 0x1bd2
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
je 0x10178939
jmp 0x101788e1
mov eax, 1
mov dword [0x101c2de0], 0x369d
mov dword [ebp - 0x24], eax
jmp 0x10178a01
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov dword [0x101c2de0], eax
mov dword [0x101c2ddc], 0x6b6
mov eax, dword [ebp - 0x10]
cmp word [eax + ecx*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
je 0x101789b5
jmp 0x10178a01
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x24], eax
jne 0x10178a01
xor eax, eax
mov dword [0x101c2ddc], 0xffffe770
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x24], eax
je 0x101789df
jmp 0x10178a01
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x24], eax
je 0x10178967
jmp 0x10178a01
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x24], eax
jne 0x10178a01
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x24], eax
je 0x1017899f
jmp 0x10178a01
xor eax, eax
mov dword [0x101c2ddc], 0x251c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x10178922
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x10178b10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101c2de8], 0
mov byte [0x101c2dec], 0
mov dword [0x101c2ddc], 0x19f5
mov dword [0x101c2de4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10178c54
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [ebp - 0x2c], eax
mov eax, edx
xor edi, edi
mov dword [ebp - 0x30], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
add ecx, 0xffffe1b1
mov ebx, dword [ebp - 0x2c]
add ebx, 0xffffe791
mov dword [0x101c2df0], 0
mov dword [0x101c2de0], ecx
mov ecx, dword [0x101c2de8]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [edi + ecx]
mov edi, dword [ebp - 0x34]
add ecx, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ecx, edx
mov dword [0x101c2df0], ecx
mov eax, ecx
cdq
idiv esi
mov dword [0x101c2de8], edx
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x101c2dec], cl
mov dword [0x101c2de0], ebx
mov ebx, dword [ebp - 0x18]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101c2dec]
mov edx, dword [0x101c2de8]
mov byte [ebx + edx], cl
mov edx, dword [0x101c2de4]
add edx, 1
mov dword [0x101c2de4], edx
cmp edx, 0x100
mov dword [ebp - 0x38], edx
jl 0x10178c92
jmp 0x10178c42
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x1a82
mov dword [0x101c2ddc], 0x1a82
mov dword [0x101c2de4], 0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
jmp 0x10178b5a
mov dword [0x101c2de0], 0x2635
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101c2ddc]
add eax, 0x1e60
mov dword [0x101c2de0], eax
mov esi, dword [0x101c2de4]
add esi, 1
mov dword [0x101c2de4], esi
cmp esi, 0x100
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], esi
jl 0x10178c54
jmp 0x10178c16
mov eax, dword [0x101c2de0]
mov ecx, dword [0x101c2ddc]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x10178b5a
Function at 0x10179440
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x28]
mov esi, dword [0x101c2ddc]
mov edi, esi
add edi, 0xffffe61c
mov dword [0x101c2de0], edi
mov byte [ebp - 0x28], 0x56
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x75
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x41
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x63
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0xfa
add esi, 0xffffecf1
mov dword [0x101c2ddc], esi
mov dword [esp], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
call fcn.10179fc0
cmp eax, 0
mov dword [ebp - 0x34], eax
je 0x10179592
mov dword [0x101c2de0], 0x12d8
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101c2de0]
add ecx, 0x206f
mov dword [0x101c2ddc], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.101798c0
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101c2ddc], 0x22f9
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x101c2de0], 0x2203
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov dword [edx + 8], ecx
mov esi, dword [0x101c2ddc]
add esi, 0xffffe791
mov dword [0x101c2ddc], esi
add ecx, 0x1e1f
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x10179588
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x48
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x48
pop esi
pop edi
pop ebp
ret
Function at 0x10179fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dl, 0x6b
lea esi, [ebp - 0x4c]
lea edi, [ebp - 0x6c]
mov ebx, dword [0x101c2de0]
add ebx, 0x24ef
mov dword [0x101c2de0], ebx
mov byte [ebp - 0x6c], 0x6b
mov byte [ebp - 0x6b], 0x65
mov byte [ebp - 0x6a], 0x72
mov byte [ebp - 0x69], 0x6e
mov byte [ebp - 0x68], 0x65
mov byte [ebp - 0x67], 0x6c
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x32
mov byte [ebp - 0x64], 0x2e
mov byte [ebp - 0x63], 0x64
mov byte [ebp - 0x62], 0x6c
mov byte [ebp - 0x61], 0x6c
mov byte [ebp - 0x60], 0
mov byte [ebp - 0x5f], 0xfa
mov dword [0x101c2ddc], 0x1d55
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0x7d], dl
jmp 0x1017a087
xor eax, eax
lea ecx, [ebp - 0x4c]
mov dword [0x101c2ddc], 0x23d0
mov dword [0x101c2de0], 0x25ea
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0x84], eax
call fcn.10178fe0
mov dword [esp], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
call fcn.10179700
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x7d]
mov ecx, dword [ebp - 0x78]
mov edx, ecx
inc edx
movsx esi, al
mov di, si
mov word [ebp + ecx*2 - 0x4c], di
mov al, byte [ebp + ecx - 0x6b]
cmp al, 0
mov dword [ebp - 0x78], edx
mov byte [ebp - 0x7d], al
je 0x1017a03e
jmp 0x1017a087
Function at 0x1017a0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101c2de4], 0
mov dword [0x101c2de8], 0
mov dword [0x101c2df4], 0
mov dword [0x101c2ddc], 0x2448
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jne 0x1017a10a
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x1017a100
xor eax, eax
mov ecx, 0x2448
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
jmp 0x1017a123
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
mov dword [0x101c2de0], 0x264a
mov ebx, esi
add ebx, 1
add edx, 1
add eax, 0xffffffa9
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x101c2de4], edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x30]
mov dword [0x101c2ddc], ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x101c2de8], edx
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x38]
mov cl, byte [ecx + edi]
mov byte [0x101c2dec], cl
mov dword [0x101c2de0], 0x20ef
mov ecx, dword [ebp - 0x1c]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x1c]
mov byte [edx + edi], cl
mov cl, byte [0x101c2dec]
mov edx, dword [0x101c2de8]
mov edi, dword [ebp - 0x1c]
mov byte [edi + edx], cl
mov edx, dword [0x101c2ddc]
mov ecx, edx
add ecx, 0xffffe99b
mov dword [0x101c2de0], ecx
mov ecx, dword [0x101c2de4]
movzx ecx, byte [edi + ecx]
mov edi, dword [0x101c2de8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edi]
mov ecx, dword [ebp - 0x3c]
add edi, ecx
and edi, 0xff
mov dword [0x101c2df4], edi
mov dword [0x101c2de0], 0x1562
mov ecx, dword [ebp - 0x1c]
mov cl, byte [ecx + edi]
mov edi, dword [ebp - 0x14]
mov ch, byte [edi + esi]
add edx, 0x5a6
mov dword [0x101c2de0], edx
xor ch, cl
mov dword [0x101c2ddc], 0x6a8
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x40], ebx
je 0x1017a108
mov eax, dword [0x101c2ddc]
mov ecx, dword [0x101c2de8]
mov edx, dword [0x101c2de4]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
jmp 0x1017a123
Function at 0x1017a270
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x101c2ddc]
add edx, 0xffffef19
mov dword [0x101c2de0], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10179a50
lea ecx, [0x10178a10]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x54], 0x138e00
mov edx, dword [0x101c2dc8]
mov dword [esp + 0x8c], edx
mov edx, dword [0x101c2dcc]
mov dword [esp + 0x90], edx
mov edx, dword [0x101c2dd0]
mov dword [esp + 0x84], edx
mov edx, dword [0x101c2dd4]
mov dword [esp + 0x48], edx
mov edx, dword [0x101c2dd8]
mov dword [esp + 0x58], edx
mov dword [0x101c2de0], 0x717
mov dword [0x101c2ddc], 0x127a
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1017a361
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1017a361
lea eax, [esp + 0x38]
mov dword [0x101c2ddc], 0xf39
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10179440
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x1017a311
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
jne 0x1017a311
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x78], ecx
mov dword [0x101c2ddc], 0x25db
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x50], eax
call fcn.101788a0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
je 0x1017a325
jmp 0x1017a359
Function at 0x10602058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106021a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1060207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1060206a
add dl, dl
jne 0x10602089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106020dc
xor eax, eax
add dl, dl
jne 0x10602096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1060217d
add dl, dl
jne 0x106020a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106020b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106020bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106020c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106020d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10602075
mov eax, 1
add dl, dl
jne 0x106020ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106020f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106020e1
sub eax, ebx
mov ebx, 1
jne 0x10602128
mov ecx, 1
add dl, dl
jne 0x1060210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10602119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10602105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10602075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1060213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1060214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10602136
cmp eax, 0x7d00
jae 0x1060216d
cmp eax, 0x500
jb 0x10602168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10602075
cmp eax, 0x7f
ja 0x10602170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10602075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1060219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10602075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x405b32
pop dword [ebp - 0x20]
mov eax, 0x3ad482ae
sub eax, 0x3a94277c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x131790b
add dword [ebp - 0x30], 0x4d20cc40
mov dword [ebp - 0x2c], 0xaf0acb2c
sub dword [ebp - 0x2c], 0x7cd77ee7
mov dword [ebp - 0x28], 0x8bb42ae9
add dword [ebp - 0x28], 0xc0981945
mov dword [ebp - 0x24], 0xf1bbda30
add dword [ebp - 0x24], 0xe4425d0
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa2e4460f
sub dword [ebp - 0x30], 0x2e71dcb9
mov dword [ebp - 0x2c], 0xcc8e3269
sub dword [ebp - 0x2c], 0x8b21d0f4
mov dword [ebp - 0x28], 0x68077691
add dword [ebp - 0x28], 0xfb67f5db
mov dword [ebp - 0x24], 0x589303d6
sub dword [ebp - 0x24], 0x589303d6
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x8b21e3f6
sub eax, 0x8ae1637a
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39bc4
push 0
call eax
mov ecx, 0x884c69d5
sub ecx, 0x884c16ee
xor edi, edi
add edi, eax
mov ebx, 0xa3f415ea
add ebx, 0x5c50fe16
add ebx, dword [ebp - 0x20]
mov esi, 0x1166638c
add esi, 0x1d6e08f2
mov dword [ebp - 0x1c], 0xe0b0a8dd
mov edx, dword [ebx]
mov dword [ebp - 0x10], 0x4d21d172
sub edx, esi
add dword [ebp - 0x14], ebx
mov dword [edi], edx
xor dword [ebp - 0xc], edx
add edi, 0xd0257d72
sub edi, 0xd0257d6e
add ebx, 0x1b1483e8
sub ebx, 0x1b1483e4
loop 0x405c51
add eax, 0x483e62c
sub eax, 0x482a7bd
mov ebx, eax
add eax, 0xcfd695ef
add eax, 0x30296a16
mov ecx, 0xb7e20185
add ecx, 0x485dfe7b
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x58d9626c
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x78354518
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x427d89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x427dcb
call fcn.0042b2d5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x427dcb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x427dc2
xor eax, eax
jmp 0x427dd3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00427dd9
pop edi
pop esi
pop ebx
ret 4

Function at 0x42c2c8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42c2f6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42c314
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042c22e
jmp 0x42c314
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42c314
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042c22e
test edi, edi
mov eax, edi
jne 0x42c2fe
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8