joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407860
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fopen]
push 0x40b9b8
push ebx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40791c
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00401f20
lea ecx, [esp + 0xc]
push ecx
call fcn.00401ec0
lea ecx, [esp + eax + 0xc]
lea edx, [esp + 0xc]
cmp ecx, edx
jbe 0x4078c2
mov al, byte [ecx]
cmp al, 0x5c
je 0x4078c1
cmp al, 0x2f
je 0x4078c1
dec ecx
lea eax, [esp + 0xc]
cmp ecx, eax
ja 0x4078ac
jmp 0x4078c2
inc ecx
mov byte [ecx], 0
lea ecx, [esp + 0xc]
push ecx
call fcn.004077d0
test eax, eax
jne 0x4078ef
push ebx
push str.jrspoeokomssscljbetgqnfmhcgotqtr
call fcn.00401bb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc
push 0x40b9b8
push ebx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40791c
push ebx
push str.ihdpnrhrgrfmkabdemjlsdnalnk
call fcn.00401bb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc
mov edi, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push esi
push edi
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
je 0x40795f
push ebx
push str.omrhjdnblhgbfratchqpipfrnnlbh
call fcn.00401bb0
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3d6d1b21
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x140e6a27
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1013c94
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x101647c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20a
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1013d7c
push ebx
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll__mbsrchr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x1013ce8
cmp byte [eax + 1], bl
jne 0x1013ce8
mov byte [eax], bl
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.01013a71
test eax, eax
jne 0x1013d07
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.01013b49
cmp dword [ebp + 0xc], 0x104
jb 0x1013d28
push edi
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d78
xor eax, eax
jmp 0x1013d7b
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1013d4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1013d24
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1013d53
sub eax, edx
lea ecx, [eax + 1]
cmp ecx, dword [ebp + 0xc]
ja 0x1013d24
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x41c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01011c2a
leave
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x7cd97db2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x22fa10bd
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x406026
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c4a0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4ad15c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x4812cc
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x406101
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x480104]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x420e1a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4514c8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
jne 0x420e3f
push 0x57
jmp 0x420ecc
push 0x1c
lea eax, [ebp - 0x68]
mov dword [ebp - 0x50], 0
push eax
xorps xmm0, xmm0
push esi
push edi
movdqu xmmword [ebp - 0x68], xmm0
movq qword [ebp - 0x58], xmm0
call dword [0x43207c]
test eax, eax
je 0x420ed2
push 0
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
push edi
call dword [fcn.00432030]
test eax, eax
je 0x420ed2
mov eax, 0x5a4d
cmp word [ebp - 0x4c], ax
jne 0x420ec7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x5c]
ja 0x420ec7
cmp eax, 0x40
jb 0x420ec7
push 0
push 0xf8
push ebx
add eax, esi
push eax
push edi
call dword [fcn.00432030]
test eax, eax
je 0x420ed2
cmp dword [ebx], 0x4550
jne 0x420ec7
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00426336
mov esp, ebp
pop ebp
ret 4
push 0xc1
call dword [0x432084]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426336
mov esp, ebp
pop ebp
ret 4
Function at 0x421efa
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x44f4e0
push 0x423e00
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4514c8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov edx, ecx
mov dword [ebp - 0x20], edx
test edx, edx
jne 0x421f58
push ecx
call dword [fcn.00432064]
mov edx, eax
mov dword [ebp - 0x20], eax
test edx, edx
jne 0x421f58
push 0xc0
call dword [0x432084]
jmp 0x4220ea
mov dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [edx], ax
je 0x421f73
push 0xc1
jmp 0x4220dd
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x421f89
push 0xbf
jmp 0x4220dd
cmp word [eax + edx + 0x14], 0
je 0x4220d8
mov eax, dword [eax + edx + 0x80]
test eax, eax
je 0x4220b9
lea ebx, [eax + edx]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4220d8
jmp 0x421fba
mov ecx, dword [ebx]
test ecx, ecx
je 0x42207e
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4220d8
lea esi, [eax + edx]
test esi, esi
je 0x4220d8
lea eax, [ecx + edx]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x421feb
add eax, edx
jmp 0x421fed
xor eax, eax
mov dword [ebp - 0x24], eax
mov ecx, dword [eax]
call fcn.00421dea
mov ecx, 0x4115e0
test ecx, ecx
je 0x42200c
push esi
push eax
push edi
call fcn.0041d3da
test eax, eax
je 0x42207e
xor esi, esi
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x422067
mov edi, edi
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x422064
xor eax, eax
test ecx, ecx
js 0x422035
add ecx, 2
je 0x422033
mov eax, dword [ebp - 0x20]
add eax, ecx
jmp 0x422035
xor eax, eax
mov ecx, 0x411640
test ecx, ecx
je 0x422075
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ecx + esi*4]
test edi, edi
je 0x422064
test eax, eax
je 0x422064
cmp byte [edi], 0
je 0x422075
push dword [edi + 0xc]
push eax
call fcn.00426406
add esp, 8
test eax, eax
jne 0x422075
mov dword [edi + 4], ebx
mov ebx, dword [ebp - 0x1c]
add ebx, 0x14
mov dword [ebp - 0x1c], ebx
mov edx, dword [ebp - 0x20]
jmp 0x421fba
inc esi
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x28]
jmp 0x42201a
mov eax, 0x4115e0
test eax, eax
je 0x422091
push 0
push 0
push edi
call fcn.0041d3da
push 0
call dword [0x432084]
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x1c], 0
jmp 0x4220d8
push 0xc0
call dword [0x432084]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46f907
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
xor ebx, ebx
mov esi, 0x421720
rep stosd dword es:[edi], eax
or dword [ebp - 0xc], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [0x421720], eax
je 0x46f972
mov edi, dword [ebp + 8]
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push ebx
push 0x10
push ebx
push dword [esi]
push edi
call dword [eax + 0x10]
test eax, eax
jne 0x46f96b
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 4]
call fcn.00470209
test eax, eax
jne 0x46f9cc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 4], ebx
add esi, 0x10
cmp dword [esi], ebx
jne 0x46f93a
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 8]
mov edi, dword [ebp - 0x2c]
push ecx
push 2
push dword [ebp - 0x20]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x34]
test eax, eax
jne 0x46f9cc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
add edx, 4
test edi, edi
je 0x46f9b2
mov eax, dword [edx]
xor eax, dword [ecx]
movzx eax, ax
xor eax, dword [edx]
lea edx, [edx + 4]
mov dword [ecx], eax
lea ecx, [ecx + 0x10]
sub edi, 1
jne 0x46f999
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], ebx
je 0x46f9c2
mov eax, dword [esi]
push ebx
push ecx
push dword [ebp - 0x2c]
push esi
call dword [eax + 0x20]
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.0046f7a2
push dword [ebp - 8]
call fcn.0047bab5
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x46f9e4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.0046f68d
mov esp, ebp
pop ebp
ret 8
Function at 0x401f20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
test ecx, ecx
je 0x402021
test edx, edx
je 0x402021
mov ebp, dword [esp + 0x2c]
test ebp, ebp
mov dword [esp], ecx
je 0x401f74
xor edi, edi
mov ecx, 0x1505
nop dword [eax + eax]
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x401f7b
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
mov ecx, esi
cmp edi, ebp
jb 0x401f50
jmp 0x401f7d
mov esi, 0x1505
jmp 0x401f7d
mov esi, ecx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea edi, [ebp - 1]
mov ebx, ebp
sub ebx, 1
jb 0x402021
mov dword [esp + 0x14], ebx
mov dword [esp + 8], edx
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov ebx, edi
not ebx
inc edi
mov edx, ebp
jmp 0x401fb5
dec ebx
inc edi
dec edx
je 0x40201f
mov eax, dword [esp + 0x14]
or eax, ebx
add eax, edi
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp + eax*4]
cmp ebp, 0xffffffff
je 0x40201f
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401fb0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 8], edx
call fcn.00417200
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x401fb0
push dword [esp + 0x2c]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00417220
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401fb0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x402021
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402e40
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x402ff6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402fef
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x402ed1
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x402fef
xor eax, eax
cmp ebx, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
jb 0x402f4c
mov eax, ebx
and eax, 0x1ff8
mov dword [esp], eax
mov edx, 7
nop
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx ebx, byte [ebp + 2]
add ebx, esi
mov eax, ecx
and eax, ebx
xor ecx, ebx
movzx edi, byte [ebp + 3]
add edi, ebx
movzx ebx, byte [ebp + 4]
add ebx, edi
add edi, ecx
lea ecx, [edi + eax*2]
movzx eax, byte [ebp + 5]
add eax, ebx
add ecx, ebx
mov ebx, dword [esp + 4]
movzx esi, byte [ebp + 6]
add esi, eax
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, esi
add ecx, esi
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x402ef0
mov esi, dword [esp + 8]
mov eax, dword [esp]
mov edx, ebx
sub edx, eax
jbe 0x402e98
mov dword [esp + 0x10], edx
mov dword [esp], eax
not eax
add eax, ebx
mov edx, ebx
and edx, 3
je 0x402fa1
mov dword [esp + 0xc], eax
neg edx
xor eax, eax
mov ebx, ebp
nop word cs:[eax + eax]
movzx esi, byte [ebx]
inc ebx
add edi, esi
add ecx, edi
dec eax
cmp edx, eax
jne 0x402f80
mov edx, dword [esp]
sub edx, eax
mov eax, dword [esp + 0xc]
cmp eax, 3
jb 0x402e90
jmp 0x402faf
mov ebx, ebp
mov edx, dword [esp]
cmp eax, 3
jb 0x402e90
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop word [eax + eax]
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x402fc0
jmp 0x402e90
shl ecx, 0x10
or ecx, edi
jmp 0x402ffb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b6f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp byte [eax + ecx], 0
lea ecx, [ecx + 1]
jne 0x41b700
lea edx, [eax + ecx]
dec edx
mov ecx, eax
not ecx
and ecx, edx
add ecx, ecx
xor edx, eax
sub ecx, edx
lea ebx, [ecx + ecx*2]
shr ebx, 2
movzx edx, byte [ecx + eax - 1]
cmp edx, 0x3d
je 0x41b72e
cmp edx, 0x2e
jne 0x41b72f
dec ebx
movzx edx, byte [ecx + eax - 2]
cmp edx, 0x3d
je 0x41b73e
cmp edx, 0x2e
jne 0x41b73f
dec ebx
push esi
push ecx
push eax
call fcn.0041b860
add esp, 0xc
mov ecx, eax
xor eax, eax
cmp ecx, ebx
jne 0x41b84d
mov edi, esp
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebx
add eax, 0xffffffe0
je 0x41b849
lea edx, [ebx - 0x41]
xor ecx, ecx
cmp edx, 0xffffffe7
jb 0x41b7f2
xor ecx, ecx
cmp eax, 0x20
jb 0x41b7bd
mov ecx, eax
and ecx, 0xffffffe0
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
xor edx, edx
nop
movups xmm2, xmmword [esi + edx + 0x20]
xorps xmm2, xmm0
movups xmm3, xmmword [esi + edx + 0x30]
xorps xmm3, xmm1
movups xmmword [esi + edx], xmm2
movups xmmword [esi + edx + 0x10], xmm3
add edx, 0x20
cmp ecx, edx
jne 0x41b790
cmp eax, ecx
je 0x41b849
test bl, 0x18
je 0x41b7f2
mov edx, ecx
mov ecx, eax
and ecx, 0xfffffff8
nop word cs:[eax + eax]
movsd xmm0, qword [esi + edx + 0x20]
mov edi, edx
and edi, 0x18
movsd xmm1, qword [esp + edi]
xorps xmm1, xmm0
movlps qword [esi + edx], xmm1
add edx, 8
cmp ecx, edx
jne 0x41b7d0
cmp eax, ecx
je 0x41b849
lea edi, [ebx - 0x21]
mov edx, ecx
test bl, 1
je 0x41b811
mov edx, ecx
and edx, 0x18
movzx edx, byte [esp + edx]
xor dl, byte [esi + ecx + 0x20]
mov byte [esi + ecx], dl
mov edx, ecx
or edx, 1
cmp edi, ecx
je 0x41b849
nop word cs:[eax + eax]
mov ecx, edx
and ecx, 0x1f
movzx ecx, byte [esp + ecx]
xor cl, byte [esi + edx + 0x20]
mov byte [esi + edx], cl
lea ecx, [edx + 1]
and ecx, 0x1f
movzx ecx, byte [esp + ecx]
xor cl, byte [esi + edx + 0x21]
mov byte [esi + edx + 1], cl
add edx, 2
cmp eax, edx
jne 0x41b820
mov byte [esi + eax], 0
add esp, 0x20
pop esi
pop edi
pop ebx
ret
Function at 0x402450
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x402475
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, 0x4030a8
sub ecx, 0x4030a4
sar ecx, 2
push ecx
push 0x4030a4
call fcn.00402560
add esp, 8
mov edx, 0x4030a0
sub edx, 0x40309c
sar edx, 2
push edx
push 0x40309c
call fcn.00402560
add esp, 8
mov eax, dword [ebp - 0x1c]
and eax, 1
je 0x4024cf
movzx ecx, word [ebp - 0x18]
mov dword [ebp - 0x54], ecx
jmp 0x4024d6
mov dword [ebp - 0x54], 0xa
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x50]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x40368c]
push ecx
mov edx, dword [0x403688]
push edx
call fcn.004025a0
add esp, 8
mov eax, dword [0x403688]
push eax
call fcn.00402420
add esp, 4
mov ecx, 0x4030b0
sub ecx, 0x4030ac
sar ecx, 2
push ecx
push 0x4030ac
call fcn.00402560
add esp, 8
mov edx, 0x4030b8
sub edx, 0x4030b4
sar edx, 2
push edx
push 0x4030b4
call fcn.00402560
add esp, 8
call fcn.004025d0
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x588d2d1d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x643c7d77
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x401805
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401844
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401844
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401844
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401844
cmp dword [ecx + 0x74], 0xe
jbe 0x401844
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret