joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10220b80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.10079660
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
lea ebp, [eax - 1]
push edi
lea ecx, [ebp - 0x29]
cmp esi, ecx
jle 0x10220bbf
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.100ccf30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp ebp, 0x29
jge 0x10220be3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.100ccf30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x28]
push 0
lea edx, [ebx + 1]
mov byte [ebx], 0
mov dword [esp + 0x30], edx
add ebx, 0x15
call fcn.100e9190
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push eax
push ecx
call fcn.100cc410
mov ecx, ebp
xor eax, eax
sub ecx, esi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, ebx
mov ecx, esi
sub eax, esi
mov esi, dword [esp + 0x4c]
add eax, ebp
mov edx, ecx
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x48]
push esi
call fcn.100d4d30
add esp, 0x20
test eax, eax
jg 0x10220c66
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
add ebp, 0xffffffec
push 0x48
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.100ccb10
mov edi, eax
add esp, 0xc
test edi, edi
mov dword [esp + 0x2c], edi
jne 0x10220ca2
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.100ccf30
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call fcn.100e9190
push eax
push 0x14
push esi
push ebp
push edi
call fcn.10220f50
add esp, 0x14
test ebp, ebp
jle 0x10220ccc
mov eax, ebx
sub edi, ebx
mov ecx, ebp
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x10220cbf
mov edi, dword [esp + 0x2c]
call fcn.100e9190
push eax
push ebp
push ebx
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.10220f50
lea ecx, [esp + 0x24]
add esp, 0x14
mov eax, esi
sub ecx, esi
mov esi, 0x14
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x10220cf0
push edi
call fcn.100ccd90
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10221430
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, edx
push esi
jne 0x10221505
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10221453
cmp al, 0x6b
jne 0x10221505
cmp al, 0x6b
lea esi, [ecx + 1]
jne 0x102214c1
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x10221475
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x10221475
cmp cl, 0xbb
jne 0x1022149e
inc edx
cmp edx, eax
jl 0x10221463
sub eax, edx
test edx, edx
jne 0x102214c4
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100ccf30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100ccf30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x102214ed
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.100ccf30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov ecx, eax
push edi
mov edi, dword [esp + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.100ccf30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x10223da0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x10223db9
mov edi, ebx
mov ebx, eax
jmp 0x10223dbb
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jg 0x10223dcb
mov eax, esi
jmp 0x10223dd5
push eax
push esi
call fcn.100d5370
add esp, 8
test eax, eax
jne 0x10223ddd
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x10223e01
push ebp
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x10223de7
pop ebp
cmp eax, dword [edi + 4]
jge 0x10223e18
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x10223e06
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x10223e3e
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x10223e3e
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
mov dword [esi + 4], edx
test ecx, ecx
jg 0x10223e28
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10226630
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xcc
call fcn.10079660
mov ecx, dword [esp + 0xd0]
push ebx
push ebp
push esi
lea esi, [ecx + 0x14]
lea eax, [ecx + 0x54]
push edi
lea edi, [esp + 0x5c]
mov ecx, dword [esi + 0x3c]
xor ebp, ebp
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x9c]
sub ecx, eax
sub edi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
sub esi, eax
mov ebx, dword [esp + 0xe4]
mov edx, dword [eax]
xor ecx, ecx
mov dword [edi + eax - 0x40], edx
mov cl, byte [ebx + ebp]
mov ebx, dword [esp + 0x14]
xor edx, ecx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x10]
xor ecx, edx
add eax, 4
mov edx, dword [ecx*4 + str._.C]
mov ecx, dword [esi + eax - 4]
xor ecx, edx
inc ebp
mov dword [esi + eax - 4], ecx
cmp ebp, 0x10
mov dword [esp + 0x10], ecx
jl 0x1022666d
xor ecx, ecx
xor esi, esi
lea eax, [esp + 0x20]
mov edx, 6
mov ecx, dword [ecx*4 + str._.C]
mov edi, dword [eax - 4]
xor edi, ecx
mov ecx, edi
mov dword [eax - 4], edi
mov ebp, dword [eax]
add eax, 0x20
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x20], ebp
mov ebx, dword [eax - 0x1c]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x1c], ebx
mov edi, dword [eax - 0x18]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0x18], edi
mov ebp, dword [eax - 0x14]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x14], ebp
mov ebx, dword [eax - 0x10]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x10], ebx
mov edi, dword [eax - 0xc]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0xc], edi
mov ebp, dword [eax - 8]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
dec edx
mov dword [eax - 8], ebp
mov ecx, ebp
jne 0x102266bc
add ecx, esi
and ecx, 0xff
inc esi
cmp esi, 0x12
jl 0x102266b3
mov edi, dword [esp + 0x18]
mov ecx, 0x10
lea esi, [esp + 0x1c]
lea edx, [esp + 0x1c]
push 0xc0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.100cda60
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
Function at 0x10249150
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov eax, 0x14
call fcn.10079660
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], 1
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
lea edx, [esp + 0x14]
movsx eax, byte [edi]
mov ebp, dword [esp + 0x2c]
inc edi
cmp eax, 0x30
jl 0x102491b1
cmp eax, 0x39
jg 0x102491b1
mov ecx, dword [edx]
mov esi, 1
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*2 - 0x30]
cmp eax, 0xff
mov dword [edx], eax
ja 0x1024927c
jmp 0x10249182
cmp eax, 0x2e
jne 0x102491cf
test esi, esi
je 0x10249280
cmp ebx, 3
je 0x1024927c
inc ebx
add edx, 4
xor esi, esi
jmp 0x10249182
test eax, eax
jne 0x1024927c
cmp ebx, 3
jne 0x1024927c
test esi, esi
je 0x1024927c
mov dl, byte [esp + 0x14]
mov al, byte [esp + 0x18]
mov cl, byte [esp + 0x1c]
mov byte [ebp], dl
mov dl, byte [esp + 0x20]
mov byte [ebp + 1], al
mov byte [ebp + 2], cl
mov byte [ebp + 3], dl
mov esi, 1
mov eax, dword [0x10312090]
test eax, eax
jne 0x1024929a
mov ecx, 0x64
xor eax, eax
mov edi, 0x10311f00
push 0x10311f00
rep stosd dword es:[edi], eax
push 0x101
mov dword [0x10312090], 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x1024929a
call sub.WS2_32.dll_WSAGetLastError
push 0x1d8
push str..crypto_bio_b_sock.c
push eax
push 9
push 2
call fcn.100ccf30
push 0x1d9
push str..crypto_bio_b_sock.c
push 0x7a
push 0x70
push 0x20
call fcn.100ccf30
add esp, 0x28
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor esi, esi
jmp 0x10249209
push 0x79
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.100ccf30
add esp, 0x14
jmp 0x1024933c
test esi, esi
jg 0x1024935a
push 0x87
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.100cdb60
mov eax, dword [esp + 0x38]
add esp, 0x10
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x102492e0
push 0x8c
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.100ccf30
add esp, 0x14
jmp 0x1024931e
cmp word [eax + 8], 2
je 0x10249301
push 0x93
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.100ccf30
add esp, 0x14
jmp 0x1024931e
xor ecx, ecx
mov edx, dword [eax + 0xc]
inc ecx
cmp ecx, 4
mov edx, dword [edx]
mov dl, byte [edx + ecx - 1]
mov byte [ecx + ebp - 1], dl
jl 0x10249303
mov dword [esp + 0x10], 0
push 0x9c
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.100cdb60
mov eax, dword [esp + 0x20]
add esp, 0x10
test eax, eax
je 0x1024935a
mov eax, dword [esp + 0x28]
push eax
push 0x1029309c
push 2
call fcn.100cd3e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x10249cf0
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
push esi
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call sub.WS2_32.dll_ioctlsocket
mov esi, eax
test esi, esi
jge 0x10249d2f
push 0x21b
push str..crypto_bio_b_sock.c
call sub.WS2_32.dll_WSAGetLastError
push eax
push 5
push 2
call fcn.100ccf30
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x1024e3e9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1024e419
push edi
call ebx
push eax
call fcn.1024e537
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x1024e443
test byte [ebp - 4], 1
je 0x1024e443
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1024e443
push edi
call ebx
push eax
call fcn.1024e537
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x1024e4e9
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.1024e336
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x1024e475
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.1024e336
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x1024e48b
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.1024e336
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1024e4b5
push 0
call ebx
push eax
call fcn.1024e537
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1024e4d3
push eax
call ebx
push eax
call fcn.1024e537
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1024e4e7
push eax
call ebx
push eax
call fcn.1024e537
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x1024e510
test byte [ebp - 4], 1
jne 0x1024e510
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1024e510
push edi
call ebx
push eax
call fcn.1024e537
pop edi
pop ebx
leave
ret 8

Function at 0x10250a74
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10250aac
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1024de8b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1024de62
jmp 0x10250ab8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4616a5
Capabilities:
Encode data using xor

Disassembly:
dec ebp
adc eax, 0x98b18ddf
or dword [eax - 0x5ab63bcf], ebx
xor esp, eax
dec ecx
movsd dword es:[edi], dword [esi]

Function at 0x4c5f51
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cd390
cmp edx, dword [eax]
je 0x4c5f73
add eax, 8
inc ecx
cmp eax, 0x4cd420
jl 0x4c5f64
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cd390]
jne 0x4c60a1
mov eax, dword [0x4d2dc0]
cmp eax, 1
je 0x4c607b
test eax, eax
jne 0x4c5fa4
cmp dword [0x4cd2bc], 1
je 0x4c607b
cmp edx, 0xfc
je 0x4c60a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c5fdb
lea eax, [ebp - 0x1a4]
push 0x4cb6b8
push eax
call fcn.004c6930
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c6dc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c601e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c6dc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cb6b4
push edi
call fcn.004c8c90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cb698
push eax
call fcn.004c6930
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c6940
lea eax, [ebp - 0xa0]
push 0x4cb694
push eax
call fcn.004c6940
push dword [esi + 0x4cd394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c6940
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cb66c
push eax
call fcn.004c8c04
add esp, 0x2c
pop edi
jmp 0x4c60a1
lea eax, [ebp + 8]
lea esi, [esi + 0x4cd394]
push 0
push eax
push dword [esi]
call fcn.004c6dc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x43a47b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47a630]
jne 0x43a485
repz ret
jmp fcn.004446e5

Function at 0x4500cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47a630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00446db2
and dword [ebp - 0x14], 0
cmp dword [0x47e1f8], 0
mov dword [ebp - 0x18], eax
jne 0x45017f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x450227
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x450227
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47e1f8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47e1fc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47e200], eax
call edi
push eax
call esi
mov dword [0x47e208], eax
test eax, eax
je 0x45017f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x47e204], eax
mov eax, dword [0x47e204]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4501d8
cmp dword [0x47e208], ecx
je 0x4501d8
push eax
call esi
push dword [0x47e208]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4501d8
test ebx, ebx
je 0x4501d8
call edi
test eax, eax
je 0x4501cf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4501cf
test byte [ebp - 8], 1
jne 0x4501d8
or dword [ebp + 0x10], 0x200000
jmp 0x45020b
mov eax, dword [0x47e1fc]
cmp eax, dword [ebp - 0x18]
je 0x45020b
push eax
call esi
test eax, eax
je 0x45020b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45020b
mov eax, dword [0x47e200]
cmp eax, dword [ebp - 0x18]
je 0x45020b
push eax
call esi
test eax, eax
je 0x45020b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47e1f8]
call esi
test eax, eax
je 0x450227
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x450229
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a47b
leave
ret

Function at 0x4565ab
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4565e6
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4565cd
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4565de
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4565e8
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4565c3
xor eax, eax
pop edi
pop esi
ret
Function at 0x40b15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x40b168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x40b14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x40b145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x40b145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x40b1d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x40b1c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x40b1f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x40b285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx

Function at 0x438ca7
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
sub esi, ebx
sub esi, ebx
mov ebx, 0xa5a79397
call fcn.00438cdb
and esi, ebx
sub esi, ebx
push esi
pop esi
xor dword [ecx], edx
sub esi, 0x2aaf63d3
inc ecx
mov ebx, ebx
cmp ecx, edi
jne fcn.00438ca7
inc ebx
dec esi
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4646466b
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x65506843
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219