joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dword [esp - 0x3c], esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push esi
mov edi, edi
push edi
nop
mov dword [esp - 4], 0x2ded5aea
xor dword [esp - 4], 0x36f46db
mov edx, edx
xor dword [esp - 4], 0x27012506
xor dword [esp - 4], 0x5cf49d85
add dword [esp - 4], 0x2a2e5fd4
xor dword [esp - 4], 0x1d051d54
xchg esp, esp
sub dword [esp - 4], 0x62a318ce
sub esp, 4
push eax
mov eax, dword [0x4bab08]
mov dword [esp - 0x10], 0x67426a22
xor eax, dword [0x4ba958]
call eax
mov edi, dword [ebp + 8]
xchg esi, esi
lea edx, [ebp - 0x208]
lea ecx, [edx + 2]
mov dword [edi], 0x1f600d72
add dword [edi], 0x28b8777a
xchg ecx, ecx
add dword [edi], 0x2402bfd6
sub dword [edi], 0x3bb34246
xor dword [edi], 0x46b3204c
mov dword [esp - 0x40], ebx
sub dword [edi], 0x76db2230
mov ax, word [edx]
add edx, 2
mov ebp, ebp
test ax, ax
jne 0x483335
sub edx, ecx
mov eax, edi
mov dword [esp - 0x30], esi
sar edx, 1
mov dword [edi + 4], edx
cmp edx, 2
jbe 0x4833a3
mov edi, edi
xor ecx, ecx
mov eax, edx
mov edx, 0x2d0dff6d
xor edx, 0x79bf9c04
mov edx, edx
xor edx, 0x6e4e8ba2
xor edx, 0x46181d4
sub edx, 0x2bbe1927
mov dword [esp - 0x30], esi
xor edx, 0x12df4ffa
mul edx
seto cl
mov dword [esp - 0x30], esp
neg ecx
or ecx, eax
push ecx
call fcn.0048b720
mov dword [esp - 0x44], 0xf57f1dd
add esp, 4
mov dword [edi], eax
xor esi, esi
mov dword [esp - 0xc], 0x11ee737b
cmp dword [edi + 4], esi
jbe 0x483423
push ebx
lea ebx, [ebp - 0x208]
mov ebx, ebx
sub ebx, eax
lea esp, [esp]
mov ecx, esi
mov dword [esp - 0x44], 0x56bb4900
lea eax, [eax + 2]
and ecx, 3
mov edx, 0x1af7921d
mov edx, edx
add edx, 0x17ee5d93
add edx, 0xbb9186d
xor edx, 0x65f1b923
sub edx, 0x22950dc9
mov ecx, ecx
sub edx, 0x12c11571
add edx, 0x4d65963c
shl ecx, 3
mov dword [esp - 0x24], 0x398a1221
inc esi
sar edx, cl
movsx cx, dl
xchg esi, esi
xor cx, word [ebx + eax - 2]
mov word [eax - 2], cx
cmp esi, dword [edi + 4]
xchg ecx, ecx
jb 0x4833c1
pop ebx
mov eax, edi
pop edi
mov dword [esp - 0x44], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4844e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ebp, ebp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp - 0x28], ebp
push dword [ebp + 8]
call fcn.00484590
mov esi, eax
test esi, esi
xchg ebx, ebx
je 0x484574
cmp byte [esi + 4], 4
jne 0x484574
mov dword [esp - 0x44], 0x2107f7f2
movzx eax, word [esi + 5]
inc eax
push eax
mov esi, esi
call fcn.0048b720
mov edi, eax
add esp, 4
xchg edi, edi
movzx eax, word [esi + 5]
xor edx, edx
mov byte [eax + edi], 0xd
xchg ebx, ebx
add byte [eax + edi], 0x42
sub byte [eax + edi], 0x26
add byte [eax + edi], 0x1c
add byte [eax + edi], 0x19
mov dword [esp - 0x28], ebx
xor byte [eax + edi], 0x3e
sub byte [eax + edi], 0x60
xor eax, eax
mov ebx, ebx
cmp ax, word [esi + 5]
jae 0x484574
mov eax, dword [esi + 8]
movzx ecx, dx
mov dword [esp - 0x2c], 0x1e785f4a
inc edx
mov al, byte [eax + ecx]
xor al, 0x37
mov byte [ecx + edi], al
xchg edx, edx
cmp dx, word [esi + 5]
jb 0x484555
mov eax, edi
mov dword [esp - 0x28], edi
pop edi
pop esi
pop ebp
mov dword [esp - 0x28], 0x5b6d2413
ret 0xc
Function at 0x486460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
sub edi, ebx
sar edi, 1
je 0x48653e
push esi
xor ecx, ecx
lea esi, [edi + 1]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048b720
push edi
push ebx
mov ebx, eax
push esi
push ebx
call fcn.0048c140
mov esi, ebx
mov dword [ebp - 8], 0
add esp, 0x14
lea ecx, [esi + 2]
mov edi, edi
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4864b0
sub esi, ecx
lea edx, [ebp - 8]
sar esi, 1
mov dword [ebp - 4], esi
cmp esi, 2
jbe 0x4864ea
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048b720
mov edx, eax
add esp, 4
mov dword [ebp - 8], edx
xor edi, edi
test esi, esi
je 0x486517
mov esi, ebx
sub esi, edx
mov ecx, edi
lea edx, [edx + 2]
and ecx, 3
mov eax, 0x737e2440
shl ecx, 3
inc edi
sar eax, cl
cbw
xor ax, word [esi + edx - 2]
mov word [edx - 2], ax
cmp edi, dword [ebp - 4]
jb 0x4864f4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.00442250
cmp dword [ebp - 4], 2
pop esi
jbe 0x486535
push dword [ebp - 8]
call fcn.0048b6f0
add esp, 4
push ebx
call fcn.0048b6f0
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x488290
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
xchg ecx, ecx
cmp dword [ecx + 4], esi
jle 0x488366
xor edx, edx
lea ebx, [ebx]
mov dword [esp - 0x3c], edi
mov eax, dword [ecx + 8]
lea edx, [edx + 0xc]
inc esi
mov dword [esp - 0x2c], esp
mov dword [edx + eax - 0xc], 0x51ae1652
xor dword [edx + eax - 0xc], 0x75dd09a
sub dword [edx + eax - 0xc], 0x3bc64ed0
add dword [edx + eax - 0xc], 0x4053eed9
mov dword [esp - 0x2c], edx
xor dword [edx + eax - 0xc], 0x3cd7a384
sub dword [edx + eax - 0xc], 0x58cd5464
sub dword [edx + eax - 0xc], 0xe8970f1
mov eax, dword [ecx + 8]
xchg ebx, ebx
mov dword [eax + edx - 8], 0x5564539d
xor dword [eax + edx - 8], 0x165afebf
add dword [eax + edx - 8], 0x2e020794
sub dword [eax + edx - 8], 0x27ee0e80
xchg esp, esp
add dword [eax + edx - 8], 0x4476221
sub dword [eax + edx - 8], 0x4d9a0857
mov eax, dword [ecx + 8]
mov dword [eax + edx - 4], 0x3ae8b557
xchg esp, esp
xor dword [eax + edx - 4], 0x17bdd110
sub dword [eax + edx - 4], 0x18ab864b
xor dword [eax + edx - 4], 0x48d3e73c
xor dword [eax + edx - 4], 0x5c7a3ac0
mov dword [esp - 0x30], 0x5039d5d3
cmp esi, dword [ecx + 4]
jl 0x4882aa
push dword [ecx + 8]
mov dword [esp - 0x44], ebx
mov dword [ecx], 0x7852b743
sub dword [ecx], 0x645a9ef1
add dword [ecx], 0x5d15baf
sub dword [ecx], 0xf788e46
mov esi, esi
xor dword [ecx], 0x5a41e598
xor dword [ecx], 0x3ef5f2ad
sub dword [ecx], 0x6ee4f28e
mov dword [ecx + 4], 0x30e98e4f
xchg ebp, ebp
add dword [ecx + 4], 0x3ca955d6
xor dword [ecx + 4], 0x576a050
add dword [ecx + 4], 0x12b9c5bb
mov dword [esp - 0x10], 0x2066bddb
sub dword [ecx + 4], 0x76cf2082
sub dword [ecx + 4], 0x4cee9ae
call fcn.0048b6f0
xchg ebx, ebx
add esp, 4
pop esi
ret
Function at 0x488920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xchg ebx, ebx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xchg edi, edi
xor edi, edi
mov dword [ebp - 0x18], ecx
lea ebx, [eax + eax*2]
mov esi, esi
mov dword [ebp - 0xc], edi
shl ebx, 2
mov dword [ebp - 0x10], ebx
lea ecx, [ecx]
mov dword [esp - 0x40], ebp
mov ecx, dword [ecx + 8]
mov eax, dword [ebp + 0x10]
add ecx, ebx
mov esi, dword [ebp + 8]
xchg ecx, ecx
xor ebx, ebx
mov edx, dword [eax + edi*4]
xor eax, eax
mov dword [esp - 0x28], ebp
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov eax, edx
mov dword [esp - 0x40], 0x3c66f835
and eax, 3
lea eax, [esi + eax*2]
mov dword [ebp - 0x14], eax
mov dword [esp - 0x38], edx
lea eax, [edx + 1]
and eax, 3
mov edi, dword [ebp - 0x14]
xchg esp, esp
lea eax, [esi + eax*2]
mov dword [ebp + 0xc], eax
lea eax, [edx - 2]
and eax, 3
mov dword [esp - 0x18], edx
lea eax, [esi + eax*2]
mov dword [ebp - 4], eax
lea eax, [edx - 1]
and eax, 3
mov dword [esp - 0xc], ebx
lea eax, [esi + eax*2]
mov dword [ebp - 8], eax
lea esp, [esp]
mov eax, 0x58ec13d6
xchg edi, edi
sub eax, 0xe7ce72a
sub eax, 0x40a2230a
xor eax, 0xa98f9a0
mov ebx, ebx
xor eax, 0x15be7011
add eax, 0x93bf2a98
mul ebx
xchg ebp, ebp
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ebx
mov dword [esp - 0x40], esp
sub edx, eax
inc ebx
mov eax, dword [ecx + edx*4]
lea esi, [ecx + edx*4]
mov dword [esp - 0x38], edi
movzx edx, word [edi]
add eax, eax
and edx, 1
or eax, edx
mov dword [esp - 0x28], 0x31a26a09
not edx
mov dword [esi], eax
movzx eax, word [edi]
shr ax, 1
mov edx, edx
shl edx, 0xf
or dx, ax
mov eax, dword [ebp + 0xc]
mov word [edi], dx
xchg esp, esp
movzx edx, word [eax]
mov eax, dword [esi]
and edx, 1
add eax, eax
mov dword [esp - 0x28], esi
or eax, edx
not edx
mov dword [esi], eax
mov dword [esp - 0x34], edi
mov eax, dword [ebp + 0xc]
shl edx, 0xf
movzx eax, word [eax]
xchg edi, edi
shr ax, 1
or dx, ax
mov eax, dword [ebp + 0xc]
mov dword [esp - 0x10], 0x1ae30cd7
mov word [eax], dx
mov eax, dword [ebp - 4]
movzx edx, word [eax]
mov eax, dword [esi]
mov edi, edi
and edx, 1
add eax, eax
or eax, edx
xchg ecx, ecx
not edx
mov dword [esi], eax
mov eax, dword [ebp - 4]
shl edx, 0xf
mov dword [esp - 0x18], 0x1a2f5582
movzx eax, word [eax]
shr ax, 1
or dx, ax
mov dword [esp - 0x14], 0x1b5f1e89
mov eax, dword [ebp - 4]
mov word [eax], dx
mov eax, dword [ebp - 8]
xchg edx, edx
movzx edx, word [eax]
mov eax, dword [esi]
and edx, 1
add eax, eax
mov edi, edi
or eax, edx
not edx
mov dword [esi], eax
mov dword [esp - 0x28], 0x28d2e13f
mov esi, dword [ebp - 8]
shl edx, 0xf
movzx eax, word [esi]
mov dword [esp - 0x38], 0xd4990f8
shr ax, 1
or dx, ax
mov word [esi], dx
mov edi, edi
cmp ebx, 0xf
jl 0x4889b6
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov dword [esp - 0x18], 0x4ec1420f
inc edi
mov ecx, dword [ebp - 0x18]
add ebx, 0xc
mov dword [ebp - 0xc], edi
mov dword [esp - 0x24], 0x4178123a
mov dword [ebp - 0x10], ebx
cmp edi, 8
jl 0x48894a
xchg esi, esi
pop edi
pop esi
pop ebx
mov ecx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x488b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xchg edi, edi
sub esp, 0x4c
xor eax, eax
push ebx
mov ebx, ecx
mov dword [esp - 0x10], 0x1b032889
jmp 0x488b2a
mov edx, dword [eax + 0x4ba520]
xor edx, 0x44ea390e
mov dword [ebp + eax - 0x4c], edx
add eax, 4
mov esi, esi
cmp eax, 0x40
jb 0x488b2a
cmp dword [ebx + 4], 8
jne 0x488c02
xchg edx, edx
mov edx, dword [ebp + 8]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
mov dword [esp - 0x10], esi
shl cx, 8
or cx, ax
movzx eax, byte [edx + 3]
mov word [ebp - 6], cx
mov esi, esi
movzx ecx, byte [edx + 2]
shl cx, 8
or cx, ax
movzx eax, byte [edx + 5]
mov ecx, ecx
mov word [ebp - 8], cx
movzx ecx, byte [edx + 4]
shl cx, 8
or cx, ax
mov esi, esi
movzx eax, byte [edx + 7]
mov word [ebp - 0xa], cx
movzx ecx, byte [edx + 6]
shl cx, 8
mov dword [esp - 0x3c], edx
or cx, ax
lea eax, [ebp - 0x4c]
push eax
mov edx, edx
nop
mov dword [esp - 4], 0x36a4edd
add dword [esp - 4], 0x5d8eceed
sub dword [esp - 4], 0x47181fc6
mov dword [esp - 0x24], ecx
add dword [esp - 4], 0x44bfd06f
add dword [esp - 4], 0xa4c9aec
sub dword [esp - 4], 0x68ed695f
sub esp, 4
mov esp, esp
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], cx
push eax
mov ecx, ebx
xchg esi, esi
call fcn.00488920
pop ebx
mov esp, ebp
pop ebp
xchg ebx, ebx
ret 4
cmp dword [ebx], 0
pushf
mov dword [ebp - 4], 0x244987
mov esp, esp
add dword [ebp - 4], 0x3ffc0164
xor dword [ebp - 4], 0x7ea379f
add dword [ebp - 4], 0x1a1adfcf
sub dword [ebp - 4], 0x61e55d43
xchg esp, esp
popf
jle 0x488d3d
mov eax, dword [ebp + 8]
mov edx, 0x6430217c
mov dword [esp - 0x30], esi
xor edx, 0x22668df2
add edx, 0x23fea0ce
sub edx, 0x3a990d2e
add edx, 0xd043bfd0
xchg esp, esp
push esi
sub edx, eax
push edi
mov dword [esp - 0x10], 0x39f1fc4f
lea edi, [eax + 2]
mov dword [ebp + 8], edx
jmp 0x488c78
movzx ecx, byte [edi - 2]
lea esi, [edx + edi]
movzx eax, byte [edi - 1]
shl cx, 8
mov edx, edx
or cx, ax
movzx eax, byte [edi + 1]
mov word [ebp - 6], cx
mov dword [esp - 0x40], ecx
movzx ecx, byte [edi]
shl cx, 8
or cx, ax
mov dword [esp - 0x30], edx
movzx eax, byte [edi + 3]
mov word [ebp - 8], cx
movzx ecx, byte [edi + 2]
mov edi, edi
shl cx, 8
or cx, ax
movzx eax, byte [edi + 5]
mov dword [esp - 0x1c], 0x5edcbbc6
mov word [ebp - 0xa], cx
movzx ecx, byte [edi + 4]
shl cx, 8
mov dword [esp - 0x24], esi
or cx, ax
lea eax, [ebp - 0x4c]
push eax
mov dword [esp - 0x38], esi
push esi
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], cx
push eax
mov dword [esp - 0x3c], 0x558f9c2f
mov ecx, ebx
call fcn.00488920
lea eax, [ebp - 0x2c]
mov esp, esp
mov ecx, ebx
push eax
mov eax, dword [ebx + 4]
sub eax, esi
mov edi, edi
sub eax, 8
push eax
lea eax, [ebp - 0xc]
mov ebx, ebx
push eax
call fcn.00488920
mov eax, dword [ebp - 4]
mov dword [esp - 0x2c], ebp
lea edi, [edi + 8]
mov edx, dword [ebp + 8]
inc eax
mov dword [esp - 0x3c], 0x56a549f6
mov dword [ebp - 4], eax
cmp eax, dword [ebx]
jl 0x488c78
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
xchg esi, esi
pop ebp
ret 4
Function at 0x488d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dword [esp - 0x38], 0x3a08912a
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [esp - 0x14], edi
test esi, esi
je 0x488da4
mov eax, dword [ebp + 8]
mov esp, esp
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, esi
mov edx, edi
mov dword [esp - 0x38], 0x1d4d145c
xor edx, eax
test cl, 1
lea ecx, [eax + eax]
xchg esi, esi
cmove edx, edi
mov eax, ecx
xor eax, ebx
mov esp, esp
mov edi, edx
cmp ecx, 0x100
cmovb eax, ecx
shr esi, 1
mov ebx, ebx
jne 0x488d73
pop ebx
mov eax, edi
mov dword [esp - 0x1c], 0x3264b303
pop edi
pop esi
pop ebp
ret
Function at 0x4892b0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea edx, [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jle 0x4892d8
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
jmp 0x4892e6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov ecx, edx
test esi, esi
jle 0x489300
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
jmp 0x48930e
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, edx
test esi, esi
jle 0x489328
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x489336
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ecx, edx
test esi, esi
jle 0x489350
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x48935e
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov eax, edx
mov dword [ebp - 0x2c], 0
cdq
mov dword [ebp - 0x3c], eax
mov eax, esi
mov dword [ebp - 0x38], edx
cdq
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x489392
add dword [esp], 5
retf
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c040
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40c0f5
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_ReleaseDC]
nop dword [eax]
push 0
push 0
call ebp
add byte [edi + ebx], 0xa0
push 0
push 0
call ebp
add byte [edi + ebx], 0x7e
push 0
push 0
call ebp
add byte [edi + ebx], 0x96
push 0
push 0
call ebp
xor byte [edi + ebx], 0xe0
push 0
push 0
call ebp
add byte [edi + ebx], 0x30
push 0
push 0
call ebp
add byte [edi + ebx], 0x9a
push 0
push 0
call ebp
add byte [edi + ebx], 0xb1
push 0
push 0
call ebp
xor byte [edi + ebx], 0x4a
push 0
push 0
call ebp
add byte [edi + ebx], 0xd0
push 0
push 0
call ebp
add byte [edi + ebx], 0x31
push 0
push 0
call ebp
xor byte [edi + ebx], 0x7f
push 0
push 0
call ebp
add byte [edi + ebx], 0xdf
push 0
push 0
call ebp
xor byte [edi + ebx], 0x30
push 0
push 0
call ebp
add byte [edi + ebx], 0xad
inc ebx
cmp esi, ebx
jne 0x40c060
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402cc5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c100
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
mov ebx, eax
jb 0x40c118
mov ebx, dword [eax]
mov esi, dword [esp + 0x40]
xor esi, edi
cmp edi, 4
jae 0x40c127
mov ecx, edi
jmp 0x40c195
mov dword [esp + 0x24], edi
shr edi, 2
xor ebp, ebp
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.GDI32.dll_ArcTo]
sub esp, 0x24
mov dword [esp + 4], str.Z81xbyuAua
mov dword [esp], 0x4d4860
call fcn.00402d5b
mov dword [esp], eax
call fcn.004060eb
imul eax, dword [ebx + ebp*4], 0x5bd1e991
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e991
imul esi, esi, 0x5bd1e991
xor esi, eax
inc ebp
cmp edi, ebp
jne 0x40c130
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
mov edi, dword [esp + 0x24]
and edi, 0xfffffffc
and ecx, 3
xor eax, eax
cmp ecx, 1
je 0x40c1be
cmp ecx, 2
je 0x40c1b4
cmp ecx, 3
jne 0x40c1cc
movsx eax, byte [ebx + edi + 2]
shl eax, 0x10
movsx ecx, byte [ebx + edi + 1]
shl ecx, 8
xor eax, ecx
movsx ecx, byte [ebx + edi]
xor ecx, eax
imul eax, ecx, 0x5bd1e991
xor esi, eax
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e991
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4035bc
Capabilities:
Terminate process

Disassembly:
jmp 0x453cc3
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453cd4
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058c1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x16a2856
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x6f0a48e2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40306c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0x890088], 0x594
push edi
mov dword [ebp - 8], eax
jne 0x4030a2
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x470ef8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x470efc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.00403065
mov eax, dword [0x470f00]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x470f04]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x890088], 0xc
mov dword [ebp - 4], eax
jne 0x403130
push esi
lea eax, [ebp - 0x830]
push eax
push 0x4024f0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x890088]
cmp eax, 0xfa9
jne 0x40314c
mov dword [0x88f624], 0xedeb2e40
cmp eax, 0x3eb
jne 0x403159
mov dword [0x88efd4], esi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, ebx
shr edx, cl
lea eax, [edi + ebx]
mov dword [ebp - 0x14], eax
mov dword [0x88f620], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x890088], 0xc
jne 0x4031af
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
add edi, edx
add eax, dword [ebp - 0x24]
xor eax, edi
xor dword [ebp - 4], eax
sub ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0040305e
dec dword [ebp - 0x18]
jne 0x4030db
cmp dword [0x890088], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], ebx
jne 0x403206
push esi
push 0x402588
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x890088]
mov ecx, dword [0x88efd8]
sub esp, 0x400
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4032b3
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x890088], 0x959
jne 0x4032a5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x400]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
call fcn.0040306c
add edi, 8
dec ebx
jne 0x403238
pop edi
pop ebx
pop esi
leave
ret
Function at 0x404370
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4700c8]
jne 0x40437a
repz ret
jmp fcn.00406ade

Function at 0x4066ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043f1
and dword [ebp - 4], 0
cmp dword [0x471a10], 0
mov ebx, eax
jne 0x4067b0
push 0x4019c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406861
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019bc
push edi
call esi
test eax, eax
je 0x406861
push eax
call fcn.0040437f
mov dword [esp], 0x4019ac
push edi
mov dword [0x471a10], eax
call esi
push eax
call fcn.0040437f
mov dword [esp], 0x401998
push edi
mov dword [0x471a14], eax
call esi
push eax
call fcn.0040437f
mov dword [esp], 0x40197c
push edi
mov dword [0x471a18], eax
call esi
push eax
call fcn.0040437f
pop ecx
mov dword [0x471a20], eax
test eax, eax
je 0x4067b0
push 0x401964
push edi
call esi
push eax
call fcn.0040437f
pop ecx
mov dword [0x471a1c], eax
mov eax, dword [0x471a1c]
cmp eax, ebx
je 0x406808
cmp dword [0x471a20], ebx
je 0x406808
push eax
call fcn.004043fa
push dword [0x471a20]
mov esi, eax
call fcn.004043fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406808
test edi, edi
je 0x406808
call esi
test eax, eax
je 0x4067ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4067ff
test byte [ebp - 0xc], 1
jne 0x406808
or dword [ebp + 0x10], 0x200000
jmp 0x406841
mov eax, dword [0x471a14]
cmp eax, ebx
je 0x406841
push eax
call fcn.004043fa
pop ecx
test eax, eax
je 0x406841
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406841
mov eax, dword [0x471a18]
cmp eax, ebx
je 0x406841
push eax
call fcn.004043fa
pop ecx
test eax, eax
je 0x406841
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x471a10]
call fcn.004043fa
pop ecx
test eax, eax
je 0x406861
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406863
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret