joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eac54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4eac85
dec al
je 0x4eacc0
dec al
je 0x4ead05
dec al
je 0x4ead6e
jmp 0x4eadf8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4eadf8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4eac95
jmp 0x4eadf8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4eadf8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4eacd0
jmp 0x4eadf8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4eadf8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4ead34
xor ebp, ebp
jmp 0x4ead44
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4ead4d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ead15
jmp 0x4eadf8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4eadf8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4eadc7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004e7dd8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ead82
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f6ab0
Capabilities:
Packed with generic packer

Disassembly:
call fcn.0057b379
xchg byte [ebx - 0x739f1740], cl
call 0x55f71d
inc esi
mov eax, eax
call 0x59d951

Function at 0x4f6ac0
Capabilities:
Packed with generic packer

Disassembly:
call fcn.0057b379
xchg byte [ebx - 0x739f1740], cl
call 0x55f71d
inc esi
mov eax, eax
call 0x59d951
Function at 0x511298
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5587dc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x5112ba
shr eax, 1
xor eax, 0xedb88320
jmp 0x5112bc
shr eax, 1
dec edx
jne 0x5112a8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5112a1
mov byte [0x558bdc], 1
pop esi
pop ebx
ret

Function at 0x5112d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x558bdc], 0
jne 0x5112ef
call fcn.00511298
mov eax, edi
dec eax
test eax, eax
jl 0x511317
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5587dc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5112f9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x513f84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x51401e.0
jmp dword [ecx*4 + 0x513fb7]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x513fe9
sub dl, 8
je 0x513ff8
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513c30
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513c88
jmp case.0x51401e.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x51401e.0
movzx ecx, byte [ecx + 0x514025]
jmp dword [ecx*4 + 0x514036]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513d34
jmp case.0x51401e.0
cmp dl, 3
jne 0x514063
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513d88
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513d44
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513dcc
jmp case.0x51401e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x51408e
sub dl, 8
je 0x51409a
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513df8
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513e64
jmp case.0x51401e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5140b9
sub dl, 8
je 0x5140c5
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513f20
jmp case.0x51401e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x513f48
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x514169
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0051313c
test eax, eax
je 0x514169
mov eax, ebx
call fcn.00514174
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x514102
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x514174
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5141a5
dec al
je 0x5141e0
dec al
je 0x514225
dec al
je 0x51428e
jmp 0x514318
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x514318
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5141b5
jmp 0x514318
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x514318
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5141f0
jmp 0x514318
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x514318
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x514254
xor ebp, ebp
jmp 0x514264
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x51426d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x514235
jmp 0x514318
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x514318
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5142e7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00511320
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5142a2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5256bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
mov ebp, eax
test edx, edx
je 0x5256cf
test ebp, ebp
jne 0x5256d6
xor eax, eax
jmp 0x525785
mov bl, 2
mov byte [esp + 1], 0
mov dword [esp + 4], esi
mov edi, edx
dec edi
test edi, edi
jl 0x52576c
inc edi
movzx eax, byte [ebp]
xor al, 0xac
inc ebp
cmp bl, 6
jne 0x525725
mov edx, eax
and dl, 0x3f
movzx edx, dl
add edx, 0x3c
mov byte [esi], dl
inc esi
movzx eax, al
shr eax, 2
and al, 0x30
or byte [esp + 1], al
movzx eax, byte [esp + 1]
add eax, 0x3c
mov byte [esi], al
inc esi
mov byte [esp + 1], 0
jmp 0x525758
movzx edx, al
shr edx, 2
mov byte [esp], dl
movzx edx, byte [esp]
and dl, 0x3c
and al, 3
or dl, al
movzx eax, dl
add eax, 0x3c
mov byte [esi], al
inc esi
movzx eax, byte [esp + 1]
add eax, eax
add eax, eax
movzx edx, byte [esp]
and dl, 3
or al, dl
mov byte [esp + 1], al
movzx eax, bl
mov ecx, 6
xor edx, edx
div ecx
add dl, 2
mov ebx, edx
dec edi
jne 0x5256ed
cmp bl, 2
je 0x52577c
movzx eax, byte [esp + 1]
add eax, 0x3c
mov byte [esi], al
inc esi
mov eax, esi
sub eax, dword [esp + 4]
mov byte [esi], 0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5616d2
Capabilities:
Encode data using xor

Disassembly:
jmp 0x58446e
mov byte [esp + 4], 0x77
mov byte [esp + 4], al
mov esi, dword [esi + 0x124962]
call fcn.005724c7
mov dword [0xe0180717], eax
imul ebx, edx, 0x1d13d71
add bh, byte [ecx - 0x6b72b6e3]
fadd dword [edi + 0x3e]
cmpsd dword [esi], dword es:[edi]
jae 0x5844f0
mov byte [0x7dbdad4d], al
insb byte es:[edi], dx
cmp byte [edi + ecx], cl
push ebx
adc al, byte [eax - 0x76469a2f]
push ebp
jns 0x5844ae
into
add dl, al
and al, 0x64
shl byte [esp], 1
mov byte [eax + ebx*4], al
push ds
mov byte [0xb4c0e00c], al
jl 0x5844fc
lcall 0x511e, 0xaee4a7e
push ecx
aad 0x94
das
xor ebp, edi
mov cl, 0xb6
and byte [esi], 0xec
imul ebp, dword [esi + ecx], 0xffffffbd
mov ah, 0x7a
sub ah, byte fs:[ebp - 0x2670b27]
leave
in eax, dx
in al, 0x68
adc byte [ecx + 0x32], 0x1a
out 0x4a, al
jbe 0x5844c2
pop esp
adc byte [ecx], cl
xchg edi, eax
cdq
int 0xbc
mov eax, 0xf40feb1c
test al, 0x3b
iretd
sbb al, 0xeb
pmuludq mm5, qword [eax - 0x9dd30c5]
jns 0x5844c8
xor byte [edi + edi*8 - 0x3d], ah
inc ebx
inc edx
invalid
Function at 0x56ad39
Capabilities:
Packed with generic packer

Disassembly:
and al, 0x71
mov dword [esp + 4], 0x3ffc4a75
pushfd
mov dword [esp + 4], edx
pushal
mov byte [esp], bl
lea esp, [esp + 0x28]
jmp fcn.0052cfaa
xchg dword [esp + 0x44], edx
pushfd
mov edx, 0x498dd2
push 0xb7cbc334
mov edx, dword [edx + 0x100213]
mov word [esp], 0xec41
call fcn.0058e61d
loop 0x56ace1
push 0xffffffffffffffb5
jbe 0x56adca
imul ebx, edx, 0xffffffdc
fcmovu st(0), st(4)
test al, 0x8c
pop eax
jl 0x56ad5e
dec esp
mov word [eax], es
jle 0x56ad9d
dec edx
push cs
rcl cl, 1
ficom word [edx]
mov bh, byte [esi + 0x46]
fcmove st(0), st(0)
pushfd
jl fcn.0056ad39
jp 0x56ad59
sub eax, 0x3d85c581
sahf
adc al, 0x24
movsb byte es:[edi], byte [esi]
xor edi, dword [ebp + 0x35132f0d]
dec ecx
add al, 0x73
push edi
jbe 0x56ad90
inc esp
test al, 0x9c
inc ebp
imul dword [edx]
mov ebx, 0xd44d5fbc
invalid
add dh, dh
popal
cmc
enter 0x130c, 0x47
bound esp, qword [ebx + 0x3d]
add dword [esi + 0x22], ebp
pop ebp
rcr dword [eax + esi*8 + 0x623e97d3], 1
aam 0x54
push dword [esp]
nop
mov dword [esp], eax
pushfd
xchg dword [esp + 8], edx
call fcn.0058819a
xchg ecx, eax
inc ebp
loope 0x56ae41
jbe 0x56ae37
imul ebx, edx, 0xffffffb0
jl 0x56ade0
fidiv dword [eax + 0x7a96107c]
pushfd
xchg esi, eax
jp 0x56ad6f
add byte [eax], ch
cmpsb byte [esi], byte es:[edi]
sbb al, byte [edx - 0x1a]
pop eax
in al, dx
jb 0x56ae24
in al, 0x18
mov bl, 0xe7
xor byte [esi - 0x3ed6d7fa], 0x76
push ebp
mov dword [0x530f43d8], eax
pop edx
mov fs, edi
arpl word [0x72a6c169], sp
inc edi
imul ecx, dword [ebp + 0x15c10a09], 0xbdf96955
rol dword [ebp + 0x75210d89], 0xb5
sub dword [edi + 0x68c9a5eb], esp
mov word [edi], gs
call 0x247306a4
jmp 0x56ae4c
ficom word [ecx]
and eax, 0x75537a83
test eax, 0x16583f02
mov edx, 0xd53a063a
jmp 0x12cdf1f7
inc ebx
ja 0x56ae4c
movsd dword es:[edi], dword [esi]
add ah, byte ss:[esi - 0x61]
shl dword [0x326e030f], 0x59
lsl ebp, word [esi + 0x32]
pop ecx
in eax, dx
inc eax
pop ebx
fist word [esi - 0x47ce1296]
mov ecx, 0x9efa2793
push 0xffffffffffffffed
xor dword [eax - 0x5d86c47], edi
sahf
fnsave dword [ecx]
fimul dword [esi - 0xf]
aad 0x82
pop ds
pushfd
fst st(3)
jb 0x56aea0
add ch, byte [edi + 0x23]
pop esi
push edx
mov byte [0xc244c87], al
pushfd
pushfd
push dword [esp + 0x14]
ret 0x1c
add bh, al
inc esp
and al, 0x20
mov bh, 0x50
les edx, [ecx + ecx*4 + 0x56682414]
invalid
dec edx
push cs
add byte [ebp + ecx*4 + 0x383cc292], bl
adc ebp, ecx
jle 0x56ae74
add al, byte [eax]

Function at 0x578620
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
or byte [edi + 0x475517], bh
mov dword [esp + 0x48], eax
lahf
cwde
pop eax
mov eax, 0x440b43
lea esp, [esp + 0x44]
jp 0x59e5c0
push 0xdc4f9006
push dword [esp]
pushal
mov eax, dword [eax + 0x162b98]
push 0xb3196b64
call fcn.0056fa74
xchg esp, eax
dec eax
inc ecx
fisubr word [edx]
imul ebx, edx, 0xffffffb3
jg 0x56f895
cmc
sbb dword [ebp - 0x123478f7], edx
rcr dword [ebx - 0x21], 1
xchg esi, eax
sbb dl, byte [ecx - 0x2b]
neg byte [eax]
lodsb al, byte [esi]
mov ebp, 0xd2064a
cli
invalid
xchg dword [esp + 0x48], eax
push 0x94e4b535
jmp 0x56f8dc
setb ah
push eax
pushal
nop
pushal
mov eax, dword [esp + 0x44]
jmp 0x57027b
Function at 0x597519
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 8], edi
mov dword [esp + 4], esi
push 0x6235a79a
mov word [esp], 0xf3b2
push ebx
nop
pop edi
pop edi
push ecx
push dword [esp]
jmp 0x57b34c
Function at 0x409631
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a344]
jne 0x40963b
repz ret
jmp fcn.0040e01c

Function at 0x41224c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b6bf
and dword [ebp - 0x14], 0
cmp dword [0x437cec], 0
mov dword [ebp - 0x18], eax
jne 0x4122ff
push 0x403774
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4123a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403768
push ebx
call edi
test eax, eax
je 0x4123a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403758
push ebx
mov dword [0x437cec], eax
call edi
push eax
call esi
push 0x403744
push ebx
mov dword [0x437cf0], eax
call edi
push eax
call esi
push 0x403728
push ebx
mov dword [0x437cf4], eax
call edi
push eax
call esi
mov dword [0x437cfc], eax
test eax, eax
je 0x4122ff
push 0x403710
push ebx
call edi
push eax
call esi
mov dword [0x437cf8], eax
mov eax, dword [0x437cf8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412358
cmp dword [0x437cfc], ecx
je 0x412358
push eax
call esi
push dword [0x437cfc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412358
test ebx, ebx
je 0x412358
call edi
test eax, eax
je 0x41234f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41234f
test byte [ebp - 8], 1
jne 0x412358
or dword [ebp + 0x10], 0x200000
jmp 0x41238b
mov eax, dword [0x437cf0]
cmp eax, dword [ebp - 0x18]
je 0x41238b
push eax
call esi
test eax, eax
je 0x41238b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41238b
mov eax, dword [0x437cf4]
cmp eax, dword [ebp - 0x18]
je 0x41238b
push eax
call esi
test eax, eax
je 0x41238b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x437cec]
call esi
test eax, eax
je 0x4123a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4123a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409631
leave
ret
Function at 0x4141c0
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.00413820
cmp dword [0x7d7e44], 0x37
jne 0x414251
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x403f68
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x403fc4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x7d8a28]
mov edx, dword [0x7d4ea4]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x100c7473
Capabilities:
Get number of processors

Disassembly:
jmp 0x100bb794
call fcn.100bb77f
salc
arpl word [ebp - 0x79], cx
loop 0x100bb78a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100e13b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x100da1dd
jmp 0x100c6476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x100d5856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x100dde32
jmp 0x100d586d
call fcn.100d5858
adc byte [eax - 0x77], dl
loopne 0x100d587c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x100bb77d
jmp 0x100da1f4
call fcn.100da1df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x100bbbce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x100bc698
jmp 0x100bd265

Function at 0x100e66f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x100d5a70

Function at 0x103f97fb
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x103f9859
jmp 0x103f9818
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x103f9818
jmp 0x103f9859
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x21477940
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x78bb2e5f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219