joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467fc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x4680f1
test al, 3
jne 0x4680f1
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x4680ac
cmp edi, 8
jb 0x468075
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x468024
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x4680b0
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x468092
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x4680b4
xor edi, edi
jmp 0x4680b4
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x4680c8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x4681b0
cmp ecx, 0x20
jb 0x46818a
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x468125
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x4681b0
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x4681a0
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x46b660
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x5283a4], 0
jne 0x46b66e
call fcn.00473880
cmp byte [0x5283ad], 0
je 0x46b68c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00474560
add esp, 0x10
ret
jmp fcn.004699a0
Function at 0x48cb90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfd00
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x48cbd1
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, 0xffffffff
jne 0x48cbf4
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0048ca60
add esp, 0xc
jmp 0x48cd10
push esi
push ebx
call fcn.0048c960
add esp, 8
mov ecx, eax
mov dword [ebp - 0x30], ecx
test esi, 0x400
je 0x48ccd5
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x48cc19
mov edx, dword [ebx]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48cc32
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00436c30
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004049c0
cmp esi, 0xffffffff
jne 0x48cc98
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0048ca60
add esp, 0xc
jmp 0x48cd10
push ebx
call fcn.0048c880
add esp, 4
test al, al
jne 0x48ccc1
mov eax, dword [ebp - 0x30]
mov dword [edi], 9
mov dword [edi + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48cd10
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48cced
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x505588
and esi, 0x10
je 0x48ccf7
mov edx, dword [ebp - 0x34]
jmp 0x48ccfc
mov edx, ecx
mov ecx, dword [ebp - 0x34]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [edi], eax
cmove ecx, edx
mov dword [edi + 4], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004905eb
mov esp, ebp
pop ebp
ret
Function at 0x490180
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x4901a6
mov eax, dword [esp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
cmp dword [esp + 4], 0
jg 0x4901b5
jl 0x490191
cmp dword [esp], 0
jbe 0x490191
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x4901e1
nop word [eax + eax]
inc esi
cmp esi, 3
ja 0x49022c
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x4901d0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.00491560
mulsd xmm0, qword [0x4eb790]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.00491560
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.00491487
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
Function at 0x490310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e02a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x51f150]
cmp eax, 0xffffffff
jne 0x490344
xor ebx, ebx
jmp 0x49034d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x49038f
mov eax, dword [ebx + 0x18]
nop
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x4903ce
test esi, esi
jne 0x4903d2
push 0x48f480
push 0x5287d8
call fcn.0048f270
mov eax, dword [0x51f150]
add esp, 8
cmp eax, 0xffffffff
je 0x49038f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 2
test ebx, ebx
je 0x4903bc
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x4903bc
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x490414
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x4903fd
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4903d2
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x490360
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x49043d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x49043d
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea ecx, [ebx + 0x14]
call fcn.0048eee0
push 0x20
push eax
call fcn.00490c6c
mov eax, dword [ebx + 0x18]
add esp, 8
mov byte [ebp - 4], 0
test eax, eax
jne 0x490420
jmp 0x490360

Function at 0x490470
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x4904d0
push 0
push 0
call fcn.004bf69c
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x490499
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x4904b7
cmp eax, 0xffffffff
je 0x4904b7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x492750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4c7662
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c7325

Function at 0x4c766d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c74a6

Function at 0x4cc997
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cc657
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412cf0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412e9a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x67
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbc
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x8f
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x62
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x42
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xcf
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x70
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbf
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xeb
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xda
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe0
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x84
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x89
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf7
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x65
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d10
pop ebx
pop edi
pop esi
ret

Function at 0x4035d5
Capabilities:
Terminate process

Disassembly:
jmp 0x451b59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451b6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058fd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403706
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b002
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b013
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aee9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b03b
push ebx
push esi
push edi
call fcn.004056f0
add esp, 0xc
push 0
call fcn.0040623a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40a550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
andnps xmm1, xmmword [ebx + 0x104d8bec]
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
push esi
je 0x40a57a
loopne 0x40a5d4
or bh, bh
cmp esp, dword [edi + 0x558b1173]
or al, 0x8a
int1
test cl, cl
mov byte [eax], cl
je 0x40a54f
inc eax
mov edx, 0xf272c63b
mov byte [eax], 0
enter 0xffffffffffffc25d, 0xc
cmp byte [eax + 0x53ec8b55], dl
inc ebx
sbb eax, sym.imp.MSVCRT.dll_strrchr
jge 0x40a5e3
mov edi, dword [ebp + 0x30]
push 0x2f
push edi
call ebx
push 0x5c
push edi
mov esi, eax
call ebx
mov esi, 0x533b10c4
jbe 0x40a5a4
mov esi, eax
rcl ecx, 0x75
push cs
iretd
in al, dx
sbb dh, ah
mov ds, word [ebp + 0x10]
test ebx, ebx
push edi
inc esp
inc ebp
cld
add byte [eax], al
add byte [eax], al
inc ecx
adc ecx, dword [ebx - 0x24d8f356]
cmp dword [eax], 0
add byte [ecx + 0x13], al
mov ebp, dword [edx - 0x7c24d8f4]
cmp byte [eax], al
je 0x40a645
mov ecx, dword [eax + ebx*4 + 4]
inc ebx
test ecx, ecx
jne 0x40a5f0
lea eax, [ebx*4 + 4]
push esi
push eax
js 0x40a619
pop esp
rol dword [eax], 0x83
les eax, [ebx - 0x762495c6]
call 0x8b772509
inc ebp
or al, 0x8b
test dword [esi - 0x7a2fa55], 0xeb104589
mov gs, word [ebx - 0x7607a2fb]
inc ebp
adc bl, ch
add ecx, dword [ebx - 0xa74ef0b]
xor byte [ecx - 1], dl
adc eax, sym.imp.MSVCRT.dll_wcslen
xor dword [ecx], 4
fmul dword [ecx - 0x2bfe34fa]
add ebp, dword [eax - 0x7c07ba75]
mov byte [edx*2 - 0x7d034477], 0x45
clc
jne 0x40a6ad
add byte [ebp - 8], 0x75
arpl word [eax + 0x45], si
jo 0x40a691
cld
lea eax, [eax + eax*2 + 1]
pop esp
lcall 0xc15c, 0x15fffc45
pop eax
add byte [ebx - 0x36ccfb3c], al
test dword [edi], edx
mov dword [ebp - 8], eax
invalid
pop es
push ecx
lea edx, [ebp - 0x10]
push esi
push edx
push eax
call fcn.0040abce
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
sub eax, ecx
add edi, 4
add esi, eax
mov eax, dword [ebp - 0x6d]
xchg ebx, eax
dec eax
mov esi, edi
invalid
Function at 0x40a720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4198dc]
push esi
adc eax, eax
push edi
jne 0x40a92d
push 0x1307f8
mov dword [0x924107f8], 0x94
dec dword [edi]
and al, al
inc eax
add byte [ecx + 0x41dd08], ah
cmp eax, 2
jne 0x40a88d
mov al, byte [0x970813]
mov esi, 0x41080c
test bh, ch
je 0x40a79e
mov edi, dword [0x53c168]
mov eax, dword [0x8fc174]
cmp dword [eax], 1
imul byte [edx]
or ecx, ecx
jl 0x40a77b
mov cl, byte [esi]
push ecx
jmp edi
out 0x83, eax
loope 0x40a787
jmp 0x40a792
mov edx, 0x85e168a
add byte [esi + edx], al
and eax, 4
test eax, eax
jne 0x40a7cc
mov al, byte [esi - 0x63]
inc esi
test al, al
jne 0x40a769
mov ecx, dword [0xa738e0]
mov eax, dword [0x4107fc]
add dword [edi + 0x3d820f03], 1
add byte [eax], al
je 0x40af11
cmp eax, 4
jne 0x40a822
cmp dword [0xb8940602], 0xffffffe8
add byte [eax + 0x14ae900], dl
add byte [eax], al
add byte [ecx + 0x56cd7400], 0xff
pop ds
insb byte es:[edi], dx
shr edi, 0x8d
mov ecx, eax
add esp, 4
hlt
cmp eax, 5
push 0x55
mov eax, dword [0xd20800]
test eax, eax
jne 0x40a84e
test ecx, ecx
jne 0x40a83e
or bh, byte [eax + 0x437a]
mov eax, 0x437a
jmp 0x40a916
xor eax, eax
cmp ecx, 0xffffffb3
movsx eax, ax
add eax, 0x33
jmp 0x412816
invalid
add byte [edx], al
jmp 0x40a916
setne al
jecxz 0x40a871
add eax, 0x50
jmp 0x40a916
xor dword [ebx + 1], 0x75
jg 0x40a833
jg 0x40a883
inc ecx
jecxz 0x40a856
or al, 8
inc ecx
add byte [ecx + 0x3d8ba274], al
push 0x9500404c
sbb al, 0xed
dec eax
xchg edx, eax
and eax, 0x4e2e
pop ebp
add dl, byte [eax - 0x6f6f6f70]
mov al, byte [0xe7b97a5f]
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4079d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4079e8
pop dword [ebp - 0x1c]
mov eax, 0x4079e8
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x375fe
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xf879c483
add ecx, 0x7867ac2
mov edx, eax
mov edi, 0x37fc3c01
sub edi, 0x37bb003d
add edi, dword [ebp - 0x1c]
mov esi, 0xa19e8e6c
sub esi, 0xf3962909
sub dword [ebp - 0x10], 0xcc13ea90
mov ebx, dword [edi]
xor ebx, esi
sub dword [ebp - 0xc], ecx
mov dword [edx], ebx
sub dword [ebp - 0xc], 0xe9814b3
add edx, 0x8756dbcf
sub edx, 0x8756dbcb
add edi, 4
loop 0x407a3d
add eax, 0xc1b6e426
add eax, 0x3e4a0bc1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..retplne
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x35e522ab
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x246a6f6b
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4ca263
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4c9fca
inc edi
or esi, edi
call fcn.004ca29a
sub esi, 0x65c69f57
mov esi, edi
add edi, edi
xor dword [ebx], ecx
sub edi, 1
inc ebx
add edi, edi
cmp ebx, edx
jne fcn.004ca263
add edi, 0x77de5753
add edi, edi
sub esi, 0x6eb243e9
ret
Function at 0x406190
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x81018b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404454
call fcn.00406df1
push 4
mov dword [esp + 0x18], 0
call fcn.00407b47
mov edi, eax
add esp, 4
test edi, edi
je 0x406204
push ebx
call fcn.00406cc9
mov dword [edi], eax
call fcn.00406a88
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406db2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4061f8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406dda
pop ebx
jmp 0x406206
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4085c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x813dc0]
jne 0x4085cb
repz ret
jmp fcn.0040dbcc
Function at 0x4125be
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x813dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a937
and dword [ebp - 0x14], 0
cmp dword [0x8157f4], 0
mov dword [ebp - 0x18], eax
jne 0x412671
push 0x403fb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je LeaveCriticalSection
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fa4
push ebx
call edi
test eax, eax
je WideCharToMultiByte
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403f94
push ebx
mov dword [0x8157f4], eax
call edi
push eax
call esi
push 0x403f80
push ebx
mov dword [0x8157f8], eax
call edi
push eax
call esi
push 0x403f64
push ebx
mov dword [0x8157fc], eax
call edi
push eax
call esi
mov dword [0x815804], eax
test eax, eax
je 0x412671
push 0x403f4c
push ebx
call edi
push eax
call esi
mov dword [0x815800], eax
mov eax, dword [0x815800]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4126ca
cmp dword [0x815804], ecx
je RtlUnwind
push eax
call esi
push dword [0x815804]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4126ca
test ebx, ebx
je 0x4126ca
call edi
test eax, eax
je 0x4126c1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4126c1
test byte [ebp - 8], 1
jne 0x4126ca
or dword [ebp + 0x10], 0x200000
jmp GetCPInfo
mov eax, dword [0x8157f8]
cmp eax, dword [ebp - 0x18]
je 0x4126fd
push eax
call esi
test eax, eax
je 0x4126fd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4126fd
mov eax, dword [0x8157fc]
cmp eax, dword [ebp - 0x18]
je 0x4126fd
push eax
call esi
test eax, eax
je 0x4126fd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x8157f4]
call esi
test eax, eax
je 0x412719
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp TlsAlloc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085c1
leave
ret