joyce8/EMBER2024-capa huggingface dataset:
Function at 0x387f3e
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x396a7d
call fcn.00381350
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov ebx, 0x8007000e
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], esi
je 0x388046
push 1
call fcn.0038227c
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x38803c
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
push dword [ebp + 8]
mov edi, eax
call esi
lea esi, [eax + edi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003813e0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x387fcd
push dword [ebp - 0x18]
inc edi
push edi
push eax
call fcn.003821cb
mov ebx, eax
test ebx, ebx
jl 0x388024
push dword [ebp + 8]
push esi
push dword [ebp - 0x14]
call fcn.00382436
mov ebx, eax
test ebx, ebx
jl 0x388024
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x388024
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x387ff6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x38f33c
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x388024
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x44], eax
cmp eax, 0xffffffff
je 0x38f353
cmp dword [ebp - 0x14], 0
je 0x388033
push dword [ebp - 0x14]
call fcn.003813c0
pop ecx
push dword [ebp - 0x18]
call fcn.003813c0
pop ecx
mov eax, ebx
call fcn.00381390
ret 4
mov ebx, 0x80070057
jmp 0x38803c

Function at 0x3885f1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x39b004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
test eax, eax
je 0x388684
cmp eax, 0xffffffff
je 0x388684
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x388684
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [ebp - 0xc], 0
push ebx
call esi
push ebx
mov dword [ebp - 0x10], eax
call esi
lea esi, [eax + eax + 2]
mov eax, esi
call fcn.003885b5
mov eax, esp
push esi
push ebx
push eax
call fcn.00388692
mov esi, dword [ebp - 0x10]
mov edi, dword [edi + 0x44]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x38f2da
cmp esi, dword [ebp - 0xc]
jne 0x38f2f6
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.003820d4
leave
ret 4
mov dword [ebp - 8], 0x80070057
jmp 0x38866d
Function at 0x3888ef
Capabilities:
Get geographical location

Disassembly:
push 0x210
mov eax, 0x396be9
call fcn.003820e6
xor eax, eax
push 0x1fe
mov word [ebp - 0x214], ax
xor ebx, ebx
lea eax, [ebp - 0x212]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
push 0x100
lea eax, [ebp - 0x214]
push eax
push 0x1001
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x214]
and esi, 0x3ff
push eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 7
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003813e0
mov edi, eax
pop ecx
cmp edi, ebx
je 0x388999
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x21c]
push 0x3889a4
push esi
push edi
call fcn.00381451
add esp, 0x14
mov eax, edi
call fcn.00382126
ret 4
Function at 0x390d7d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [ecx + eax + 0x18]
test esi, esi
jbe 0x390dba
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x390db2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x390dbc
inc edx
add eax, 0x28
cmp edx, esi
jb 0x390da2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401980
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp sym.___write_memory.part.0
Function at 0x401ee0
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x401ef0
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x401eed
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x401f10
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x401f48
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x401f3e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x401f4a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x401f30
xor eax, eax
pop ebx
pop esi
ret

Function at 0x402490
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053bc]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 4
test ebx, ebx
je 0x4024e5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4024de
test esi, esi
je 0x4024de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4024c0
mov dword [esp], 0x4053a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xf48939
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [fcn.00f55098]
test eax, eax
je 0xf48978
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xf48978
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xf48978
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xf48978
cmp dword [ecx + 0x74], 0xe
jbe 0xf48978
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0xf54640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xf5466d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xf5466d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4051ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4087d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040429a
and dword [ebp - 0x14], 0
cmp dword [0x40c630], 0
mov dword [ebp - 0x18], eax
jne 0x40525e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405306
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405306
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40c630], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40c634], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40c638], eax
call edi
push eax
call esi
mov dword [0x40c640], eax
test eax, eax
je 0x40525e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40c63c], eax
mov eax, dword [0x40c63c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4052b7
cmp dword [0x40c640], ecx
je 0x4052b7
push eax
call esi
push dword [0x40c640]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4052b7
test ebx, ebx
je 0x4052b7
call edi
test eax, eax
je 0x4052ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4052ae
test byte [ebp - 8], 1
jne 0x4052b7
or dword [ebp + 0x10], 0x200000
jmp 0x4052ea
mov eax, dword [0x40c634]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4052ea
mov eax, dword [0x40c638]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40c630]
call esi
test eax, eax
je 0x405306
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405308
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405516
leave
ret

Function at 0x405516
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4087d0]
jne 0x405520
repz ret
jmp fcn.00406683
Function at 0x10031c50
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10031e14
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
jmp 0x10031c7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10031c81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10031c70
mov eax, 1
add ebx, ebx
jne 0x10031c93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10031c88
jne 0x10031ca4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10031c88
xor ecx, ecx
sub eax, 3
jb 0x10031cb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10031d2a
mov ebp, eax
add ebx, ebx
jne 0x10031cc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10031cd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10031cf4
inc ecx
add ebx, ebx
jne 0x10031ce0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10031cd5
jne 0x10031cf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10031cd5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10031d14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10031d05
jmp 0x10031c76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10031d14
add edi, ecx
jmp 0x10031c76
pop esi
mov edi, esi
mov ecx, 0x6e7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10031d32
cmp byte [edi], 0xa
jne 0x10031d32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10031d37
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x10031da6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x314b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x31538]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10031d64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3153c]
or eax, eax
je 0x10031da0
mov dword [ebx], eax
add ebx, 4
jmp 0x10031d81
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10031dd7
cmp al, 0xef
ja 0x10031dca
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10031dac
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10031db9
mov ebp, dword [esi + 0x31540]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10031e0b
sub esp, 0xffffff80
jmp 0x1000c8fa
Function at 0x45e7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x45e805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x45e878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x45e83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x45e86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x45e86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x45e831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x45e7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x58f7b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x116000]
push edi
jmp 0x58f7ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x58f7d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58f7c0
mov eax, 1
add ebx, ebx
jne 0x58f7e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x58f7f4
jne 0x58f813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58f813
dec eax
add ebx, ebx
jne 0x58f800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x58f7d8
add ebx, ebx
jne 0x58f80f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x58f865
xor ecx, ecx
sub eax, 3
jb 0x58f82b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58f89a
sar eax, 1
mov ebp, eax
jmp 0x58f836
add ebx, ebx
jne 0x58f836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58f804
inc ecx
add ebx, ebx
jne 0x58f844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58f804
add ebx, ebx
jne 0x58f851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x58f846
jne 0x58f862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58f846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x58f884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x58f876
jmp 0x58f7c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x58f884
add edi, ecx
jmp 0x58f7c6
pop esi
mov edi, esi
mov ecx, 0x3b21
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x58f8a2
cmp byte [edi], 0x1e
jne 0x58f8a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x58f8a7
lea edi, [esi + 0x18c000]
mov eax, dword [edi]
or eax, eax
je 0x58f91f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ac1bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ac2e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x58f8d4
mov ecx, edi
jns 0x58f903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1ac2ec]
or eax, eax
je 0x58f919
mov dword [ebx], eax
add ebx, 4
jmp 0x58f8f1
call dword [esi + 0x1ac2fc]
mov ebp, dword [esi + 0x1ac2f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x58f953
sub esp, 0xffffff80
jmp 0x487376
Function at 0x407350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40735f
pop dword [ebp - 0x50]
mov eax, 0x40735f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x40e06
push 0
mov eax, 0xbbf4eb57
add eax, 0x444d66c1
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x547d
mov edx, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x50]
mov edi, 0xc25c4f44
sub edi, 0x7b13491a
mov esi, dword [ebx]
sub dword [ebp - 4], ecx
sub esi, edi
xor dword [ebp - 0x34], esi
mov dword [edx], esi
add dword [ebp - 0x30], 0x76075561
add edx, 0xca7bffa5
sub edx, 0xca7bffa1
add ebx, 4
loop 0x4073ad
add eax, 0x1ff44c66
sub eax, 0x1ff3079f
xor ebx, ebx
add ebx, eax
add eax, 0xd99b6d31
sub eax, 0xd99b6d2c
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x42689f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4268ae
pop dword [ebp - 0x18]
mov eax, 0xe7d7043d
sub eax, 0xe7949b8f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6cd33bea
add dword [ebp - 0x28], 0xe17f0961
mov dword [ebp - 0x24], 0xfd753e70
add dword [ebp - 0x24], 0x34be0dd5
mov dword [ebp - 0x20], 0x8630a860
sub dword [ebp - 0x20], 0x39e46432
mov dword [ebp - 0x1c], 0xc19729ac
add dword [ebp - 0x1c], 0x3e68d654
lea eax, [ebp - 0x28]
push eax
mov eax, 0xb92a91e1
sub eax, 0xb8e6cfb5
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe3200fde
add dword [ebp - 0x28], 0x91525978
mov dword [ebp - 0x24], 0x7fcebae1
sub dword [ebp - 0x24], 0x3e62596c
mov dword [ebp - 0x20], 0x766002e2
sub dword [ebp - 0x20], 0x12f09676
mov dword [ebp - 0x1c], 0x84ad3acb
sub dword [ebp - 0x1c], 0x84ad3acb
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x74b94c5a
add eax, 0x8b8a7696
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x4b04a
push 0
call eax
mov ecx, 0x5c43
mov esi, eax
mov edi, 0x4dceb558
sub edi, 0x4d875f58
add edi, dword [ebp - 0x18]
mov edx, 0x77e52142
xor dword [ebp - 0x10], 0xb3e64414
mov ebx, dword [edi]
xor dword [ebp - 8], 0xd39cb1ea
sub ebx, edx
add dword [ebp - 0xc], 0x2dd01f50
mov dword [esi], ebx
sub dword [ebp - 0x10], 0xba410c4c
add esi, 4
add edi, 0xcfa86625
sub edi, 0xcfa86621
loop 0x4269c4
add eax, 0x671771c9
sub eax, 0x67160dea
xor ebx, ebx
add ebx, eax
add eax, 0x151c19a9
sub eax, 0x151c19a4
mov ecx, 0xf15a4583
sub ecx, 0xf11a4583
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x8df3bc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8df3c2
pop ebp
sub ebp, 6
sub ebp, 0x4df3bc
jmp 0x8df420
jmp 0x8df3fe
add byte [eax], al
jb 0x8df46d
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
add byte [eax], bh
retf
jmp 0x8df429
mov eax, 0x4df3bc
add eax, ebp
add eax, 0x93
mov ecx, 0x62c
mov edx, 0x2b06241e
xor byte [eax], dl
inc eax
dec ecx
jne 0x8df440
jmp 0x8df453
je 0x8df4b3
jbe 0x8df475
push cs
push ds
push ds
jbe 0x8df47a
sal byte [edx], cl
push ds
lahf
out dx, al
std
enter 0xffffffffffff9f70, 0xffffffffffffffee
std
enter 0x2d70, 0xffffffffffffffde
dec esi
loope 0x8df3fb
and ch, byte [edi]
pop edx
push ds
dec esi
xchg ebp, eax
rcl dword [ebp + 0x1e1e2297], cl
push ds
push ds
push ds
lahf
invalid
push ds
jbe 0x8df4b3
mov byte [0x321f1e5a], al
cmp dh, byte [esi + 0x1e]
push ds
push ds
push ds
neg byte [ebx]
push ds
push ds
push ds
div dword [esi + ebx]
push ds
push ds
dec ebx
xchg ebx, eax
jb 0x8df4f6
push ds
xchg ebp, eax
wait
push ss
push ds
push ds
push ds
xchg ebp, eax
mov edx, dword [edx]
push ds
push ds
push ds
xchg ebp, eax
xchg ebx, eax
push cs
push ds
push ds
push ds
fcompi st(7)
sbb al, 0x2f
sbb al, 0x9d
fcomp qword [edx]
push edi
adc dword [ebx - 0x1e1e1e16], ebx
inc ebx
fcom qword [edx]
push ds
xchg ebp, eax
xchg edx, eax
cmp bl, byte [edx]
push ds
push ds
push ds
jbe 0x8df4a0
sub dword [edi], edx
push ds
jbe 0x8df500
mov byte [0x321f1e5a], al
cmp cl, byte [edi - 0xa]
sbb ebx, dword [esi]
dec edi
neg byte [ebx]
push ds
push ds
push ds
mul dword [ecx]
sbb al, 0x1e
push ds
dec ebx
dec edx
inc ebx
loope 0x8df571
adc ah, cl
imul edx, dword [esi], 0xfffffff6
insb byte es:[edi], dx
push ds
push ds
push ds
xchg ebp, eax
mov dword [0x1e1e1e16], eax
sub eax, 0xa9ec9fd7
jmp 0x8df4fe
not byte [ecx]
lcall 0xe59e, 0x1e1e1e04
not dword [ecx]
lcall 0x9f78, 0x1e1e1e0f
in eax, 0xe1
cmp edx, dword [ecx]
lcall 0xf75f, 0x1e1e1e0b
shl cl, cl
loope 0x8df53d
aaa
push edx
daa
pop ds
popfd
fistp word [ebx]
popfd
neg byte [edx]
mul dword [ebx + 0x37e1e1e1]
dec edx
daa
sbb al, 0x9d
fistp word [eax]
popfd
hlt
sbb byte [ebp - 0x962e50c], bl
sbb esi, edi
mov ch, 0xe1
loope 0x8df55e
inc ebx
fcom qword [edx]
push ds
dec ebx
xchg ebp, eax
dec eax
dec ecx
dec ebx
xchg ebp, eax
imul edx, dword [edx], 0xffffff95
arpl word [esi], dx
loop 0x8df53b
sahf
xchg esp, eax
sbb byte [edi + 0x1e1e1fd8], bl
push ds
xchg esi, eax
sbb dword [edi + 0x1e1e1fd9], ebx
push ds
movsd dword es:[edi], dword [esi]
sbb al, 0x1e
push ds
push ds
sbb al, 0xcc
adc dword [ebx + 0x1e1e1e1b], ebx
xchg esp, eax
or byte [eax + 0xc], bl
int3