joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4148ed
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0xc
mov eax, 1
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x414936
push 0
push 0x425bc4
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
jmp 0x414948
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
call fcn.0041e381
mov dword [ebp - 8], eax
mov eax, 6
xchg edx, eax
mov eax, dword [ebp - 8]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], edx
push dword [ebp - 0xc]
call fcn.0040fe74
mov edx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x417a92
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
je 0x417ac6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x417ac6
xor eax, eax
jmp 0x417ac9
xor eax, eax
inc eax
cmp eax, 0
je 0x417b1b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
call fcn.004175d4
mov dword [ebp - 0xc], eax
push 0
push 0x425da0
push 6
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
push eax
push 6
push 0
push 0x425dae
push 6
push 0x24
lea esi, [esp + 4]
push esi
push 3
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x417b71
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
call fcn.004175d4
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
push eax
push 6
push 0
push 0x425dc0
push 6
push 0x18
lea esi, [esp + 4]
push esi
push 2
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0x400000
cmp eax, 0
je 0x417b9e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
xchg edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
jmp 0x417bc6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xchg edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
leave
ret 4
Function at 0x4181ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x41820d
cmp eax, 2
je 0x41828a
cmp eax, 1
je 0x4182ba
push 0
push 0x425e4b
push 6
push 0
push dword [ebp + 0x10]
push 2
push 0
push 0x425e6a
push 6
push 0x24
lea esi, [esp + 4]
push esi
push 3
call fcn.0040ebd9
jmp 0x4182cc
mov eax, dword [ebp - 8]
cmp eax, 0xa
je 0x41824d
mov eax, dword [ebp - 8]
cmp eax, 0xd
je 0x41824d
mov eax, dword [ebp - 8]
cmp eax, 0xb
je 0x41824d
mov eax, dword [ebp - 8]
cmp eax, 0xc
je 0x41824d
mov eax, dword [ebp - 8]
cmp eax, 0xe
je 0x41824d
mov eax, dword [ebp - 8]
cmp eax, 0x1a
je 0x41824d
xor eax, eax
jmp 0x418250
xor eax, eax
inc eax
cmp eax, 0
je 0x41827e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
call fcn.00417608
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.00417608
pop edx
xchg edx, eax
cmp eax, edx
jne 0x41827e
jmp 0x418282
xor eax, eax
jmp 0x418285
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
jmp 0x4182cc
mov eax, dword [ebp - 8]
cmp eax, 0xa
jne 0x4182ae
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
xchg edx, eax
cmp eax, edx
jne 0x4182ae
jmp 0x4182b2
xor eax, eax
jmp 0x4182b5
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
jmp 0x4182cc
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004181ac
xor al, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 0xc

Function at 0x419072
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 4
mov eax, dword [ebp + 0xc]
mov edx, dword [0x4220d8]
cmp eax, edx
jne 0x4190bf
mov eax, dword [0x422250]
mov dword [ebp - 8], eax
mov eax, 5
xchg edx, eax
mov eax, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 8], edx
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], edx
jmp 0x419127
mov eax, dword [ebp + 0xc]
mov edx, dword [0x4220e0]
cmp eax, edx
jne 0x4190f0
push 0
push 0x425eff
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
jmp 0x419127
xor eax, eax
inc eax
je 0x419119
push 0
push 0x425f23
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
jmp 0x419127
call fcn.0041911e
Function at 0x41a192
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0x1c
push 8
call fcn.00411f10
mov dword [ebp - 8], eax
push dword [0x422104]
push dword [ebp - 8]
call fcn.00411b1a
xor eax, eax
push eax
push dword [ebp + 8]
call fcn.00411c37
mov dword [ebp - 0xc], eax
push dword [0x422104]
push dword [ebp - 0xc]
call fcn.00411b1a
mov eax, dword [0x422108]
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
xor eax, eax
push eax
xor eax, eax
push eax
xor eax, eax
push eax
push 0
push 0
xor eax, eax
push eax
xor eax, eax
push eax
xor eax, eax
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.00412872
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 3
jne 0x41a214
xor eax, eax
jmp 0x41a217
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0
je 0x41a257
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], edx
push 1
call fcn.0041e3f2
push dword [ebp - 0xc]
call fcn.00411a84
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
call fcn.00411ab8
mov dword [ebp - 0x18], eax
jmp 0x41a2e7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xa
je 0x41a2ca
cmp eax, 0xb
je 0x41a2d1
cmp eax, 0xd
je 0x41a2d1
cmp eax, 0xe
je 0x41a2d1
mov eax, dword [ebp - 0x20]
cmp eax, 0
je 0x41a2c8
push 0
push 0x426055
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
jmp 0x41a2dc
mov eax, 0
jmp 0x41a2dc
mov eax, 0xa
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jb 0x41a276
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.0041a02a
push dword [ebp - 8]
call fcn.00411a42
mov edx, eax
mov eax, 1
cmp eax, edx
jge 0x41a31d
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00411b37
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x41a324
Capabilities:
Encrypt data using rc4 prga
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0x10
push dword [ebp + 8]
call fcn.00411a84
mov dword [ebp - 8], eax
push dword [ebp + 8]
call fcn.00411ab8
mov dword [ebp - 0xc], eax
jmp 0x41a482
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xd
je 0x41a3bd
cmp eax, 0xa
je 0x41a3bd
cmp eax, 0xb
je 0x41a415
cmp eax, 6
je 0x41a477
cmp eax, 5
je 0x41a477
cmp eax, 0xe
je 0x41a477
cmp eax, 0xc
je 0x41a477
push 0
push 0x4260b0
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
jmp 0x41a482
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, edx
jae 0x41a3e5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
jne 0x41a3e5
jmp 0x41a3e9
xor eax, eax
jmp 0x41a3ec
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x41a400
mov eax, 2
jmp 0x41a405
mov eax, 1
mov edx, eax
mov eax, dword [ebp - 8]
xchg edx, eax
shl eax, 4
add eax, edx
mov dword [ebp - 8], eax
jmp 0x41a482
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, edx
jae 0x41a43d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
jne 0x41a43d
jmp 0x41a441
xor eax, eax
jmp 0x41a444
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x41a46f
push 0
push 0x426077
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x41a482
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp eax, edx
jb 0x41a347
leave
ret 4

Function at 0x41be61
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 4
mov eax, dword [ebp + 8]
shl eax, 8
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [0x422094]
mov edi, dword [ebp - 8]
dec edi
mov eax, dword [eax + edi*4]
mov dword [ebp - 8], eax
mov eax, 0
mov edx, dword [ebp - 8]
cmp eax, edx
jne 0x41becb
push 0
push dword [ebp + 8]
push 2
push 0
push 0x426258
push 6
push 0
push dword [ebp + 0xc]
push 2
push 0
push 0x426270
push 6
push 0x30
lea esi, [esp + 4]
push esi
push 4
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x41bf15
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0xc
mov eax, dword [0x422250]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x41bf6b
cmp eax, 4
je 0x41bf7c
push 0
push 0x42628b
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, 0
jmp 0x41bf94
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
jmp 0x41bf94
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, 2
sub eax, edx
leave
ret

Function at 0x41e06b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x422294]
mov edx, dword [0x422248]
cmp eax, edx
jne 0x41e0a1
push 0
push 0x426324
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
shl eax, 8
mov edx, eax
mov eax, 0x40000000
or eax, edx
mov edx, eax
mov eax, dword [0x422294]
mov dword [eax], edx
mov eax, dword [0x422250]
xchg edx, eax
mov eax, dword [0x422294]
mov dword [eax + 4], edx
mov eax, dword [0x422278]
mov dword [0x422250], eax
mov eax, dword [0x422294]
add eax, 8
mov dword [0x422294], eax
leave
ret 4

Function at 0x41e0ed
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x422294]
mov edx, dword [0x422248]
cmp eax, edx
jne 0x41e123
push 0
push 0x426346
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
shl eax, 8
mov edx, eax
mov eax, 0x80000000
or eax, edx
mov edx, eax
mov eax, dword [0x422294]
mov dword [eax], edx
mov eax, dword [0x422250]
xchg edx, eax
mov eax, dword [0x422294]
mov dword [eax + 4], edx
mov eax, dword [0x422278]
mov dword [0x422250], eax
mov eax, dword [0x422294]
add eax, 8
mov dword [0x422294], eax
leave
ret 4

Function at 0x41e381
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 4
mov eax, dword [0x422278]
mov dword [ebp - 8], eax
mov eax, dword [0x422278]
add eax, 0x10
mov dword [0x422278], eax
mov eax, dword [0x422278]
mov edx, dword [0x422234]
cmp eax, edx
jb 0x41e3d1
push 0
push 0x4263ac
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 8]
leave
ret
Function at 0x41ef78
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xd
jne 0x41ef9b
push dword [ebp + 8]
call fcn.00417a92
jmp 0x41efc4
mov eax, 0
mov edx, dword [ebp + 0x18]
cmp eax, edx
jne 0x41efac
mov eax, dword [ebp + 8]
jmp 0x41efc4
xor eax, eax
inc eax
je 0x41efb6
mov eax, dword [ebp + 0x18]
jmp 0x41efc4
call fcn.0041efbb

Function at 0x41f1f7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0x18
mov eax, dword [0x42229c]
cmp eax, 0
jle 0x41f222
push 0
push 0x426525
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00411a84
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call fcn.00411ab8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [0x422278]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xa
je 0x41f27f
push 0
push 0x426530
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, 0
mov dword [ebp - 0x18], 0
jmp 0x41f366
mov eax, dword [0x42229c]
cmp eax, 1
jle 0x41f2c2
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
push eax
push 2
push 0
push 0x426570
push 6
push 0x18
lea esi, [esp + 4]
push esi
push 2
call fcn.0040ebd9
push dword [ebp + 0x14]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.0041ef78
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 2
je 0x41f30f
cmp eax, 0x13
je 0x41f338
cmp eax, 0x19
je 0x41f338
cmp eax, 0x10
je 0x41f338
cmp eax, 0x11
je 0x41f338
mov eax, 0
jmp 0x41f35b
push 0
push 0x42657c
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040ebd9
push dword [ebp - 0x18]
call fcn.0041e3d6
mov eax, dword [ebp + 0xc]
jmp 0x41f387
push dword [ebp - 0x14]
push dword [ebp - 8]
xor eax, eax
inc eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.0041f38b
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
jmp 0x41f387
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jb 0x41f290
mov eax, dword [ebp - 0x1c]
mov dword [0x422278], eax
push dword [ebp - 0x18]
call fcn.0041e3d6
mov eax, dword [ebp + 0xc]
leave
ret 0x10
Function at 0x421989
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x403ee7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], edi
je 0x403f16
cmp dword [esi + 4], edi
jbe 0x403f0f
mov eax, dword [esi]
mov eax, dword [eax + edi*8]
test eax, eax
je 0x403f09
push eax
call fcn.004301e8
inc edi
cmp edi, dword [esi + 4]
jb 0x403efa
push dword [esi]
call fcn.004324f6
push ebx
xor ebx, ebx
mov edi, 0xe0
cmp dword [esi + 8], ebx
je 0x403f48
cmp dword [esi + 0xc], ebx
jbe 0x403f40
mov dword [ebp + 8], ebx
mov eax, dword [esi + 8]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x403f2b
push dword [esi + 8]
call fcn.004324f6
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x403f74
cmp dword [esi + 0x14], ebx
jbe 0x403f6c
and dword [ebp + 8], ebx
mov eax, dword [esi + 0x10]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x403f57
push dword [esi + 0x10]
call fcn.004324f6
xor edi, edi
pop ebx
cmp dword [esi + 0x18], edi
je 0x403f9f
cmp dword [esi + 0x1c], edi
jbe 0x403f97
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edi*8]
test dword [edi + 0x65], eax
je 0x403fb9
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654b7972
imul esi, dword [bp + di + 0x74], 0x654b7972
jns 0x403fcf
jo 0x404016
xor dword [eax], eax
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx + 0x40], al
add byte [eax], al
add byte [esi + 0x2e000011], dh
adc dword [eax], eax
add byte [esi], ch
adc al, 0
add byte [0x516aede9], bl
cmp edi, dword [eax]
pop esp
add dword [edi - 0x7e818284], 0x383b8177
dec esi
dec esi
dec esi
cmp dword [ebx], 0x4e4e4e38
dec esi
adc byte [ebx - 0x6c685f5e], 0xa4
xchg ebx, eax
dec esi
mov al, byte [0xa1979593]
mov byte [0x994ea7a0], al
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
push esi
mov eax, dword [0x9d944e57]
mov al, byte [0xa1a7a14e]
mov byte [0x975b9b93], al
pushfd
mov eax, dword [0x9a9a8fa2]
xchg ebx, eax
xchg edx, eax
dec esi
invalid
invalid
Function at 0x9cbb4c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x9f0274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x9edd3c
push esi
call fcn.009c3f93
pop ecx
pop ecx
test eax, eax
jne 0x9cbb7a
xor al, al
jmp 0x9cbbf7
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.009cb881
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x9cbbb4
push dword [ebp - 0x210]
call fcn.009b2212
xor al, al
jmp 0x9cbbf5
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x9cbbba
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x9cbbda
push edx
call fcn.009cba83
pop ecx
test al, al
je 0x9cbba5
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x9cbbe8
mov bl, 1
push dword [ebp - 0x210]
call fcn.009b2212
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.009aeb72
leave
ret

Function at 0x9cc6dc
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x9f0274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x9cc71f
call fcn.009bc207
mov dword [eax], 0xf
call fcn.009bc21a
mov dword [eax], 0xd
call fcn.009bfae4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009aeb72
leave
ret
test eax, eax
jne 0x9cc726
inc eax
jmp 0x9cc713
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x9cc711
xor eax, eax
cmp ecx, 1
setne al
jmp 0x9cc713

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x71e14b25
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4f2667f1
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401650
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4182bf
call fcn.00417e80
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0xf
mov dword [ebp - 0x10], esi
mov dword [esi], 0x41b3e8
mov dword [esi + 4], 0x41b3c8
lea ecx, [esi + 0x10]
mov dword [esi + 8], 0x41b3b8
mov dword [esi + 0xc], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00401d26
lea ecx, [esi + 0x20]
push 0xf
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00401d26
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00401720
lea eax, [esi + 0xa0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 4
mov dword [eax], 0x41b310
lea ecx, [esi + 0xc8]
mov byte [esi + 0xb4], 1
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xc4], bl
push 0xf
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00401d26
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x41b380
mov dword [esi + 4], 0x41b360
mov dword [esi + 8], 0x41b350
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x401720
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4182ea
call fcn.00417e80
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x41b450
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
push 0xf
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00401d26
push edi
push edi
push edi
lea ecx, [esi + 0x38]
push 1
mov byte [ebp - 4], 1
mov dword [esi + 0x30], edi
call fcn.00405661
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
call fcn.004017b4
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x41b420
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4025ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi], eax
test eax, eax
setne cl
mov al, cl
pop esi
pop ebp
ret 0x18

Function at 0x402d8e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x402db9
push ebx
push edi
movzx edi, byte [edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x4207f4]
xor eax, edi
inc edx
dec esi
jne 0x402d9f
pop edi
pop ebx
mov dword [ecx], eax
pop esi
ret 8