joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016dc4c
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x10196c00
call fcn.10158e50
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x10a5aaf4], edi
jne 0x1016dc90
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1016dc7b
mov dword [0x10a5aaf4], ebx
jmp 0x1016dc90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1016dc90
mov dword [0x10a5aaf4], 2
mov eax, dword [0x10a5aaf4]
cmp eax, ebx
jne 0x1016dcb0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1016dd73
cmp eax, 2
je 0x1016dcb9
cmp eax, edi
jne 0x1016dce1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x1016dccc
mov eax, dword [0x10a5a91c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1016dce8
xor eax, eax
jmp 0x1016dd73
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.10158fb0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1016dd1b
cmp esi, edi
jne 0x1016dd31
push dword [ebp - 0x20]
call fcn.10158ce7
pop ecx
mov esi, eax
cmp esi, edi
je 0x1016dce1
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1016dd64
cmp dword [ebp + 0x14], edi
jne 0x1016dd4e
push edi
push edi
jmp 0x1016dd54
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x1016dd70
push esi
call fcn.10158cf9
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.10158e8b
ret
Function at 0x1016dd7c
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x10196c10
call fcn.10158e50
xor esi, esi
cmp dword [0x10a5aaf8], esi
jne 0x1016ddc0
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1016ddab
mov dword [0x10a5aaf8], edi
jmp 0x1016ddc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1016ddc0
mov dword [0x10a5aaf8], 2
mov eax, dword [0x10a5aaf8]
cmp eax, 2
je 0x1016dea1
cmp eax, esi
je 0x1016dea1
cmp eax, 1
jne 0x1016de05
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x1016ddee
mov eax, dword [0x10a5a91c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x1016de0c
xor eax, eax
jmp 0x1016deb3
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.10158fb0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x1016de42
cmp edi, esi
jne 0x1016de5d
lea eax, [ebx + ebx]
push eax
call fcn.10158ce7
pop ecx
mov edi, eax
cmp edi, esi
je 0x1016de05
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1016de90
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x1016de7a
push esi
push esi
jmp 0x1016de80
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1016de9c
push edi
call fcn.10158cf9
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x1016deb3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.10158e8b
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop eax
add ebx, 0xe957917b
sub ebx, 0x8530085d
call fcn.0043b686
or ebx, edx
add edx, 0xdf139c1a
xor dword [esi], eax
push 0x25662cf8
pop ebx
sub ebx, edx
inc esi
add ebx, 0x6c3e169a
add edx, ebx
cmp esi, edi
jne fcn.0043b647
push edx
pop edx
ret
Function at 0x410456
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41a570
call fcn.00410c49
push 1
call fcn.004104d9
pop ecx
test al, al
jne 0x4102ff
push 7
call fcn.00410d92
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004104a4
mov byte [ebp - 0x24], al
mov eax, dword [0x41d028]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4102f8
test eax, eax
jne 0x410369
mov dword [0x41d028], ecx
push 0x4132f4
push 0x4132dc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41034c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x410450
push 0x4132d8
push 0x4132b8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41d028], 2
jmp 0x41036e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00410636
pop ecx
call fcn.00410d86
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41039e
push esi
call fcn.004105a9
pop ecx
test al, al
je 0x41039e
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00410fc1
call esi
call fcn.00410d8c
mov esi, eax
cmp dword [esi], edi
je 0x4103bc
push esi
call fcn.004105a9
pop ecx
test al, al
je 0x4103bc
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00410ea7
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00410eda
test al, al
jne 0x4103f5
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4103fe
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00410653
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x410450
call fcn.00410c8f
ret
call fcn.00410165
jmp 0x4102e0

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1261774
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x4484f4f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x48cbf8
Capabilities:
Encode data using xor

Disassembly:
inc esp
imul esp, dword [edi + 0x37], 0x59035b82
aaa
sbb byte [ebx + 3], 0x59
xlatb
mov esp, dword [ebx - 0x4b74c9b9]
aam 0xb1
mov dword [esi], esp
mov ebx, 0xdfabbb88
or dword [edx + 0x76635fd2], 0x1ea3e443
xchg ebp, eax
cmp ah, byte [ebx + 0x6a2a074a]
mov esp, fs
in al, 0x13
inc ebp
dec ebp
in al, 0x13
inc ebp
dec ebp
push 0x42
imul ebp, esi, 0x2602271f
pop ds
daa
add ah, byte [esi]
xor eax, 0x73fc77d0
mov dword [esi + 0x4d515eab], eax
clc
fmulp st(7)
daa
pop eax
and dword [eax], eax
neg edi
mov bh, 0x79
push ecx
stosb byte es:[edi], al
xchg byte [ecx + edi*8], ah
popal
loope 0x48cbf0
jae 0x48cbce
mov byte [esp + edx - 0x3711155a], cl
stosb byte es:[edi], al
sbb eax, 0x17f46267
stosb byte es:[edi], al
and ebp, dword [edi - 0x60]
dec eax
xchg byte [edx + 0x3a], bl
xchg di, ax
sbb al, 0xdb
add eax, 0x4a534b63
jnp 0x48cbd1
stosd dword es:[edi], eax
sub dword [ecx + 0x71f1811a], 0xffffffa1
mov byte [0x96903ec6], al
sub ebp, ebp
xchg edx, eax
aaa
inc edi
xchg ecx, eax
push ebx
inc ecx
sub dword [ebx], edi
jle 0x48cc00
sub byte [edi + 0x5c69123f], dh
xor byte [ebp + 0x3b34386], 0xff
xor ch, byte [esp + esi*8 - 0x3486e293]
mov edi, ds
xchg edx, eax
idiv dword [ecx + 0x6dd47c01]
mov ecx, 0x6dd47c01
jbe 0x48ccab
invalid
jle 0x48cc75
out dx, al
aaa
rol bh, 0
mov esi, 0xab843341
sal esp, 0x1b
adc dword [eax], ebx
mov cs, word [esi]
aaa
cdq
mov edi, 0xfa46902e
add eax, 0x965186cf
rol byte [esi], 1
scasd eax, dword es:[edi]
add dword [edi], esp
pop edx
pop ebx
mov al, byte [0xbf3c61bd]
lcall 0xc924, 0xb84adaf3
sar byte [edi - 0x7d], 1
pop edi
push ebx
xor eax, 0x74e368ef
clc
jns 0x48cd61
xchg dword [ebx + 0x39fc955e], ebx
hlt
mov eax, 0xfa8cb94c
and eax, 0x29e35603
or esi, dword [eax]
mov dword [ebx - 0x69028a8], eax
fstp xword [esi + 0x52ab604f]
das
sar dword [edi], cl
xchg dword [edi], ecx
neg dword [edi]
imul esp, dword [eax], 0xffffff97
cmp dword [esi + 3], esp
retf 0xe72b
Function at 0x5b5bb9
Capabilities:
Encode data using xor

Disassembly:
loop 0x5b5b66
xchg ebp, eax
push ebp
invalid
lodsd eax, dword es:[esi]
loopne 0x5b5b07
and ebp, dword [ecx]
pushfd
mov dword [eax + 0x60], esi
sbb eax, 0x468ec540
cli
sal byte [esi], cl
out 0x8d, al
stosb byte es:[edi], al
and al, 0xbc
les edi, [ecx]
mov ah, 0x66
xlatb
movsd dword es:[edi], dword [esi]
mov eax, 0x508b29cb
inc ebp
inc ecx
mov ah, 0xd3
mov ch, 0x7b
neg byte [edi + edx*2 - 0x74]
inc esp
loope 0x5b5b2f
and al, 0xb3
pop es
mov ah, 0x50
in al, 0xb3
push ecx
out 0x89, eax
xchg ecx, eax
fincstp
lodsd eax, dword [esi]
sub dword [ebx], eax
xor ah, byte [edi + 0x26]
mov bh, 0x60
mov bh, 0x60
invalid
pop edx
mov esi, 0xb7c3d7e3
dec ebx
lodsd eax, dword [esi]
adc dword [ebp - 0x4ed10e6], esp
mov eax, 0x61855e8f
mov ch, 0xd4
jno 0x5b5be5
or cl, ch
std
cmpsd dword [esi], dword es:[edi]
push ecx
jecxz 0x5b5b35
mov al, byte [esi + eax*8 - 0x305ff950]
push esp
wait
add dword [ecx + ecx*4 + 0x687b9261], 0xb2e0ade5
push 0xb2e0ade5
test dh, al
mov al, 6
mov al, byte [0x819b54cf]
test byte [ecx + 0x687b9261], cl
push 0xb2e0ade5
push 0xb2e0ade5
mov ss, ebx
mov eax, 0x36d211a8
cli
adc al, 0xb2
fnsave dword [ebx - 0x2beb2f89]
push esp
loopne 0x5b5b9b
inc ebx
mov al, byte [0xbb2bad42]
sbb ecx, ebp
invalid
js 0x5b5baa
inc edx
inc esp
sal edi, cl
or esp, esi
test edx, 0x9d2511b3
wait
test byte [ecx + 0x7b], cl
mov cl, 0x89
add dword [ecx - 0x3d20fb6d], eax
scasb al, byte es:[edi]
jne 0x5b5c28
xor eax, 0xaa3de3ca
jne 0x5b5b8d
out 5, al
in al, 0x84
mov al, 0xa4
pop ss
or bh, byte [ebx - 0x33]
mov word [edi - 8], es
sub ebp, esp
aad 0xa4
mov dh, 0x64
jne 0x5b5bc8
cmpsb byte [esi], byte es:[edi]
and esi, esi
jne 0x5b5c7f
outsb dx, byte [esi]
rcl dword [ecx - 0x23], 0x47
and dword [ecx + 0x2091c063], 0x23
imul dword [eax - 0x75]
mov byte [0x4a20ee1], al
xor eax, 0x952c7b44
cmpsd dword [esi], dword es:[edi]
add al, cl
popal
les ecx, cs:[ebx - 0x31eeaee0]
cwde
mov eax, dword [0xb45f1e00]
xor al, 0xfd
sti
push es
mov ah, 0x3f
scasb al, byte es:[edi]
jecxz 0x5b5c28
invalid
and dword [ecx], eax
xor byte [ebp + 0x5bdbb736], dh
invalid
Function at 0x6590fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6603a8
cmp edx, dword [eax]
je 0x65911f
add eax, 8
inc ecx
cmp eax, 0x660438
jl 0x659110
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6603a8]
jne 0x65924d
mov eax, dword [0xa5d104]
cmp eax, 1
je 0x659227
test eax, eax
jne 0x659150
cmp dword [0x6602d4], 1
je 0x659227
cmp edx, 0xfc
je 0x65924d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659187
lea eax, [ebp - 0x1a4]
push 0x65e6b8
push eax
call fcn.00659ae0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00659f70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6591ca
lea eax, [ebp - 0x1a4]
push eax
call fcn.00659f70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e6b4
push edi
call fcn.0065be40
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e698
push eax
call fcn.00659ae0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00659af0
lea eax, [ebp - 0xa0]
push 0x65e694
push eax
call fcn.00659af0
push dword [esi + 0x6603ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00659af0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e66c
push eax
call fcn.0065bdb4
add esp, 0x2c
pop edi
jmp 0x65924d
lea eax, [ebp + 8]
lea esi, [esi + 0x6603ac]
push 0
push eax
push dword [esi]
call fcn.00659f70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402000
Capabilities:
Terminate process

Disassembly:
mov esi, 0
mov edi, 0
mov ebp, 1
mov edx, 0
mov eax, esi
imul eax, eax, 4
add eax, edi
movzx ebx, byte [eax + section..data]
mov eax, esi
imul eax, eax, 4
add eax, ebp
movzx ecx, byte [eax + section..data]
cmp ebx, ecx
jne 0x402037
inc edx
jmp 0x402055
cmp ebp, dword [0x401014]
jae 0x402042
inc ebp
jmp 0x402022
mov eax, dword [0x401014]
cmp edi, eax
jae 0x402055
inc edi
cmp edi, eax
jae 0x402055
mov ebp, edi
inc ebp
jmp 0x402014
mov eax, dword [0x401010]
cmp esi, eax
jae 0x40206b
inc esi
mov edi, 0
mov ebp, 1
jmp 0x402014
mov eax, dword [0x401010]
sub eax, edx
inc eax
push eax
call 0x402081
and eax, 0x6f722064
ja 0x4020a0
add bh, bh
adc eax, sym.imp.msvcrt.dll_printf
add esp, 8
mov esi, 0
mov edi, 0
mov ebp, 1
mov edx, 0
mov eax, esi
imul eax, eax, 4
add eax, edi
movzx ebx, byte [eax + section..data]
mov eax, ebp
imul eax, eax, 4
add eax, edi
movzx ecx, byte [eax + section..data]
cmp ebx, ecx
jne 0x4020c1
inc edx
jmp 0x4020df
cmp ebp, dword [0x401010]
jae 0x4020cc
inc ebp
jmp 0x4020ac
mov eax, dword [0x401010]
cmp esi, eax
jae 0x4020df
inc esi
cmp esi, eax
jae 0x4020df
mov ebp, esi
inc ebp
jmp 0x40209e
mov eax, dword [0x401014]
cmp edi, eax
jae 0x4020f5
inc edi
mov esi, 0
mov ebp, 1
jmp 0x40209e
mov eax, dword [0x401014]
sub eax, edx
inc eax
push eax
call 0x40210a
and eax, 0x6f632064
insb byte es:[edi], dx
add bh, bh
adc eax, sym.imp.msvcrt.dll_printf
add esp, 8
call dword [sym.imp.msvcrt.dll__getch]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x402081
Capabilities:
Terminate process

Disassembly:
mov esi, 0
mov edi, 0
mov ebp, 1
mov edx, 0
mov eax, esi
imul eax, eax, 4
add eax, edi
movzx ebx, byte [eax + section..data]
mov eax, esi
imul eax, eax, 4
add eax, ebp
movzx ecx, byte [eax + section..data]
cmp ebx, ecx
jne 0x402037
inc edx
jmp 0x402055
cmp ebp, dword [0x401014]
jae 0x402042
inc ebp
jmp 0x402022
mov eax, dword [0x401014]
cmp edi, eax
jae 0x402055
inc edi
cmp edi, eax
jae 0x402055
mov ebp, edi
inc ebp
jmp 0x402014
mov eax, dword [0x401010]
cmp esi, eax
jae 0x40206b
inc esi
mov edi, 0
mov ebp, 1
jmp 0x402014
mov eax, dword [0x401010]
sub eax, edx
inc eax
push eax
call 0x402081
and eax, 0x6f722064
ja 0x4020a0
add bh, bh
adc eax, sym.imp.msvcrt.dll_printf
add esp, 8
mov esi, 0
mov edi, 0
mov ebp, 1
mov edx, 0
mov eax, esi
imul eax, eax, 4
add eax, edi
movzx ebx, byte [eax + section..data]
mov eax, ebp
imul eax, eax, 4
add eax, edi
movzx ecx, byte [eax + section..data]
cmp ebx, ecx
jne 0x4020c1
inc edx
jmp 0x4020df
cmp ebp, dword [0x401010]
jae 0x4020cc
inc ebp
jmp 0x4020ac
mov eax, dword [0x401010]
cmp esi, eax
jae 0x4020df
inc esi
cmp esi, eax
jae 0x4020df
mov ebp, esi
inc ebp
jmp 0x40209e
mov eax, dword [0x401014]
cmp edi, eax
jae 0x4020f5
inc edi
mov esi, 0
mov ebp, 1
jmp 0x40209e
mov eax, dword [0x401014]
sub eax, edx
inc eax
push eax
call 0x40210a
and eax, 0x6f632064
insb byte es:[edi], dx
add bh, bh
adc eax, sym.imp.msvcrt.dll_printf
add esp, 8
call dword [sym.imp.msvcrt.dll__getch]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x40210a
Capabilities:
Terminate process

Disassembly:
mov esi, 0
mov edi, 0
mov ebp, 1
mov edx, 0
mov eax, esi
imul eax, eax, 4
add eax, edi
movzx ebx, byte [eax + section..data]
mov eax, esi
imul eax, eax, 4
add eax, ebp
movzx ecx, byte [eax + section..data]
cmp ebx, ecx
jne 0x402037
inc edx
jmp 0x402055
cmp ebp, dword [0x401014]
jae 0x402042
inc ebp
jmp 0x402022
mov eax, dword [0x401014]
cmp edi, eax
jae 0x402055
inc edi
cmp edi, eax
jae 0x402055
mov ebp, edi
inc ebp
jmp 0x402014
mov eax, dword [0x401010]
cmp esi, eax
jae 0x40206b
inc esi
mov edi, 0
mov ebp, 1
jmp 0x402014
mov eax, dword [0x401010]
sub eax, edx
inc eax
push eax
call 0x402081
and eax, 0x6f722064
ja 0x4020a0
add bh, bh
adc eax, sym.imp.msvcrt.dll_printf
add esp, 8
mov esi, 0
mov edi, 0
mov ebp, 1
mov edx, 0
mov eax, esi
imul eax, eax, 4
add eax, edi
movzx ebx, byte [eax + section..data]
mov eax, ebp
imul eax, eax, 4
add eax, edi
movzx ecx, byte [eax + section..data]
cmp ebx, ecx
jne 0x4020c1
inc edx
jmp 0x4020df
cmp ebp, dword [0x401010]
jae 0x4020cc
inc ebp
jmp 0x4020ac
mov eax, dword [0x401010]
cmp esi, eax
jae 0x4020df
inc esi
cmp esi, eax
jae 0x4020df
mov ebp, esi
inc ebp
jmp 0x40209e
mov eax, dword [0x401014]
cmp edi, eax
jae 0x4020f5
inc edi
mov esi, 0
mov ebp, 1
jmp 0x40209e
mov eax, dword [0x401014]
sub eax, edx
inc eax
push eax
call 0x40210a
and eax, 0x6f632064
insb byte es:[edi], dx
add bh, bh
adc eax, sym.imp.msvcrt.dll_printf
add esp, 8
call dword [sym.imp.msvcrt.dll__getch]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x43b65e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
dec edi
inc edx
call fcn.0043b68e
inc edi
add edi, edi
sub edx, edx
xor dword [esi], eax
add edx, 0xd98e26c3
or edi, edi
inc esi
mov edi, edx
mov edi, 0x8ae10666
cmp esi, ebx
jne fcn.0043b65e
add edx, edi
ret

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c84
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404650
call fcn.00405880
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret
Function at 0x4053b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x4c8480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
Function at 0x41453d
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x414565
push cs
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x414557
pop edi
pop esi
pop ebp
ret 4