joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb36620
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0xb36627
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0xb36704
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xb5ab48]
inc ecx
sub edx, 8
sub esi, 1
jne 0xb36640
pop edi
test edx, edx
je 0xb3672b
jmp 0xb36710
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0xb5ab48]
inc ecx
sub edx, 1
jne 0xb36710
not eax
pop esi
ret

Function at 0xb36730
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xb5ab48]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0xb5ab48]
mov dword [edx + 8], ecx
ret

Function at 0xb36780
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0xb5ab48]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0xb5ab48]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0xb37b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xb37b9e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0xb37b92
cmp dword [edi + 0x7c], ebx
je 0xb37bad
call fcn.00b37f60
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00b378f0
add esp, 0xc
test eax, eax
je 0xb37bd4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.00b41f46
mov esi, eax
add esp, 4
cmp esi, ebx
je 0xb37c12
push 0x4000
call fcn.00b41f46
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0xb37c1f
push esi
call fcn.00b42010
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0xb37c67
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00b36a40
test eax, eax
jne 0xb37c67
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0xb37c8e
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0xb37c94
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0xb37cd1
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0xb37cd1
call fcn.00b36730
add ebp, 1
jne 0xb37cc0
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10064227
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10064236
pop dword [ebp - 0x14]
mov eax, 0xbde42ed1
add eax, 0x52221365
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x70ac4e1
sub dword [ebp - 0x24], 0xb8b87f96
mov dword [ebp - 0x20], 0x649ef0a0
add dword [ebp - 0x20], 0xcd945ba5
mov dword [ebp - 0x1c], 0x6e57530f
sub dword [ebp - 0x1c], 0x220b0ee1
mov dword [ebp - 0x18], 0x160f7d81
add dword [ebp - 0x18], 0xe9f0827f
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x4b585d31
add dword [ebp - 0x24], 0x291a0c25
mov dword [ebp - 0x20], 0xf69d6eed
add dword [ebp - 0x20], 0x4acef288
mov dword [ebp - 0x1c], 0x57b9068
add dword [ebp - 0x1c], 0x5df3dc04
mov dword [ebp - 0x18], 0x7c5fd058
sub dword [ebp - 0x18], 0x7c5fd058
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x4227a663
add eax, 0xcddf69a5
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x48b0a
push 0
call eax
mov ecx, 0x96756d6d
sub ecx, 0x96751c8a
xor esi, esi
add esi, eax
mov edi, 0x100ac600
add edi, dword [ebp - 0x14]
mov edx, 0x9781f29b
add dword [ebp - 8], ebx
mov ebx, dword [edi]
xor dword [ebp - 4], 0x7fe92088
add ebx, edx
xor dword [ebp - 8], esi
mov dword [esi], ebx
xor dword [ebp - 0x10], 0xfc399fdc
add esi, 4
add edi, 4
loop 0x10064349
add eax, 0xc26c47b6
sub eax, 0xc26b1157
xor ebx, ebx
add ebx, eax
add eax, 0x6caddce2
sub eax, 0x6caddcdd
mov ecx, 0x76315324
add ecx, 0x99ceacdc
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x100020e0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x18
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
test byte [0x10005018], 8
jne 0x10002268
lea eax, [esi - 0x101]
cmp ax, 1
jbe 0x10002130
cmp si, 0x104
je 0x10002130
mov eax, 9
mov word [0x10009028], ax
mov eax, 1
jmp 0x10002221
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x100022fa
mov edx, dword [ebx + 0xac]
mov word [eax + 8], si
lea esi, [ebx + 0xa8]
movd xmm0, esi
movd xmm1, edx
punpckldq xmm0, xmm1
movq qword [eax], xmm0
mov dword [edx], eax
mov edx, dword [0x10009010]
mov dword [ebx + 0xac], eax
mov eax, dword [0x1000900c]
test edx, edx
je 0x10002230
mov dword [esp], edx
mov esi, dword [sym.imp.user32.dll_PostMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call esi
mov edx, dword [ebx + 0xb0]
sub esp, 0x10
test edx, edx
je 0x100022d8
cmp edx, dword [0x10009010]
jne 0x100022f0
mov edx, dword [ebx + 0xb4]
mov eax, dword [0x1000900c]
test edx, edx
je 0x100021ff
cmp edx, dword [ebx + 0xb0]
je 0x100021ff
mov eax, dword [0x1000900c]
cmp dword [0x10009010], edx
jne 0x100022ae
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call esi
xor eax, eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov edx, dword [ebx + 0xb0]
mov esi, dword [sym.imp.user32.dll_PostMessageW]
test edx, edx
je 0x100022a0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call esi
sub esp, 0x10
jmp 0x100021d7
movzx eax, si
mov dword [esp + 0xc], str.DG_CONTROL_DAT_NULL_MSG_i_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.TWAIN_ControlNull
mov dword [esp + 4], 0x10005018
mov dword [esp], 3
call fcn.10001760
jmp 0x10002106
mov edx, dword [ebx + 0xb4]
test edx, edx
je 0x100021ff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call esi
sub esp, 0x10
mov eax, dword [0x1000900c]
jmp 0x100021ff
mov edx, dword [ebx + 0xb4]
test edx, edx
jne 0x100021ee
jmp 0x100022ca
mov eax, dword [0x1000900c]
jmp 0x10002240
mov word [0x10009028], 2
jmp 0x10002124
Function at 0x100024b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [ebp + 0xc]
test byte [0x10005018], 8
jne 0x10002580
mov ebx, dword [0x10009024]
test ebx, ebx
je 0x10002570
mov edx, dword [esi]
xor edi, edi
jmp 0x100024ee
mov eax, dword [ebx]
mov edi, ebx
test eax, eax
je 0x10002570
mov ebx, eax
cmp dword [ebx + 4], edx
jne 0x100024e0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x402
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [ebx + 0xa4]
sub esp, 0x14
mov esi, eax
test edi, edi
je 0x100025b0
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
neg ax
sbb ax, ax
and eax, 0xb
mov word [0x10009028], ax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 3
mov esi, 1
jmp 0x1000255b
mov dword [esp + 0xc], str.DG_CONTROL_DAT_IDENTITY_MSG_CLOSEDS_n
mov dword [esp + 8], str.TWAIN_CloseDS
mov dword [esp + 4], 0x10005018
mov dword [esp], 3
call fcn.10001760
jmp 0x100024c9
mov eax, dword [ebx]
mov dword [0x10009024], eax
jmp 0x1000252c
Function at 0x1036b09
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x15
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 8]
test al, 1
je 0x1036b20
or edx, 3
xor eax, eax
test dl, 1
je 0x1036b36
mov eax, 0x20000
test dl, 2
jne 0x1036b36
mov eax, 0x40000
test dl, 8
je 0x1036b40
or eax, 0x10000
test dl, 0x10
je 0x1036b4a
or eax, 0x400000
mov ecx, 0x20000000
test ecx, edx
je 0x1036b58
or eax, 0x800000
test edx, 0x40000000
je 0x1036b62
or eax, ecx
pop ebp
ret 4

Function at 0x1044956
Capabilities:
Encode data using xor

Disassembly:
push 8
call dword [esp + 0x58]
inc dword [ebp + 0x6aa0]
call dword [esp + 0x58]
xchg ch, ch
xor eax, esi
push esp
call dword [esp + 0x5c]
call dword [esp + 0x5c]
or edx, 0xe55a50c6
call dword [esp + 0x58]
mov ecx, 0x937338db
inc edx
dec eax
call edi
not dh
cmp esi, eax
mov ch, dh
je fcn.01044956
mov dl, 0xbd
dec esi
dec ecx
push eax
cmp ecx, 0xdc860ff8
rdtsc
pop esi
ret

Function at 0x8b0268
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8b03b8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8b028e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8b027a
add dl, dl
jne 0x8b0299
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8b02ec
xor eax, eax
add dl, dl
jne 0x8b02a6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8b038d
add dl, dl
jne 0x8b02b5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b02c0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b02cb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b02d6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8b02e2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8b0285
mov eax, 1
add dl, dl
jne 0x8b02fa
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b0305
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8b02f1
sub eax, ebx
mov ebx, 1
jne 0x8b0338
mov ecx, 1
add dl, dl
jne 0x8b031e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8b0329
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8b0315
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8b0285
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8b034f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8b035a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8b0346
cmp eax, 0x7d00
jae 0x8b037d
cmp eax, 0x500
jb 0x8b0378
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8b0285
cmp eax, 0x7f
ja 0x8b0380
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8b0285
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8b03ae
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8b0285
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4b91f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x48d015
lea edi, [esi - 0x8c015]
push edi
or ebp, 0xffffffff
jmp 0x4b9212
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b9219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9208
mov eax, 1
add ebx, ebx
jne 0x4b922b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b923c
jne 0x4b925b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b925b
dec eax
add ebx, ebx
jne 0x4b9248
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b9220
add ebx, ebx
jne 0x4b9257
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b92ad
xor ecx, ecx
sub eax, 3
jb 0x4b9273
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b92e2
sar eax, 1
mov ebp, eax
jmp 0x4b927e
add ebx, ebx
jne 0x4b927e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b924c
inc ecx
add ebx, ebx
jne 0x4b928c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b924c
add ebx, ebx
jne 0x4b9299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b928e
jne 0x4b92aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b928e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b92cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b92be
jmp 0x4b920e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b92cc
add edi, ecx
jmp 0x4b920e
pop esi
mov edi, esi
mov ecx, 0x5e2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b92ea
cmp byte [edi], 6
jne 0x4b92ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b92ef
lea edi, [esi + 0xb7000]
mov eax, dword [edi]
or eax, eax
je 0x4b9367
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb95fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb9638]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b931c
mov ecx, edi
jns 0x4b934b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb9640]
or eax, eax
je 0x4b9361
mov dword [ebx], eax
add ebx, 4
jmp 0x4b9339
call dword [esi + 0xb963c]
mov ebp, dword [esi + 0xb9644]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b939b
sub esp, 0xffffff80
jmp 0x403868
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x40ea38
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40eb0d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40eb28
push ebx
push 0x40eb38
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40eab8
mov al, 0x6a
call fcn.0040e658
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040ea0c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40eac1
call fcn.0040ea0c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb14
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ec28
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecf3
jmp 0x40ece7
cmp dword [esi + 0x10], 0x1000
jne 0x40ecd3
test byte [esi + 0x15], 1
jne 0x40ecd3
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40ec84
cmp ebp, 2
je 0x40ec84
cmp ebp, 0x10
je 0x40ec84
cmp ebp, 0x20
jne 0x40eca0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40eca0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ecb1
mov eax, dword [esi]
add eax, ebx
call fcn.0040ec20
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40eca4
cmp byte [esp + 4], 0
je 0x40ecd3
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecf3
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ec59
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x411019
Capabilities:
Terminate process

Disassembly:
jmp 0x413580
jmp fcn.004135c0
cmp ecx, dword [0x41702c]
jne 0x41358a
repz ret
jmp 0x41108c
Function at 0x52b090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd4000]
push edi
jmp 0x52b0aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52b0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b0a0
mov eax, 1
add ebx, ebx
jne 0x52b0c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52b0d4
jne 0x52b0f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b0f3
dec eax
add ebx, ebx
jne 0x52b0e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52b0b8
add ebx, ebx
jne 0x52b0ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52b145
xor ecx, ecx
sub eax, 3
jb 0x52b10b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52b17a
sar eax, 1
mov ebp, eax
jmp 0x52b116
add ebx, ebx
jne 0x52b116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b0e4
inc ecx
add ebx, ebx
jne 0x52b124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b0e4
add ebx, ebx
jne 0x52b131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52b126
jne 0x52b142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52b126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52b164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52b156
jmp 0x52b0a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52b164
add edi, ecx
jmp 0x52b0a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52b182
cmp byte [edi], 0x11
jne 0x52b182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52b187
lea edi, [esi + 0x124000]
mov eax, dword [edi]
or eax, eax
je 0x52b1ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17cf28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17d0a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52b1b4
mov ecx, edi
jns 0x52b1e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17d0a8]
or eax, eax
je 0x52b1f9
mov dword [ebx], eax
add ebx, 4
jmp 0x52b1d1
call dword [esi + 0x17d0b8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52b230
cmp al, 0xef
ja 0x52b223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52b205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52b212
mov ebp, dword [esi + 0x17d0ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52b264
sub esp, 0xffffff80
jmp 0x42800a