joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a20a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6a20e1
mov esi, dword [esp + 0x1c]
movzx ebx, byte [esi]
mov edi, ebx
and edi, 0xffffff80
test edx, edx
je 0x6a20c1
mov dword [edx], edi
mov dword [esp], edi
cmp eax, 1
jne 0x6a2118
mov eax, 1
test ecx, ecx
je 0x6a2110
movzx edx, byte [esi]
cmp byte [esp], 0
je 0x6a20dd
neg dl
mov byte [ecx], dl
jmp 0x6a2110
call fcn.005b5b10
push 0xaa8f82
push 0xa0
push 0xaa8f32
call fcn.005b5c10
add esp, 0xc
push 0
push 0xde
push 0xd
call fcn.005b5d00
add esp, 0xc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
movzx edx, byte [esi]
test edx, edx
je 0x6a21bf
cmp edx, 0xff
jne 0x6a21fa
cmp eax, 9
jae 0x6a213d
xor edi, edi
mov edx, 1
jmp 0x6a21b0
lea ebp, [eax - 1]
mov dword [esp + 4], ebp
and ebp, 0xfffffff8
lea edx, [ebp + 1]
pxor xmm1, xmm1
xor edi, edi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [esi + edi + 1]
movd xmm4, dword [esi + edi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add edi, 8
cmp ebp, edi
jne 0x6a2160
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
cmp dword [esp + 4], ebp
je 0x6a21bb
nop dword [eax + eax]
movzx ebp, byte [esi + edx]
or edi, ebp
inc edx
cmp eax, edx
jne 0x6a21b0
test edi, edi
je 0x6a21fa
mov edi, eax
movzx edx, byte [esi + 1]
and dl, 0x80
cmp byte [esp], dl
mov eax, 0xffffffff
jne 0x6a21fe
call fcn.005b5b10
push 0xaa8f82
push 0xc1
push 0xaa8f32
call fcn.005b5c10
add esp, 0xc
push 0
push 0xdd
jmp 0x6a2104
mov edi, eax
xor eax, eax
add eax, edi
test ecx, ecx
je 0x6a2110
test eax, eax
je 0x6a210e
mov dh, bl
sar dh, 7
add esi, edi
add ecx, eax
shr ebx, 7
test al, 1
mov byte [esp], dh
jne 0x6a2230
mov edi, eax
cmp eax, 1
je 0x6a2110
jmp 0x6a224e
lea edi, [eax - 1]
mov dl, byte [esi - 1]
xor dl, dh
dec esi
movzx edx, dl
add ebx, edx
mov byte [ecx - 1], bl
dec ecx
shr ebx, 8
cmp eax, 1
je 0x6a2110
mov dword [esp + 4], eax
neg edi
xor ebp, ebp
movzx eax, byte [esp]
nop word [eax + eax]
movzx edx, byte [esi + ebp - 1]
xor dl, al
movzx edx, dl
add edx, ebx
mov byte [ecx + ebp - 1], dl
shr edx, 8
mov ah, byte [esi + ebp - 2]
xor ah, al
movzx ebx, ah
add ebx, edx
mov byte [ecx + ebp - 2], bl
shr ebx, 8
add ebp, 0xfffffffe
cmp edi, ebp
jne 0x6a2260
mov eax, dword [esp + 4]
jmp 0x6a2110
Function at 0x701230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 4], ecx
mov ecx, dword [ecx]
xor eax, eax
cmp ecx, 1
sbb eax, eax
mov dword [esp], eax
mov eax, 1
test ebx, ebx
je 0x7013ae
mov edx, dword [ebx]
test edx, edx
je 0x7013ae
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x3c]
mov dword [esp + 8], eax
or dword [esp], ecx
nop word [eax + eax]
xorps xmm0, xmm0
movsd qword [esp + 0x70], xmm0
xorps xmm1, xmm1
movups xmmword [esp + 0x60], xmm1
movups xmmword [esp + 0x50], xmm1
movups xmmword [esp + 0x40], xmm1
movups xmmword [esp + 0x30], xmm1
movups xmmword [esp + 0x20], xmm1
movups xmmword [esp + 0x10], xmm1
lea eax, [esp + 0x88]
movsd qword [eax + 0x10], xmm0
movups xmmword [eax], xmm1
mov eax, dword [esp + 0xc]
mov dword [esp + 0x78], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp]
mov dword [esp + 0x84], eax
mov dword [esp + 0x94], edx
lea ecx, [esp + 0x78]
mov edx, 0xabeac0
push 0x56
call fcn.007015d0
add esp, 4
mov esi, eax
mov edi, fcn.007009b0
test eax, eax
je 0x701317
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0x24]
test edi, edi
mov ecx, fcn.007009b0
cmove edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x10]
push eax
push esi
push 7
call edi
add esp, 0xc
mov ebp, eax
test eax, eax
jle 0x70135f
cmp dword [esp + 0x14], 0
je 0x70135f
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0xc]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.005d0f80
add esp, 0x18
mov ebp, eax
test ebp, ebp
jle 0x701378
mov dword [esp + 0x24], ebp
lea eax, [esp + 0x10]
push eax
push esi
push 8
call edi
add esp, 0xc
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x701393
push 0x2c9
push 0xabe94c
push eax
call fcn.005db5b0
add esp, 0xc
test ebp, ebp
jle 0x7013ac
mov edx, dword [ebx + 0x14]
add ebx, 0x14
test edx, edx
jne 0x701280
mov eax, 1
jmp 0x7013ae
xor eax, eax
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x70a440
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov esi, dword [edx]
test esi, esi
je 0x70a51f
mov ebx, dword [esp + 0x28]
test byte [edx + 0x5c], 2
mov eax, 0xac33ca
mov edi, esi
mov esi, 0xac3389
cmove esi, eax
test edi, edi
jle 0x70a526
mov dword [esp + 4], esi
lea ebp, [edx + 9]
mov dword [esp], 4
mov esi, edi
nop dword [eax + eax]
movzx eax, byte [ebp - 1]
mov edi, eax
shl edi, 0x10
cmp esi, 2
mov dword [esp + 8], esi
jbe 0x70a535
movzx ebx, byte [ebp]
shl ebx, 8
movzx ecx, byte [ebp + 1]
mov dword [esp + 0xc], ecx
lea edx, [ebx + ecx]
or ebx, edi
shr eax, 2
mov esi, dword [esp + 4]
movzx eax, byte [esi + eax]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp]
mov byte [edi + ecx - 4], al
shr ebx, 0xc
and ebx, 0x3f
movzx eax, byte [esi + ebx]
mov byte [edi + ecx - 3], al
shr edx, 6
and edx, 0x3f
movzx eax, byte [esi + edx]
mov byte [edi + ecx - 2], al
mov eax, dword [esp + 0xc]
and eax, 0x3f
movzx eax, byte [esi + eax]
mov esi, dword [esp + 8]
mov byte [edi + ecx - 1], al
add ecx, 4
mov dword [esp], ecx
add ebp, 3
add esi, 0xfffffffd
jne 0x70a490
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
lea eax, [esi + ebx]
add eax, 0xfffffffc
add esi, 0xfffffffc
jmp 0x70a587
xor esi, esi
jmp 0x70a5a7
xor esi, esi
mov eax, ebx
mov byte [eax], 0
test byte [edx + 0x5c], 1
je 0x70a598
jmp 0x70a59d
jne 0x70a540
movzx eax, byte [ebp]
shl eax, 8
or edi, eax
mov eax, edi
shr eax, 0x12
mov edx, dword [esp + 4]
movzx eax, byte [edx + eax]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
mov byte [ebx + esi - 4], al
mov eax, edi
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [edx + eax]
mov byte [ebx + esi - 3], al
mov cl, 0x3d
cmp dword [esp + 8], 1
je 0x70a57b
shr edi, 6
and edi, 0x3f
movzx ecx, byte [edx + edi]
lea eax, [ebx + esi]
mov byte [ebx + esi - 2], cl
mov byte [ebx + esi - 1], 0x3d
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov byte [eax], 0
test byte [edx + 0x5c], 1
jne 0x70a59d
mov byte [ebx + esi], 0xa
inc esi
mov byte [ebx + esi], 0
mov dword [edx], 0
mov dword [ecx], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x739de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
xor esi, esi
test ebx, ebx
jle 0x739e00
nop
movzx eax, byte [ecx + esi]
cmp al, byte [edx + esi]
jne 0x739e00
inc esi
cmp ebx, esi
jne 0x739df0
mov esi, ebx
mov ebp, ebx
sar ebp, 0x1f
and ebp, ebx
lea eax, [ebp - 1]
mov dword [esp], eax
lea edi, [ebx - 1]
mov eax, ebx
lea ebx, [edi + 1]
test ebx, ebx
jle 0x739e2d
cmp byte [ecx + edi], 0
jne 0x739e3d
cmp byte [edx + edi], 0xff
lea edi, [edi - 1]
lea ebx, [eax - 1]
je 0x739e10
jmp 0x739e32
mov eax, ebp
mov ebx, dword [esp]
mov ebp, 0xffffffff
cmp esi, ebx
jge 0x739e4a
jmp 0x739eb5
mov eax, ebx
mov ebx, edi
mov ebp, 0xffffffff
cmp esi, ebx
jl 0x739eb5
cmp esi, eax
jge 0x739e78
movzx ecx, byte [ecx + esi]
movzx edx, byte [edx + esi]
mov ch, dl
xor ch, cl
movzx eax, ch
lea ebx, [eax - 1]
cmp ebx, 0x1e
ja 0x739e7f
mov edi, 7
jmp dword [ebx*4 + 0xacc248]
shl esi, 3
mov ebp, esi
jmp 0x739eb5
cmp eax, 0x3f
je 0x739ea5
cmp eax, 0x7f
jne 0x739eb5
mov edi, 1
jmp 0x739eaa
mov edi, 2
not dl
or cl, dl
test ch, cl
jne 0x739eb5
lea ebp, [edi + esi*8]
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4150ba
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00415139
jae 0x4150c6
xor ecx, ecx
call fcn.00415139
jae 0x4150f0
xor eax, eax
call fcn.00415139
jae 0x415101
mov al, 0x10
call fcn.00415139
adc al, al
jae 0x4150e2
jne 0x41512e
stosb byte es:[edi], al
jmp 0x4150c7
call fcn.00415145
dec ecx
loop 0x41510d
mov eax, ebp
call fcn.00415143
jmp 0x41512f
lodsb al, byte [esi]
shr eax, 1
je 0x415155
adc ecx, 2
mov ebp, eax
jmp 0x41512f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00415143
cmp eax, 0x7d00
jae 0x41512d
cmp eax, 0x500
jae 0x41512e
cmp eax, 0x7f
ja 0x41512f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4150c7
pop ebp
ret 8
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0xfd8a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfd8a860]
xor edx, dword [ebx*4 + 0xfd8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfd8a460]
add ecx, 4
xor edx, dword [eax*4 + 0xfd8b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfd8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfd8ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfd8a460]
add ecx, 4
xor eax, dword [edx*4 + 0xfd8b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfd8a860]
xor edx, dword [ebx*4 + 0xfd8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfd8a460]
xor edx, dword [eax*4 + 0xfd8b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfd8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfd8ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfd8a460]
xor eax, dword [edx*4 + 0xfd8b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfd8a860]
xor edx, dword [ebx*4 + 0xfd8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfd8a460]
xor edx, dword [eax*4 + 0xfd8b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfd8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfd8ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfd8a460]
and edx, 0xff
xor eax, dword [edx*4 + 0xfd8b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfd8a860]
xor edx, dword [ebx*4 + 0xfd8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfd8a460]
add ecx, 4
xor edx, dword [eax*4 + 0xfd8b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfd8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfd8ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfd8a460]
and edx, 0xff
xor eax, dword [edx*4 + 0xfd8b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0xfd8a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0xfd8ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0xfd8a460]
and eax, 0xff
xor edi, dword [eax*4 + 0xfd8b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0xfd8a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x247d26e7
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x24a66c3d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x408408
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x434404], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x408425
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x408453
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x40842e
mov dword [ecx*4 + 0x434400], eax
inc ecx
cmp ecx, 0x100
jne 0x408427
jmp 0x408419
cmp edx, ebx
je 0x40846c
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x434400]
jmp 0x408453
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x421850
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x421872
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421879
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421868
mov eax, 1
add ebx, ebx
jne 0x42188b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421880
jne 0x42189c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421880
xor ecx, ecx
sub eax, 3
jb 0x4218b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421922
mov ebp, eax
add ebx, ebx
jne 0x4218bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4218c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4218ec
inc ecx
add ebx, ebx
jne 0x4218d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4218cd
jne 0x4218e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4218cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42190c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4218fd
jmp 0x42186e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42190c
add edi, ecx
jmp 0x42186e
pop esi
mov edi, esi
mov ecx, 0x663
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42192a
cmp byte [edi], 7
jne 0x42192a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42192f
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x4219a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21b78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21bf0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42195c
mov ecx, edi
jns 0x42198b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21bf4]
or eax, eax
je 0x4219a1
mov dword [ebx], eax
add ebx, 4
jmp 0x421979
call dword [esi + 0x21bf8]
popal
jmp 0x40325c
Function at 0x40106c
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x45ea03
call fcn.0043b410
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
cmp byte [esi + 0x20], 0
push 1
pop ebx
mov dword [ebp - 4], ebx
jne 0x401253
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
cmp edi, eax
je 0x401162
mov ecx, edi
call fcn.00401f8a
push eax
lea eax, [ebp - 0xd]
push ebx
push eax
push str.File_s
lea ecx, [ebp - 0x48]
call fcn.00401721
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004017a3
push eax
lea eax, [ebp - 0xe]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
push eax
push str.DeleterDeleteFile
call fcn.00401721
sub esp, 0x28
lea eax, [ebp - 0xf]
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
push eax
push str.ISSetupDLLOp
mov byte [ebp - 4], 3
call fcn.00401721
mov byte [ebp - 4], 2
call fcn.00432638
add esp, 0x58
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00401279
and dword [ebp - 0x18], 0
push 0xc
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
push edi
call fcn.004016f7
call fcn.0042c726
add esp, 0x2c
test al, al
je 0x401156
mov ecx, edi
call fcn.00401f8a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401156
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp eax, 0x64
jge 0x401156
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401112
add edi, 0x28
cmp edi, dword [esi + 8]
jne 0x40109f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, dword [esi + 0x14]
je 0x401246
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0x28]
call fcn.00401f8a
push eax
lea eax, [ebp - 0xf]
push ebx
push eax
push str.Folder_s
lea ecx, [ebp - 0x48]
call fcn.00401721
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004017a3
push eax
lea eax, [ebp - 0xe]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
push eax
push str.DeleterDeleteFolder
call fcn.00401721
sub esp, 0x28
lea eax, [ebp - 0xd]
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
push eax
push str.ISSetupDLLOp
mov byte [ebp - 4], 5
call fcn.00401721
mov byte [ebp - 4], 4
call fcn.00432638
add esp, 0x58
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00401279
and dword [ebp - 0x18], 0
push 0xc
lea ecx, [ebp - 0x14]
sub esp, 0x28
mov edi, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00401aa9
push eax
mov ecx, edi
call fcn.004016f7
call fcn.0042c726
add esp, 0x2c
test al, al
je 0x40123a
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0x28]
call fcn.00401f8a
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40123a
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp eax, 0x64
jge 0x40123a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4011e8
sub dword [ebp - 0x14], 0x28
mov eax, dword [ebp - 0x14]
jmp 0x401168
cmp byte [esi + 0x21], 0
je 0x401253
push ebx
call fcn.00401302
pop ecx
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.00401a76
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401a76
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x402bec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi + 8], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
jne 0x402c15
push ebx
push ebx
call fcn.0043bb7a
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x402c2d
push ebx
push ebx
call fcn.0043bb7a
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x402c45
push ebx
push ebx
call fcn.0043bb7a
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [esi], eax
jne 0x402c5b
push ebx
push ebx
call fcn.0043bb7a
push dword [esi + 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [esi]
call fcn.0043b430
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x404256
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov byte [ebp - 0x1c], 0x49
cmp byte [ebp + 0xc], al
mov dword [ebp - 4], eax
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
je 0x4042bc
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], al
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401721
mov eax, dword [ebp + 8]
leave
ret 8