joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11038017
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x110e030c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
and dword [ebx + 0x34c], 0
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 0x348], ecx
mov dword [ebx + 0x350], eax
test ecx, ecx
jne 0x11038082
call sym.DuiLib.dll_public:_static_class_DuiLib::MenuObserverImpl____cdecl_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test esi, esi
je 0x11038082
call sym.DuiLib.dll_public:_static_class_DuiLib::MenuObserverImpl____cdecl_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
call sym.DuiLib.dll_public:_static_class_DuiLib::MenuObserverImpl____cdecl_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
mov edx, ebx
lea ecx, [ebx + 0x10]
neg edx
mov esi, dword [eax]
sbb edx, edx
and edx, ecx
mov ecx, eax
push edx
call dword [esi]
mov ecx, dword [ebx + 0x348]
test ecx, ecx
je 0x110380aa
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov edi, eax
mov ecx, edi
call sym.DuiLib.dll_public:_struct_HWND______thiscall_DuiLib::CPaintManagerUI::GetPaintWindow_void_const
lea ecx, [ebp - 0x14]
mov ebx, eax
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
push 0x88
movsd dword es:[edi], dword [esi]
push SysReAllocString
push 0
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
mov ecx, esi
call sym.DuiLib.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__struct_tagRECT__struct_HMENU____
mov eax, dword [ebp + 0x24]
mov edi, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
mov dword [esi + 0x354], eax
jmp 0x110380f8
push edi
call ebx
mov edi, eax
push edi
call ebx
test eax, eax
jne 0x110380f3
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.11053e08
leave
ret 0x20
Function at 0x11048c72
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x11048ca0
cmp eax, edi
jge 0x11048c94
push esi
call fcn.11044df7
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x11048cc3
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x11048ca9
mov dword [esi + 8], edx
jmp 0x11048cd8
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x11048cce
xor dl, dl
jmp 0x11048cd3
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x11048cc3
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x11048d12
push str.zlib_corrupt
call fcn.11044d22
add esp, 4
jmp 0x11048d52
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x11048d22
push str.read_past_buffer
jmp 0x11048d08
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x11048d3c
push edi
push ecx
push esi
call fcn.1104bc0a
add esp, 0xc
test eax, eax
je 0x11048d52
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.11058d50
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x1104f4c3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x110e030c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1104f57d
movzx eax, word [esi]
test ax, ax
je 0x1104f57d
push edi
mov edi, esi
mov ecx, esi
mov edx, eax
cmp dx, 0x2f
je 0x1104f505
cmp dx, 0x5c
jne 0x1104f507
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x1104f4f9
cmp edi, esi
je 0x1104f550
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.1106355b
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x1104f58b
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.1104f4c3
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.11063f7e
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.1106bcf9
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.11053e08
leave
ret
call fcn.1105499e
int3

Function at 0x1104fefc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x1104ff78
cmp dword [edi + 4], 0xffffffff
jne 0x1104ff78
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x110a77e4
push esi
call fcn.1106bcf9
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x1104ff4a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x1104ff4a
mov eax, 0x2000000
jmp 0x1104ff7d
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1105249c
add esp, 0x10
test eax, eax
jne 0x1104ff68
mov eax, dword [ebp - 4]
jmp 0x1104ff7d
push eax
call fcn.11052d62
mov dword [edi], eax
mov eax, dword [0x110e2270]
pop ecx
jmp 0x1104ff7d
mov eax, 0x1000000
pop edi
leave
ret 0xc
Function at 0x1105249c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
cmp eax, 1
je 0x110524c1
cmp eax, 2
je 0x110524c1
cmp eax, 3
je 0x110524c1
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x10000
xor eax, eax
leave
ret
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
mov byte [ebp - 8], dl
mov ecx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [edi], edx
cmp eax, 1
jne 0x11052520
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push 2
push edx
push edx
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x11052505
mov dword [edi], 0x100
jmp 0x110525e3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb al, al
inc al
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
cmp eax, 2
jne 0x110525cf
push edx
push 0x80
push 3
push edx
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x11052553
mov dword [edi], 0x200
jmp 0x110525e3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
neg eax
push 0
push dword [ebp - 4]
sbb al, al
inc al
mov byte [ebp - 8], al
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0xc], esi
test esi, esi
je 0x110525bf
push esi
call fcn.11063aaa
mov ebx, eax
pop ecx
test ebx, ebx
je 0x110525bf
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 0x800
test eax, eax
jne 0x110525a7
mov dword [edi], ecx
mov eax, ecx
jmp 0x110525a9
mov eax, dword [edi]
cmp dword [ebp - 0x10], esi
je 0x110525b2
mov dword [edi], ecx
mov eax, ecx
test eax, eax
je 0x110525bf
push ebx
call fcn.11063aa5
pop ecx
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x110525d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
jne 0x110525e7
test ebx, ebx
jne 0x110525e7
mov dword [edi], 0x300
xor eax, eax
jmp 0x11052647
push 0x24
call fcn.11053f56
mov esi, eax
xor edx, edx
mov eax, dword [ebp + 0x10]
pop ecx
mov dword [esi + 4], eax
cmp dword [ebp - 4], edx
je 0x1105262b
mov ecx, dword [ebp - 8]
mov byte [esi], 1
mov byte [esi + 8], cl
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], dl
mov dword [esi + 0x14], edx
test cl, cl
je 0x11052643
push 1
push edx
push edx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x14], eax
xor edx, edx
jmp 0x11052643
mov eax, dword [ebp - 0xc]
mov byte [esi], dl
mov byte [esi + 8], 1
mov dword [esi + 0xc], edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edx
mov dword [esi + 0x14], edx
mov dword [edi], edx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1105264c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x1105267f
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1105267a
mov byte [edi + 0x10], 1
mov eax, dword [ebp + 0x10]
jmp 0x110526a9
mov edx, dword [edi + 0x20]
push esi
mov esi, dword [edi + 0x1c]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x1c]
cmovbe esi, ecx
mov ecx, dword [edi + 0x18]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.11058d50
add esp, 0xc
mov eax, esi
add dword [edi + 0x20], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x11052837
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x11052845
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x11052904
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
sub edi, 1
jne 0x1105285d
pop edi
test esi, esi
je 0x11052920
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x110a70a8]
inc edx
sub esi, 1
jne 0x11052908
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x11089f4f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.11089729

Function at 0x11089f5a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.11089964

Function at 0x11095c6f
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.110959f6
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x6a951cbf
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x68593803
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4090448b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x49290226
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c040
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40c0f5
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_ReleaseDC]
nop dword [eax]
push 0
push 0
call ebp
add byte [edi + ebx], 0xad
push 0
push 0
call ebp
add byte [edi + ebx], 0x84
push 0
push 0
call ebp
add byte [edi + ebx], 0x95
push 0
push 0
call ebp
xor byte [edi + ebx], 0x10
push 0
push 0
call ebp
add byte [edi + ebx], 0x87
push 0
push 0
call ebp
add byte [edi + ebx], 0xc7
push 0
push 0
call ebp
add byte [edi + ebx], 0xca
push 0
push 0
call ebp
xor byte [edi + ebx], 0xb4
push 0
push 0
call ebp
add byte [edi + ebx], 0xe1
push 0
push 0
call ebp
add byte [edi + ebx], 0x1d
push 0
push 0
call ebp
xor byte [edi + ebx], 0xd5
push 0
push 0
call ebp
add byte [edi + ebx], 0xa6
push 0
push 0
call ebp
xor byte [edi + ebx], 0x53
push 0
push 0
call ebp
add byte [edi + ebx], 0x3e
inc ebx
cmp esi, ebx
jne 0x40c060
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402cc5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c100
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
mov ebx, eax
jb 0x40c118
mov ebx, dword [eax]
mov esi, dword [esp + 0x40]
xor esi, edi
cmp edi, 4
jae 0x40c127
mov ecx, edi
jmp 0x40c195
mov dword [esp + 0x24], edi
shr edi, 2
xor ebp, ebp
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.GDI32.dll_ArcTo]
sub esp, 0x24
mov dword [esp + 4], str.Z81xbyuAua
mov dword [esp], 0x4d4860
call fcn.00402d5b
mov dword [esp], eax
call fcn.004060eb
imul eax, dword [ebx + ebp*4], 0x5bd1e991
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e991
imul esi, esi, 0x5bd1e991
xor esi, eax
inc ebp
cmp edi, ebp
jne 0x40c130
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
mov edi, dword [esp + 0x24]
and edi, 0xfffffffc
and ecx, 3
xor eax, eax
cmp ecx, 1
je 0x40c1be
cmp ecx, 2
je 0x40c1b4
cmp ecx, 3
jne 0x40c1cc
movsx eax, byte [ebx + edi + 2]
shl eax, 0x10
movsx ecx, byte [ebx + edi + 1]
shl ecx, 8
xor eax, ecx
movsx ecx, byte [ebx + edi]
xor ecx, eax
imul eax, ecx, 0x5bd1e991
xor esi, eax
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e991
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4035bc
Capabilities:
Terminate process

Disassembly:
jmp 0x453cc3
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453cd4
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058c1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x67555ae7
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x553925de
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c040
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40c0f5
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_ReleaseDC]
nop dword [eax]
push 0
push 0
call ebp
add byte [edi + ebx], 6
push 0
push 0
call ebp
add byte [edi + ebx], 0x71
push 0
push 0
call ebp
add byte [edi + ebx], 0x86
push 0
push 0
call ebp
xor byte [edi + ebx], 0xf8
push 0
push 0
call ebp
add byte [edi + ebx], 0xe9
push 0
push 0
call ebp
add byte [edi + ebx], 0x14
push 0
push 0
call ebp
add byte [edi + ebx], 0x42
push 0
push 0
call ebp
xor byte [edi + ebx], 0x28
push 0
push 0
call ebp
add byte [edi + ebx], 0x36
push 0
push 0
call ebp
add byte [edi + ebx], 0xf1
push 0
push 0
call ebp
xor byte [edi + ebx], 0xc7
push 0
push 0
call ebp
add byte [edi + ebx], 0xe9
push 0
push 0
call ebp
xor byte [edi + ebx], 0x6d
push 0
push 0
call ebp
add byte [edi + ebx], 0xcb
inc ebx
cmp esi, ebx
jne 0x40c060
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402cc5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c100
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
mov ebx, eax
jb 0x40c118
mov ebx, dword [eax]
mov esi, dword [esp + 0x40]
xor esi, edi
cmp edi, 4
jae 0x40c127
mov ecx, edi
jmp 0x40c195
mov dword [esp + 0x24], edi
shr edi, 2
xor ebp, ebp
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.GDI32.dll_ArcTo]
sub esp, 0x24
mov dword [esp + 4], str.Z81xbyuAua
mov dword [esp], 0x4d4860
call fcn.00402d5b
mov dword [esp], eax
call fcn.004060eb
imul eax, dword [ebx + ebp*4], 0x5bd1e991
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e991
imul esi, esi, 0x5bd1e991
xor esi, eax
inc ebp
cmp edi, ebp
jne 0x40c130
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
mov edi, dword [esp + 0x24]
and edi, 0xfffffffc
and ecx, 3
xor eax, eax
cmp ecx, 1
je 0x40c1be
cmp ecx, 2
je 0x40c1b4
cmp ecx, 3
jne 0x40c1cc
movsx eax, byte [ebx + edi + 2]
shl eax, 0x10
movsx ecx, byte [ebx + edi + 1]
shl ecx, 8
xor eax, ecx
movsx ecx, byte [ebx + edi]
xor ecx, eax
imul eax, ecx, 0x5bd1e991
xor esi, eax
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e991
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4035bc
Capabilities:
Terminate process

Disassembly:
jmp 0x453cc3
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453cd4
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058c1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x4a4128
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4d5d78]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a416b
cmp word [esi], dx
jne 0x4a416b
or byte [edi + eax + 0x28], 4
jmp 0x4a4170
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a42c3
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a42a3
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a41b2
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a41e8
cmp eax, edx
jae 0x4a41f4
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a418a
jmp 0x4a42c3
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a429f
cmp dword [ebp - 0x14], 0
je 0x4a429f
mov eax, dword [ebx*4 + 0x4d5d78]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a4277
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a4240
mov word [esi], cx
jmp 0x4a4273
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4d5d78]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4d5d78]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4d5d78]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a42c3
pop ebx
cmp word [ebp - 4], bx
jne 0x4a4288
cmp esi, dword [ebp + 0xc]
jne 0x4a4288
mov word [esi], bx
jmp 0x4a42c0
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401938
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a42c3
push 0xd
jmp 0x4a42bc
mov ecx, dword [ebx*4 + 0x4d5d78]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a42ba
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a42c3
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x402300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x46e36c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x14], 0x4b
mov byte [ebp - 0x13], 0x45
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x4c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0
push 0x46b524
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b78a
mov esp, ebp
pop ebp
ret