joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a305
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xe4
push 8
call fcn.00487560
push eax
call fcn.004543ba
mov dword [ebp - 0xc], eax
call fcn.00487560
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, 0x9c
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax + 0x14], edx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb4]
mov al, byte [eax + 0x9a]
cmp al, 1
setne al
xor ah, ah
cwde
mov dword [ebp - 0xec], eax
push 0
push dword [ebp - 0x18]
push 8
push str.Windows
call fcn.004441d1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 4]
cmp eax, 5
je 0x49a450
cmp eax, 6
je 0x49a4ab
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a41d
mov eax, dword [ebp - 0xe8]
cmp eax, 0x4f3d
jl 0x49a3ed
mov eax, str.Server_2022
jmp 0x49a41b
mov eax, dword [ebp - 0xe8]
cmp eax, 0x42ee
jl 0x49a401
mov eax, str.Server_2019
jmp 0x49a41b
xor eax, eax
inc eax
je 0x49a40d
mov eax, str.Server_2016
jmp 0x49a41b
call fcn.0049a412
mov eax, dword [ebp - 0xe8]
cmp eax, 0x55f0
jl 0x49a431
mov eax, 0x54bb8c
jmp 0x49a44b
xor eax, eax
inc eax
je 0x49a43d
mov eax, 0x54bb8f
jmp 0x49a44b
call fcn.0049a442
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49a47f
cmp eax, 1
je 0x49a486
cmp eax, 2
je 0x49a48d
call fcn.0049a476
mov eax, 0x54bb06
jmp 0x49a4a6
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a4a1
mov eax, str.Server_2003_R2
jmp 0x49a4a6
mov eax, str.Server_2003
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49a4e1
cmp eax, 1
je 0x49a4fc
cmp eax, 2
je 0x49a517
cmp eax, 3
je 0x49a532
call fcn.0049a4d8
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a510
mov eax, str.Server_2008_R1
jmp 0x49a515
mov eax, 0x54bb45
jmp 0x49a54b
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a52b
mov eax, str.Server_2012
jmp 0x49a530
mov eax, 0x54bb53
jmp 0x49a54b
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a546
mov eax, str.Server_2012_R2
jmp 0x49a54b
mov eax, 0x54bb64
Function at 0x49a8fa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, 0x1000
mov dword [ebp - 0x18], 0x1000
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x20]
add eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x49a99e
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x49a99e
mov eax, 2
push edx
mov edx, dword [ebp - 0x18]
imul edx
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.MSVCRT.DLL_realloc]
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x49a91c
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret 8
Function at 0x5008dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x501d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x501d2e
cmp eax, 5
je 0x501d65
mov dword [ebp - 0x20], 0
jmp 0x501e1a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x501e1a
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.0043da1c
mov dword [ebp - 0x14], eax
jmp 0x501df0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x501da9
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x501da9
xor eax, eax
jmp 0x501dac
xor eax, eax
inc eax
cmp eax, 0
je 0x501de5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x501e08
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x501e08
jmp 0x501e0c
xor eax, eax
jmp 0x501e0f
xor eax, eax
inc eax
cmp eax, 0
jne 0x501d84
mov eax, dword [0x53edf4]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x50280d
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x50283b
cmp eax, 0xf
je 0x502869
mov eax, 0
jmp 0x502ab0
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.0043d912
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x502867
mov eax, 0
jmp 0x502ab0
jmp 0x50287b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x502aad
Function at 0x504b51
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov eax, 1
mov dword [ebp - 0x28], 1
mov eax, 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [0x549ae0]
dec eax
mov edx, eax
mov eax, dword [0x549adc]
add eax, edx
mov dword [ebp - 0x30], eax
jmp 0x504d0f
call fcn.005046b5
xor al, 1
cmp eax, 0
je 0x504bb1
jmp 0x504d18
mov eax, dword [0x549adc]
mov edi, dword [0x549ae0]
dec edi
mov al, byte [eax + edi]
mov byte [ebp - 0x2c], al
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
jne 0x504bd6
mov dword [ebp - 0xc], 1
jmp 0x504d0f
mov al, byte [ebp - 0x2c]
cmp al, 0x30
jb 0x504be6
mov al, byte [ebp - 0x2c]
cmp al, 0x39
ja 0x504be6
jmp 0x504bea
xor eax, eax
jmp 0x504bed
xor eax, eax
inc eax
cmp eax, 0
je 0x504c1f
mov eax, dword [ebp - 0x10]
push edx
mov edx, 0xa
mov ecx, edx
imul ecx
pop edx
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 0x2c]
sub al, 0x30
mov edx, eax
mov eax, dword [ebp - 0x10]
and edx, 0xff
add eax, edx
mov dword [ebp - 0x10], eax
jmp 0x504d0f
mov al, byte [ebp - 0x2c]
cmp al, 0x3b
jne 0x504c47
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x2c]
cmp al, 0x40
jb 0x504c65
mov al, byte [ebp - 0x2c]
cmp al, 0x7e
ja 0x504c65
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
je 0x504c65
mov al, byte [ebp - 0x2c]
cmp al, 0x5b
je 0x504c65
jmp 0x504c69
xor eax, eax
jmp 0x504c6c
xor eax, eax
inc eax
cmp eax, 0
je 0x504d03
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x2c]
cmp al, 0x4d
je 0x504cba
cmp al, 0x6d
je 0x504cd3
cmp al, 0x52
je 0x504cec
mov eax, dword [0x549ae0]
dec eax
mov edx, eax
mov eax, dword [0x549adc]
add eax, edx
push eax
push dword [ebp - 0x30]
call fcn.005048f0
jmp 0x504cfe
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x504cd1
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc]
call fcn.005046e6
jmp 0x504cfe
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x504cea
push dword [ebp - 0x24]
push 1
push dword [ebp - 0xc]
call fcn.005046e6
jmp 0x504cfe
mov eax, dword [ebp - 0x28]
cmp eax, 2
jne 0x504cfe
push dword [ebp - 0x24]
call fcn.005048cb
jmp 0x504d18
mov al, byte [ebp - 0x2c]
cmp al, 0x1b
jne 0x504d0f
jmp 0x504d18
xor eax, eax
inc eax
jne 0x504b9e
leave
ret
Function at 0x5080ec
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x24
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004429fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x5b
je 0x508129
mov eax, 0
jmp 0x508a1c
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 1
mov dword [ebp - 0x14], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
Function at 0x51351b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push dword [0x549f20]
push dword [0x516008]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x513560
mov eax, 0xffffffff
jmp 0x5136a2
mov eax, dword [0x549f20]
mov al, byte [eax]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x80
cmp eax, 0
jne 0x51358c
mov eax, 1
mov dword [ebp - 0x14], 1
jmp 0x5135f1
mov eax, dword [ebp - 0x10]
and eax, 0xe0
cmp eax, 0xc0
jne 0x5135a9
mov eax, 2
mov dword [ebp - 0x14], 2
jmp 0x5135f1
mov eax, dword [ebp - 0x10]
and eax, 0xf0
cmp eax, 0xe0
jne 0x5135c6
mov eax, 3
mov dword [ebp - 0x14], 3
jmp 0x5135f1
mov eax, dword [ebp - 0x10]
and eax, 0xf8
cmp eax, 0xf0
jne 0x5135e3
mov eax, 4
mov dword [ebp - 0x14], 4
jmp 0x5135f1
call fcn.005135e8
Function at 0x513acc
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
push 0
call dword [sym.imp.MSVCRT.DLL_fflush]
add esp, 4
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x549f78]
mov ecx, edx
cdq
idiv ecx
pop edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x549f78]
mov ecx, edx
cdq
idiv ecx
mov eax, edx
bt eax, 0x1f
jae 0x513b15
bt ecx, 0x1f
jae 0x513b13
neg ecx
add eax, ecx
pop edx
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00513dab
cmp eax, 0
je 0x513b3b
mov eax, dword [0x549f78]
mov edx, dword [ebp - 0xc]
sub eax, edx
cmp eax, 1
jne 0x513b3b
jmp 0x513b3f
xor eax, eax
jmp 0x513b42
xor eax, eax
inc eax
cmp eax, 0
je 0x513b5c
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x513b74
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
cmp eax, edx
jne 0x513b74
jmp 0x513b78
xor eax, eax
jmp 0x513b7b
xor eax, eax
inc eax
cmp eax, 0
je 0x513ba7
mov eax, 0
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 1
push 0x54bfd0
push dword [0x516004]
call dword [sym.imp.KERNEL32.DLL_WriteConsoleW]
mov eax, dword [0x549f90]
and eax, 0xffff
mov dword [ebp - 0x1c], eax
mov eax, dword [0x549f90]
shr eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
add eax, edx
shl eax, 0x10
mov edx, dword [ebp - 0xc]
or eax, edx
push eax
push dword [0x516004]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
mov eax, dword [ebp + 0x10]
push edx
mov edx, dword [0x549f78]
mov ecx, edx
cdq
idiv ecx
pop edx
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [0x549f7c]
mov edx, dword [ebp - 0x18]
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0
jle 0x513c3f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jge 0x513c2f
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
shl eax, 0x10
mov edx, dword [ebp - 0x1c]
or eax, edx
mov dword [0x549f90], eax
mov eax, dword [ebp + 0x10]
push edx
mov edx, dword [0x549f78]
mov ecx, edx
cdq
idiv ecx
pop edx
mov edx, eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov dword [0x549f24], eax
leave
ret 0xc
Function at 0x514128
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 2
jge 0x514163
mov eax, 2
mov dword [ebp - 0xc], 2
push dword [ebp + 8]
call fcn.004425f7
push eax
push dword [ebp + 0xc]
call fcn.004425f7
pop edx
xchg edx, eax
add eax, edx
push eax
push dword [ebp - 0xc]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
shl eax, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [0x549f74]
cmp eax, edx
jle 0x514205
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [0x549f74], eax
push dword [0x549f2c]
call dword [sym.imp.MSVCRT.DLL_free]
add esp, 4
push dword [0x549f74]
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x549f2c], eax
mov eax, 0
mov edx, dword [0x549f2c]
cmp eax, edx
jne 0x514205
push 0
push dword [ebp - 0x14]
push 2
push 0
push str.Cannot_allocate_memory:_init_buffer:
push 6
push 0x18
lea esi, [esp + 4]
push esi
push 2
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [0x549f2c]
mov dword [0x549f30], eax
leave
ret 8

Function at 0x5150e3
Capabilities:
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00442639
push eax
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov dword [ebp - 0xc], eax
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x51512d
push 0
push str.SetConsoleTitle_failed_
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
call fcn.00513cc7
call fcn.00513d8a
push 5
push dword [0x548a74]
call fcn.0044c49f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x515173
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x515173
xor eax, eax
jmp 0x515176
xor eax, eax
inc eax
cmp eax, 0
je 0x51519b
mov eax, 0x50
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, 0x32
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
leave
ret 4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x63752787
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x269f10ca
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x5304748e
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x3e7a3bee
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [ebp + 8], 0
jne 0x401043
xor eax, eax
leave
ret
mov eax, dword fs:[0x30]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x14]
test esi, esi
je 0x4010e6
mov eax, 0x103
push edi
cmp dword [esi + 0x28], 0
je 0x4010e5
cmp word [esi + 0x24], ax
jae 0x4010da
push 0x104
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.00402cd0
mov eax, dword [esi + 0x28]
add esp, 0xc
mov edi, ebx
cmp word [eax], bx
je 0x4010bc
cmp edi, 0x103
jae 0x4010bc
mov bl, byte [eax + edi*2]
lea eax, [ebx - 0x20]
lea edx, [ebx - 0x61]
movzx ecx, al
cmp dl, 0x19
movzx eax, bl
cmova ecx, eax
xor ebx, ebx
mov byte [ebp + edi - 0x104], cl
inc edi
mov eax, dword [esi + 0x28]
cmp word [eax + edi*2], bx
jne 0x40108c
lea eax, [ebp - 0x104]
mov byte [ebp + edi - 0x104], bl
push eax
call fcn.0040118f
pop ecx
cmp eax, dword [ebp + 8]
je 0x4010e2
mov eax, 0x103
mov esi, dword [esi]
test esi, esi
jne 0x401061
jmp 0x4010e5
mov ebx, dword [esi + 0x10]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4010ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40118a
cmp dword [ebp + 0xc], 0
je 0x40118a
mov ecx, dword [esi + 0x3c]
mov eax, esi
cdq
xorps xmm0, xmm0
push ebx
push edi
mov ecx, dword [ecx + esi + 0x78]
mov edi, eax
add ecx, esi
mov dword [ebp - 0xc], edi
xor eax, eax
movlpd qword [ebp - 0x1c], xmm0
mov ebx, dword [ecx + 0x20]
add ebx, edi
adc eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp + 8], eax
xor eax, eax
add dword [ebp + 8], edi
mov edi, dword [ecx + 0x24]
add edi, dword [ebp - 0xc]
adc eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x18]
jmp 0x40116f
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add eax, esi
push eax
call fcn.0040118f
pop ecx
cmp eax, dword [ebp + 0xc]
je 0x40117c
mov eax, dword [ebp - 0x10]
add ebx, 4
adc dword [ebp - 4], 0
add edi, 2
adc dword [ebp - 8], 0
test eax, eax
jne 0x40114a
mov ecx, dword [ebp - 0x1c]
pop edi
mov eax, ecx
pop ebx
jmp 0x40118c
movzx eax, word [edi]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + eax*4]
add ecx, dword [ebp - 0xc]
jmp 0x401176
xor eax, eax
pop esi
leave
ret

Function at 0x40118f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
or esi, 0xffffffff
mov al, byte [edi]
test al, al
je 0x4011d1
push ebx
movzx eax, al
push eax
call fcn.004011de
pop ecx
push 8
pop ebx
lea edx, [esi + esi]
mov ecx, eax
xor ecx, esi
mov esi, edx
xor esi, 0x9c46e25
test ecx, ecx
cmovns esi, edx
add eax, eax
sub ebx, 1
jne 0x4011ae
inc edi
mov al, byte [edi]
test al, al
jne 0x4011a1
pop ebx
not esi
push esi
call fcn.004011de
pop ecx
pop edi
pop esi
pop ebp
ret

Function at 0x40179c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x4017bd
mov eax, ecx
and eax, 0xf
mov al, byte [eax + 0x4155b0]
xor byte [edx + ecx], al
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x4017a9
pop ebp
ret
Function at 0x401bc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push 0xb02b8f46
call fcn.00401030
pop ecx
push 0xc952550b
mov esi, 0x9b79cce5
mov dword [0x4155f0], eax
push esi
call fcn.00401030
pop ecx
push eax
call fcn.004010ec
pop ecx
pop ecx
push 0xfaf8ac69
push esi
mov dword [0x4155d0], eax
call fcn.00401030
pop ecx
push eax
call fcn.004010ec
pop ecx
pop ecx
push 0x59c35644
push esi
mov dword [0x4155cc], eax
call fcn.00401030
pop ecx
push eax
call fcn.004010ec
pop ecx
pop ecx
push 0xbcb2c9fc
push esi
mov dword [0x4155c8], eax
call fcn.00401030
pop ecx
push eax
call fcn.004010ec
pop ecx
pop ecx
push 0xe217bc5
push esi
mov dword [0x4155c4], eax
call fcn.00401030
pop ecx
push eax
call fcn.004010ec
push 0x7627a48c
push dword [0x4155f0]
mov dword [0x4155c0], eax
call fcn.004010ec
push 0xa05b3f92
push dword [0x4155f0]
mov dword [0x415600], eax
call fcn.004010ec
push 0xac79c201
push dword [0x4155f0]
mov dword [0x4155fc], eax
call fcn.004010ec
mov edx, dword [0x4155f0]
add esp, 0x20
mov dword [0x4155f8], eax
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
add ecx, edx
mov eax, dword [ecx + 0x18]
mov dword [0x4155ec], eax
mov eax, dword [ecx + 0x20]
add eax, edx
mov dword [0x4155e4], eax
mov eax, dword [ecx + 0x1c]
add eax, edx
mov dword [0x4155e0], eax
mov eax, dword [ecx + 0x24]
add eax, edx
mov dword [0x4155e8], eax
call fcn.00401012
test eax, eax
je 0x401ce3
mov eax, dword fs:[0xc0]
mov dword [0x4155f4], eax
pop esi
ret
xor ecx, ecx
cmp dword [0x4155ec], ecx
je 0x401d32
push ebx
mov ebx, dword [0x4155e8]
push edi
movzx eax, word [ebx + ecx*2]
mov edx, dword [0x4155e0]
mov edx, dword [edx + eax*4]
add edx, dword [0x4155f0]
xor eax, eax
mov esi, 0x340f
lea edi, [eax + edx]
cmp word [edi], si
mov esi, dword [0x4155ec]
je 0x401d2a
inc eax
cmp eax, 0x1e
jl 0x401d0a
inc ecx
cmp ecx, esi
jb 0x401cf5
jmp 0x401d30
mov dword [0x4155f4], edi
pop edi
pop ebx
pop esi
ret

Function at 0x40270f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40274e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40274e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40274e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40274e
cmp dword [ecx + 0x74], 0xe
jbe 0x40274e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret