joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfb3544
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jp 0xc1a72f
dec esp
shrd ebx, esi, cl
dec ecx
mov dword [edi + edx*2 - 2], ebx
not esi
inc esp
add al, dh
add di, 0xda2
inc ecx
jmp ebx
xor eax, 0x3801eebc
mov ebp, 0x1fa81fa0
inc ecx
rol edx, cl
not eax
dec eax
dec eax
mov dword [esp + edx - 0x182deb0d], edi
ror bp, 0xe7
or dword [esp + edx - 0x182deb0b], edx
not eax
ror byte [esp + edx*4 - 0x60b7ac32], 0xe7
dec esp
mov dword [esp + edx - 0x182deb0d], ecx
inc esp
xchg bh, dl
xor dword [esp + edx*2 - 0x305bd61a], eax
inc ecx
pop ecx
dec eax
arpl ax, ax
xadd ebp, edi
dec esp
adc ebx, eax
movsx eax, cx
dec ecx
mov ebx, dword [edi + edx - 0x182deb0d]
inc ebp
mov esi, edx
dec eax
lea esi, [ebp + edi*4 - 0x54d35f61]
dec esi
mov esi, dword [edx + edi - 0x182deb05]
xor cx, di
dec ecx
rol edx, 0xd1
adc cx, bp
inc edx
mov cl, byte [edx + edi - 0x182deafd]
dec ecx
nop
sbb edx, edx
inc dx
dec ebp
lea edi, [edi + edx*2 + 8]
jns 0xc33fe0

Function at 0xfb7bab
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], ebp
inc ecx
push edi
push 0x9290d2ba
pushfd
pop ebp
dec eax
mov dword [esp], ebp
mov ebp, 0xf4b59614
dec eax
dec ebp
inc esp
movsx edi, ch
dec eax
lea ebp, [0xff3f31b2]
jge 0xeb7ff4
add edi, eax
dec cx
shr cx, cl
mov ecx, dword [esi + ecx*4 - 0x17e]
lea eax, [edx - 0x4051eb70]
mov edx, dword [edx + esi - 0x55303063]
inc eax
jg 0xef3280
push eax
bound edi, qword [ebx + 0x5b]
dec ecx
push es
mov esi, dword [esi - 0x456f6e31]
mov ch, 0x4c
dec esp
mov dword [esp + edi*8 - 0x538], ebx
ret
inc ebp
sub bh, bh
push edx
inc ecx
not bh
inc ecx
movzx edx, bh
push edi
call fcn.00f9a60f
loopne 0xeb801d
test dword [eax], eax
add eax, 0x21000000
dec ebp
mov ah, 0
add byte [eax], dl
add byte [eax], al
mov eax, dword [0xbe61]
invalid
mov eax, 0xafd5
nop
push esi
add byte [ebp + 0x73], bl
xchg byte [eax], al
add byte [eax - 0x7df0ffa8], dh
jb 0xc1dfe1
seta byte [esp + eax + 4]
xor eax, dword [eax + ebp - 4]
lea ebp, [ebp + edx - 0x5530687a]
xchg byte [esp + edx - 0x5530686f], dl
mov dword [esp + edx - 0x55306800], edx
xor eax, ebx
neg dl
xchg word [esp + edx - 0x553067ff], dx
xor eax, 0x6e382fbc
sal word [esp + edx - 0x55303063], 0x81
movzx ecx, dx
not eax
ja 0xeddcde
adc dword [esp + ecx - 0x3064], ecx
xchg byte [esp + edx - 0x55303066], cl
ror eax, 2
inc edx
dec eax
sal dword [esp + ecx - 0x3065], 0xb9
xor ebx, eax
push ecx
jmp 0xc66705
push 0x23d6712
jmp 0xc0ce2a
Function at 0xfc76da
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec eax
inc edx
dec ebp
lea ebp, [ebp + edx*2 - 0x16d]
dec eax
inc edx
inc sp
mov dword [esp + edx - 0xae], edx
call fcn.00f3b39b
inc ebp
mov esp, dword [ebp + ebp - 0x45b7]
dec eax
dec ebp
dec eax
mov dword [esp + ebp - 0x45b2], esi
inc ebp
xor esp, ecx
inc ecx
mov ecx, esi
inc ecx
shl dh, 0xa1
add word [esp + ebp*8 - 0x22d8b], 0x3fb9
inc ecx
dec esp
dec eax
dec dword [esp + ebp - 0x45b2]
inc esp
mov byte [esp + ebp*8 - 0x22d8b], dh
inc ecx
bswap esp
not ebp
pop eax
inc ecx
not esp
inc eax
movzx edx, dh
jle 0xf3af05
inc ecx
mov eax, 0xcab78981
inc ebp
lea esp, [esp + edx*4 - 0x5847d81]
dec eax
not ecx
inc ecx
neg dh
inc ecx
xor esp, 0x2fb45237
inc ecx
push ecx
inc ecx
shl al, 0x81
adc ebp, edx
inc esp
xor dword [esp + edx - 0xb3], esp
dec eax
dec ecx
push ecx
neg bp
dec esp
mov ecx, dword [esp + edx - 0xab]
dec eax
mov dword [esp + edx - 0xab], 0x389f8b11
dec ecx
not eax
dec ebp
arpl sp, sp
and word [esp + edx*2 - 0x158], 0x1695
inc esp
mov edx, edx
dec ebp
adc ebx, esp
dec eax
lea ebx, [edx*4 - 0x654825de]
inc ebp
movzx esi, byte [ebp + edx - 0xb8]
jmp 0xc20ed3

Function at 0xfc8091
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc eax
add dh, dl
dec esp
mov dword [esp + edi - 0x41a84b9c], ecx
xadd cx, ax
inc esp
movzx edx, dl
inc esp
xor dword [esp + ecx - 0x20a0], esp
dec esp
mov ecx, dword [esp + edi - 0x41a84b9c]
add si, bp
dec edx
lea ebx, [edx*8 + 0x5a8d7009]
xadd cl, ch
dec ebp
arpl sp, sp
inc esp
adc esi, eax
inc ecx
rol dl, 0x45
js 0xf3ae99
dec ebp
adc ebx, esp
dec eax
and dword [esp + edi - 0x41a84ba4], 0x6eba180a
jp 0xf112ae
setns byte [esp + eax - 0x358ea278]
inc esp
or edx, esi
dec edx
lea edi, [ecx + edi - 0xd59e]
jo 0xea484c
inc ecx
add ecx, eax
dec eax
mov dword [esp + ecx - 0xd54c], 0xdc2b1196
dec ecx
mov dword [edi + ecx - 0xd54c], edi
dec edx
lea esi, [0xd402de9c]
dec ecx
sbb eax, 0xd9021e8e
mov edx, dword [esp + ecx*4 - 0x3552a]
inc ecx
mov ebx, dword [ebp + ecx*8 - 0x6aa65]
dec ebp
lea ebp, [ebp + eax*2 - 0x6b1d4507]
rol cl, 0xa2
inc ecx
xor ebx, ecx
lea ebx, [esi + ebx - 0x636bc0b4]
inc esp
xor byte [esp + ecx - 0xd525], dl
ror ebx, 3
neg ebx
shl si, 0x49
ror ebx, 1
call fcn.00f28683
xor ebx, eax
inc dx
movzx ecx, dx
add edi, eax
movzx eax, cx
xor edx, 0x9014363e
jmp edi

Function at 0xfc8407
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
xor ebx, eax
not dword [esp + ecx - 0x44000000]
add edi, eax
sub cl, byte [esp + ecx - 0x43fffffd]
jno 0xfd43e0
inc ebp
dec esi
mov dword [esp + esi*2 - 0x6a175a10], ecx
dec esi
mov dword [esp - 0x648de9be], eax
inc dx
ror dword [esp + esi - 0x350bad0c], 0x45
dec edx
neg dword [esp - 0x648de9b8]
inc edx
xor dword [esp - 0x648de9a6], ebp
inc eax
sar dh, 1
dec esi
mov ecx, dword [esp - 0x648de9a6]
inc edx
inc dword [esp + esi - 0x350bad08]
dec eax
arpl bp, bp
call fcn.00f15f22
not byte [esp + ecx - 0x43fffffe]
jmp 0xfbb07a

Function at 0xfca41e
Capabilities:
Encrypt data using speck

Disassembly:
inc cx
or eax, 0xf41888a
mov dh, 0xc8
inc ecx
inc esp
or eax, ecx
dec esp
mov dword [esp + eax - 0x3908a0af], eax
call fcn.00eb5544
Function at 0xfd566d
Capabilities:
Encrypt data using speck

Disassembly:
bswap ecx
xor al, byte [esp + eax*2 - 0x654bdaa9]
dec dword [esp + edx - 0x1bb8e0f0]
lea ecx, [eax + ecx + 0x4297ad26]
inc word [esp + edx - 0x1bb8e0f0]
bswap ecx
jns 0xf130f7
sbb ax, word [esp + eax - 0x32a5edf5]
inc ecx
add word [esp + edx*2 - 0x3771c1e0], 0xed20
jae 0xc46c33
xor ebx, ecx
shr dx, 0x43
adc edi, ecx
pop edx
dec dx
mov esi, dword [eax + esi - 0x32a54c57]
add dx, ax
or eax, 0x9824e12c
jnp fcn.00f3ad7e
mov edx, dword [esi]
add esi, 4
mov dword [esp], 0xf6054684
call fcn.00c3aefc
jmp 0xed04f5
inc ebp
mov edi, dword [edi + edi - 0xa8a1]
inc ecx
push esi
jmp 0xfda31e
pop edx
push eax
lea edx, [eax + eax*2 - 0x4bca8df8]
not ecx
ror ecx, 2
shl dx, 0xc2
add ax, 0xb003
dec ecx
not al
push eax
xor ebx, ecx
add edi, ecx
xor word [esp + 4], ax
shr eax, 0xde
call fcn.00c45af0
lea ebp, [ebp + eax*2 - 0x22]
shl edx, 0x84
shr eax, 0x43
mov ecx, dword [edx + ebp - 0x1bb8e0f0]
mov dword [esp + edx*4 - 0x6ee383c0], 0xa1a0f881
xor eax, 0x32a5edaa
xor ecx, ebx
sal al, 0x41
adc byte [esp + edx*2 - 0x3771c1e0], 0x91
jle 0xeafa0a
pop ebx
jmp fcn.00f0add5

Function at 0xfdb9be
Capabilities:
Encrypt data using speck

Disassembly:
mov cl, byte [esi + 8]
call fcn.00c5a781
dec edi
push 0x1d797a6e
nop
test eax, 0xdfb58ee3

Function at 0x14ab269
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [ebx + eax*2 + 0x2378aea]
dec eax
mov dword [esp + eax - 0x4018], esi
rol word [esp + eax - 0x4015], 0xe2
dec esp
lea esi, [edx + ecx - 0x126e40f0]
xor ebx, 0x60b95b2a
inc esp
add dh, dh
bswap ebx
call fcn.00fb481e
Function at 0x14ab299
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x53a271a0
xor ecx, ecx
not edx
movzx eax, cl
seta al
je 0xed2017
inc ecx
rol esp, 1
inc eax
sal dh, 0x86
inc ecx
xor esp, 0x4502ac98
inc ecx
movzx ebp, dx
dec dl
inc ecx
and edx, 0x1d1ab90a
inc ecx
inc esp
dec eax
xchg dword [esp + ebx*2 - 0xd4], esi
inc ecx
bswap esp
dec esp
lea eax, [edx*8 + 0x4491f026]
jmp 0xf01dc1
mov dword [esi + ecx], edx
push eax
dec cl
lea ebp, [ebp + ecx*8 - 0x7fc]
adc ecx, 0xf525ccbc
mov ecx, dword [ebp + eax*4]
lea edx, [eax + eax + 0xa069a28]
push edx
pop edx
xor ecx, ebx
add word [esp + eax + 2], dx
neg ecx
and ax, 0x7abe
xor ecx, 0xeaae19ab
and al, 0x9b
lea eax, [edx + 0xb92d2b5]
lea ecx, [eax + ecx - 0x58d5130a]
pop edx
ror ecx, 1
shr edx, 0xd7
xadd al, dl
sub ecx, 0xf0353aab
xchg edx, eax
dec eax
xor ecx, 0x5aa23f15
call fcn.00c49c6f
inc ecx
inc esp
inc cx
and edx, 0x894e7eb9
mov word [eax + esi*8 - 0x41], ss
invalid
lea esp, [esp + 4]
je 0xc0c195
jmp fcn.00ea1eb9
mov edx, dword [ebp + ecx*4]
xadd ecx, eax
call fcn.00fd3e85
jbe 0xf12ef9
sbb esi, 0xc
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
mov dword [esi], edx
push ss
push 0x8603b014
mov ebx, dword [esp + 8]
call fcn.00f1327d
rdtsc
mov ecx, 0x79968d16
shl ecx, cl
lea esi, [esi + ecx - 0x45800008]
add ecx, ecx
mov dword [esi + 4], eax
sub ecx, ecx
mov eax, 0xad18cf85
mov dword [esi + ecx], edx
lea ebp, [ecx + ebp - 4]
jae 0xf2b069
jae 0x14ab368
int1
iretd
and ebp, edi
inc ecx
pop ebx
jl 0x14ab2af
pop edi
inc esi
xchg dword [esi + ebx*8], edx
lodsb al, byte [esi]
fcom dword [edi + 0x1a28f804]
shl byte [ecx + 0x5c], cl
ret
mov word [edx - 0x152eb930], cs
into
pop ebx
adc ah, byte [ebx + 0x4f]
mov cl, 0x71
loopne 0x14ab30c
in eax, 0x8f
jmp 0x8409f5bf

Function at 0x14af141
Capabilities:
Get number of processors

Disassembly:
or eax, edi
jmp eax
ror ecx, 0x88
mov dx, ax
jb 0xc29592
movzx dx, dl
movzx eax, cx
mov dword [esp + ecx - 0x2b782869], ecx
sar ecx, 0x13
mov al, byte [esi + ecx - 0x56f]
not dl
not al
ja 0xf93dd7

Function at 0x14b1c42
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + ebx - 1], 0xe1bdcdb0
dec ebp
lea edi, [edi + ebx*2 + 2]
inc sp
xadd ebp, eax
inc cx
shld esi, edx, cl
call fcn.00c3e2f7
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x32dd017d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x30f461c3
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x583d20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x112000]
push edi
or ebp, 0xffffffff
jmp 0x583d42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x583d49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x583d38
mov eax, 1
add ebx, ebx
jne 0x583d5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x583d6c
jne 0x583d8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x583d8b
dec eax
add ebx, ebx
jne 0x583d78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x583d50
add ebx, ebx
jne 0x583d87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x583ddd
xor ecx, ecx
sub eax, 3
jb 0x583da3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x583e12
sar eax, 1
mov ebp, eax
jmp 0x583dae
add ebx, ebx
jne 0x583dae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x583d7c
inc ecx
add ebx, ebx
jne 0x583dbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x583d7c
add ebx, ebx
jne 0x583dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x583dbe
jne 0x583dda
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x583dbe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x583dfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x583dee
jmp 0x583d3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x583dfc
add edi, ecx
jmp 0x583d3e
pop esi
mov edi, esi
mov ecx, 0x564d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x583e1a
cmp byte [edi], 0x1e
jne 0x583e1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x583e1f
lea edi, [esi + 0x180000]
mov eax, dword [edi]
or eax, eax
je 0x583e97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a0490]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a05d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x583e4c
mov ecx, edi
jns 0x583e7b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a05d4]
or eax, eax
je 0x583e91
mov dword [ebx], eax
add ebx, 4
jmp 0x583e69
call dword [esi + 0x1a05dc]
mov ebp, dword [esi + 0x1a05d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x583ecb
sub esp, 0xffffff80
jmp 0x4a8ace
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x47bc40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
cmp dword [esp + 0x18], 0
mov esi, ecx
mov ecx, 0xc9100bd9
mov eax, 0x2f8bc11d
cmove eax, ecx
mov ecx, 0x972f94a1
nop
cmp ecx, 0x972f94a1
je 0x47bcb1
cmp ecx, 0xc9100bd9
je 0x47bcb5
cmp ecx, 0x2f8bc11d
jne 0x47bc60
mov dword [esi], 0x502144
mov dword [esi + 0x78], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x70], 0x5021ac
mov ecx, 0xc9100bd9
jmp 0x47bc60
mov ecx, eax
jmp 0x47bc60
mov eax, dword [esi]
mov edi, 0x1114102f
mov ebp, 0x996a7506
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x502140
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x70]
mov dword [esi + eax - 4], ecx
mov eax, dword [0x517e3c]
mov edx, dword [0x517e40]
lea ecx, [eax - 1]
imul eax, ecx
mov ecx, eax
xor ecx, 0xfffffffe
test ecx, eax
mov ecx, 0x996a7506
sete bl
sete byte [esp + 2]
cmove ecx, edi
cmp edx, 0xa
setl dl
setl byte [esp + 3]
cmovge ecx, ebp
xor dl, bl
mov edx, 0xb9dee703
cmovne ecx, edi
mov edi, 0x66d4d674
nop dword [eax]
cmp edi, 0x1114102e
jg 0x47bd40
cmp edi, 0x996a7506
je 0x47bd73
cmp edi, 0xb9dee703
jne 0x47bd20
mov edi, ecx
jmp 0x47bd20
cmp edi, 0x1114102f
je 0x47bd7a
cmp edi, 0x66d4d674
jne 0x47bd20
movzx eax, byte [esp + 2]
mov bh, byte [esp + 3]
mov edi, 0x996a7506
mov bl, al
xor bl, bh
test bh, bh
cmovne edi, edx
test al, al
cmove edi, ebp
test bl, bl
cmovne edi, edx
jmp 0x47bd20
mov edi, 0xb9dee703
jmp 0x47bd20
lea edi, [esi + 0x10]
mov ecx, esi
push 0
push 0
push edi
call fcn.00493d50
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x502140
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x70]
mov dword [esi + eax - 4], ecx
mov dword [esi + 0x10], 0x5020c0
push 8
call fcn.0049d630
add esp, 4
mov ebx, eax
push 1
call fcn.0049e4ad
add esp, 4
lea edx, [esi + 0x14]
lea ecx, [esi + 0x18]
mov dword [ebx + 4], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x24]
lea ecx, [esi + 0x28]
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x34]
lea ecx, [esi + 0x38]
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x18], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x10], 0x502080
mov ecx, edi
push 0
push 0
call fcn.00484200
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4eedfe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ef047

Function at 0x4ef5e0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ef668

Function at 0x4f0d02
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f0dce
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xc741f53
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x17294577
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x40b133]
shl eax, 2
mov dword [0x40b137], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00402870
pop edx
call fcn.00401b78
call fcn.00402874
push 0
call fcn.004034f8
pop ecx
push 0x40b0dc
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40b13b], eax
push 0
jmp fcn.00408774

Function at 0x402534
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4076cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40772e
call fcn.0040767c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004029f8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004029f8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4077ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40cd00], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x407886
cmp dword [0x40ccfc], 0
jne 0x407886
cmp dword [0x40cf08], 0
je 0x407840
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0040757c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x407826
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0040757c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x407826
lea ebx, [ebp - 0x84]
jmp 0x407827
inc ebx
call fcn.00407768
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4078c1
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40cd04
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004029f8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40cd07
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4078c1
cmp dword [0x40ccfc], 0
je 0x4078a0
cmp dword [0x40ccfc], 0xffffffff
je 0x4078c1
push esi
call dword [0x40ccfc]
pop ecx
mov eax, dword [0x40cd00]
test eax, eax
je 0x4078c1
cmp dword [0x40cd00], 0xffffffff
je 0x4078c1
cmp byte [eax], 0
je 0x4078c1
push esi
push eax
call fcn.004076cc
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret