joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c5390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101d5844]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x28], 0
mov dx, word [ebp - 0x28]
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov ebx, ecx
sub edi, dword [eax]
mov dword [ebp - 0x2c], eax
mov al, byte [ebx + 0x1a]
mov byte [ebp - 0x21], al
test al, al
je 0x100c53de
lea ecx, [ebx + 0x1b]
movzx esi, al
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
add dx, ax
sub esi, 1
jne 0x100c53d0
movzx eax, dx
cmp edi, eax
je 0x100c53f8
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116b04
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esi, [ebp - 0x20]
mov dword [ebx + 0x16], eax
movups xmm0, xmmword [ebx]
mov cx, word [ebx + 0x18]
mov word [ebp - 8], cx
mov cl, byte [ebx + 0x1a]
movups xmmword [ebp - 0x20], xmm0
mov byte [ebp - 6], cl
movq xmm0, qword [ebx + 0x10]
movq qword [ebp - 0x10], xmm0
nop
movzx ecx, byte [esi]
mov edx, eax
shr edx, 0x18
inc esi
xor edx, ecx
shl eax, 8
lea ecx, [ebp - 5]
xor eax, dword [edx*4 + 0x101c2708]
cmp esi, ecx
jne 0x100c5420
movzx edi, byte [ebp - 0x21]
lea esi, [ebx + 0x1b]
add edi, 0x1b
add edi, ebx
cmp esi, edi
je 0x100c5469
nop dword [eax]
movzx ecx, byte [esi]
mov edx, eax
shr edx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x101c2708]
cmp esi, edi
jne 0x100c5450
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ecx + 4]
mov ecx, dword [ecx]
cmp ecx, edi
je 0x100c548e
movzx edx, byte [ecx]
mov esi, eax
shr esi, 0x18
inc ecx
xor esi, edx
shl eax, 8
xor eax, dword [esi*4 + 0x101c2708]
cmp ecx, edi
jne 0x100c5475
mov ecx, dword [ebp - 4]
pop edi
mov dword [ebx + 0x16], eax
xor ecx, ebp
pop esi
mov al, 1
pop ebx
call fcn.10116b04
mov esp, ebp
pop ebp
ret

Function at 0x100c54b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov edi, dword [eax + 4]
mov eax, dword [eax]
cmp eax, edi
je 0x100c54df
movzx ecx, byte [eax]
inc eax
movzx edx, byte [esi + 3]
xor edx, ecx
mov ecx, dword [esi]
shl ecx, 8
xor ecx, dword [edx*4 + 0x101c2708]
mov dword [esi], ecx
cmp eax, edi
jne 0x100c54c3
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100e4140
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor edx, edx
push edi
movsd xmm0, qword [esi + 0x10b8]
lea edi, [edx + 3]
movsd qword [esi + 0x10b0], xmm0
nop dword [eax]
mov ecx, dword [esi + 0x10c8]
imul eax, ecx, 0x343fd
shr ecx, 0x10
and ecx, 0x7fff
shl edx, 0xf
xor edx, ecx
add eax, 0x269ec3
mov dword [esi + 0x10c8], eax
sub edi, 1
jne 0x100e4160
movd xmm0, edx
cvtdq2ps xmm0, xmm0
pop edi
mulss xmm0, dword [0x101c3cc8]
cvtps2pd xmm0, xmm0
movsd qword [esi + 0x10b8], xmm0
pop esi
ret
Function at 0x100fa970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 8
jl 0x100faa25
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [ebp + 8]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x10171ca0]
xor edx, dword [ecx*4 + 0x101718a0]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x101720a0]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x101708a0]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x10170ca0]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x101704a0]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x101710a0]
xor edx, dword [eax*4 + 0x101714a0]
mov eax, edx
sub ebx, 1
jne 0x100fa994
pop ebx
jmp 0x100faa28
mov eax, dword [ebp + 8]
test edi, edi
je 0x100faa4c
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x101704a0]
sub edi, 1
jne 0x100faa30
pop edi
pop esi
pop ebp
ret
Function at 0x1014986c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101496e2

Function at 0x1014bac6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014b743
Function at 0x401390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx + 0x3c]
push ebx
push esi
push edi
mov edi, dword [eax + ecx + 0x78]
mov ebx, edx
add edi, ecx
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 8], ecx
mov eax, dword [edi + 0x24]
mov edx, dword [edi + 0x1c]
add eax, ecx
mov dword [ebp - 0xc], eax
add edx, ecx
mov eax, dword [edi + 0x20]
add eax, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], eax
test ebx, 0xffff0000
jne 0x4013f0
movzx esi, bx
cmp esi, dword [edi + 0x10]
jb 0x40146e
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
cmp esi, eax
ja 0x40146e
sub esi, dword [edi + 0x10]
mov esi, dword [edx + esi*4]
add esi, ecx
jmp 0x401450
xor edx, edx
cmp dword [edi + 0x18], edx
jbe 0x401450
mov eax, dword [eax + edx*4]
add eax, ecx
mov cl, byte [ebx]
cmp cl, byte [eax]
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 8]
jne 0x40142c
cmp byte [ebp - 1], 0
je 0x401428
mov cl, byte [ebx + 1]
cmp cl, byte [eax + 1]
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 8]
jne 0x40142c
add ebx, 2
add eax, 2
cmp byte [ebp - 1], 0
jne 0x4013fc
xor eax, eax
jmp 0x401431
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401444
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
movzx eax, word [eax + edx*2]
mov esi, dword [ebx + eax*4]
add esi, ecx
mov ebx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x18]
cmp edx, dword [edi + 0x18]
jb 0x4013f7
cmp esi, edi
jb 0x4014ac
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x7c]
add eax, edi
cmp esi, eax
jae 0x4014ac
push esi
call fcn.0046d6bb
mov edi, eax
pop ecx
test edi, edi
jne 0x401472
xor eax, eax
jmp 0x4014ae
push 0x2e
push edi
xor esi, esi
call fcn.00468fb0
pop ecx
mov ebx, eax
pop ecx
push edi
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
jne 0x401499
push edi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x4014a5
lea edx, [ebx + 1]
mov ecx, eax
call fcn.00401390
mov esi, eax
push edi
call fcn.0046d711
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4014d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x4014e2
pop esi
ret
mov edx, esi
mov ecx, eax
pop esi
jmp fcn.00401390

Function at 0x401522
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
jb 0x401535
mov esi, dword [esi]
xor ebx, ebx
mov dword [ebp - 0xe], 0x4c5b753e
mov cl, 0x3e
mov dword [ebp - 0xa], 0xd525b50
mov dword [ebp - 6], 0x525a100c
mov eax, ebx
mov word [ebp - 2], 0x52
xor byte [ebp + eax - 0xd], cl
inc eax
cmp eax, 0xc
jae 0x401565
mov cl, byte [ebp - 0xe]
jmp 0x401556
lea eax, [ebp - 0xd]
mov byte [ebp - 1], bl
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x401584
mov edx, 0x494074
mov ecx, eax
call fcn.00401390
mov ebx, eax
push esi
call ebx
mov ecx, eax
xor edx, edx
and ecx, 0x10
cmp eax, 0xffffffff
pop esi
cmove ecx, edx
mov eax, ecx
pop ebx
leave
ret 4
Function at 0x401c31
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov edx, ecx
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], edx
push 0xf
pop esi
push dword [ebp + 8]
lea ecx, [edx + 4]
mov dword [ecx + 0x10], ebx
lea edi, [edx + 0x7c]
mov dword [ecx + 0x14], esi
mov byte [ecx], bl
mov dword [edx + 0x2c], ebx
mov dword [edx + 0x30], esi
mov byte [edx + 0x1c], bl
mov dword [edx + 0x44], ebx
mov dword [edx + 0x48], esi
mov byte [edx + 0x34], bl
lea ebx, [edx + 0x4c]
and dword [ebx + 0x10], 0
mov dword [ebx + 0x14], esi
mov byte [ebx], 0
and dword [edx + 0x74], 0
mov dword [edx + 0x78], esi
mov byte [edx + 0x64], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], esi
lea esi, [edx + 0x94]
mov byte [edi], al
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
lea eax, [edx + 0xac]
and dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
xor eax, eax
mov dword [edx + 0xc4], eax
mov dword [edx + 0xc8], eax
mov dword [edx + 0xcc], eax
mov dword [edx + 0xd0], eax
mov dword [edx + 0xd4], eax
mov word [edx + 0xd8], ax
mov byte [edx + 0xda], al
call fcn.00403a54
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
lea ecx, [ecx + 0x1c]
call fcn.00403a54
mov ecx, dword [ebp - 8]
push dword [ebp + 0x10]
lea ecx, [ecx + 0x34]
call fcn.00403a54
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.00403a54
mov ebx, dword [ebp - 8]
push 0
push 0x494070
lea ecx, [ebx + 0x64]
call fcn.00403c0c
push 0
push 0x494070
mov ecx, edi
call fcn.00403c0c
push 0
push 0x494070
mov ecx, esi
call fcn.00403c0c
movaps xmm0, xmmword [0x49db50]
xor edx, edx
movups xmmword [ebp - 0x1b], xmm0
mov word [ebp - 0xb], 0x5251
mov ecx, edx
mov byte [ebp - 9], dl
mov al, byte [ebp - 0x1b]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0x11
jb 0x401d4d
mov byte [ebp - 9], dl
mov cl, 0x3b
mov dword [ebp - 8], 0x565e4f3b
mov eax, edx
mov word [ebp - 4], 0x4b
xor byte [ebp + eax - 7], cl
inc eax
cmp eax, 4
jae 0x401d7d
mov cl, byte [ebp - 8]
jmp 0x401d6e
lea eax, [ebp - 0x1a]
mov byte [ebp - 3], dl
push eax
lea ecx, [ebp - 0x64]
call fcn.00403ae8
push eax
lea eax, [ebp - 7]
push eax
call fcn.0046e9c4
pop ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403ae8
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.00403e20
pop ecx
push eax
lea ecx, [ebx + 0xac]
call fcn.00403a82
lea ecx, [ebp - 0x34]
call fcn.00403b2e
lea ecx, [ebp - 0x4c]
call fcn.00403b2e
lea ecx, [ebp - 0x64]
call fcn.00403b2e
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x401dd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x3c]
push 0x494070
call fcn.00403ae8
xor ebx, ebx
mov dword [ebp - 0xa], 0x40552c6f
mov cl, 0x6f
mov word [ebp - 6], 0x40
mov eax, ebx
xor byte [ebp + eax - 9], cl
inc eax
cmp eax, 4
jae 0x401e12
mov cl, byte [ebp - 0xa]
jmp 0x401e03
mov byte [ebp - 5], bl
mov cl, 0x5d
mov dword [ebp - 0x1d], 0x2f38165d
mov eax, ebx
mov dword [ebp - 0x19], 0x6e313833
mov dword [ebp - 0x15], 0x3139736f
mov word [ebp - 0x11], 0x31
xor byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 0xc
jae 0x401e43
mov cl, byte [ebp - 0x1d]
jmp 0x401e34
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x10], bl
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x401e58
mov eax, ebx
jmp 0x401e64
mov edx, str.GetVolumeInformationA
mov ecx, eax
call fcn.00401390
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
lea ecx, [ebp - 9]
push ecx
call eax
mov ecx, dword [ebp - 4]
lea esi, [ebp - 0xf]
mov eax, ecx
shl eax, 2
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, ecx
xor edx, edx
push 0xa
pop ecx
div ecx
dec esi
mov ecx, eax
add dl, 0x30
mov byte [esi], dl
test ecx, ecx
jne 0x401e84
push ecx
lea eax, [ebp - 0xf]
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.00404247
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00403a82
lea ecx, [ebp - 0x54]
call fcn.00403b2e
lea eax, [ebp - 0x3c]
push eax
mov ecx, eax
call fcn.00403a2e
push 0x494070
mov ecx, edi
call fcn.00403ae8
cmp dword [ebp - 0x2c], ebx
jbe 0x401f0e
lea eax, [ebx - 1]
test al, 1
lea eax, [ebp - 0x3c]
jne 0x401ef0
cmp dword [ebp - 0x28], 0x10
cmovae eax, dword [ebp - 0x3c]
mov al, byte [eax + ebx]
add al, 0x40
jmp 0x401efb
cmp dword [ebp - 0x28], 0x10
cmovae eax, dword [ebp - 0x3c]
mov al, byte [eax + ebx]
mov byte [ebp - 8], al
mov ecx, edi
push dword [ebp - 8]
call fcn.00403bd1
inc ebx
cmp ebx, dword [ebp - 0x2c]
jb 0x401ed7
cmp dword [edi + 0x14], 0x10
mov esi, edi
jb 0x401f18
mov esi, dword [edi]
mov eax, edi
jb 0x401f1e
mov eax, dword [edi]
mov ebx, dword [edi + 0x10]
add ebx, eax
jmp 0x401f3b
mov cl, byte [esi]
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x401f3a
movsx eax, cl
push eax
call fcn.0046ddd0
pop ecx
mov byte [esi], al
inc esi
cmp esi, ebx
jne 0x401f25
lea ecx, [ebp - 0x3c]
call fcn.00403b2e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408257
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
push 0
push 0x14
mov dword [ebp - 4], edi
and dword [edi], 0
call fcn.00406641
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40827f
push 7
pop eax
jmp 0x4082f4
cmp dword [0x4a2214], 0
push ebx
mov ebx, dword [ebp + 8]
je 0x4082cc
mov eax, dword [0x4a2318]
test eax, eax
je 0x40829f
push 0xc8
call eax
pop ecx
jmp 0x4082a1
xor eax, eax
test eax, eax
jne 0x4082cc
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x408237
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.0046eb43
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4082d8
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 4]
cmp dword [esi + 8], 0
jne 0x4082ef
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
pop ecx
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40be53
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x40be87
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x40be6d
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
leave
ret
Function at 0x42b989
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
push edi
test esi, esi
je 0x42b9ee
xor eax, eax
push eax
push 8
mov dword [ebp - 0x10], eax
call fcn.00406b1f
mov edi, eax
mov dword [ebp - 0x14], edi
pop ecx
pop ecx
test edi, edi
je 0x42b9ee
test byte [ebp + 8], 1
mov ecx, dword [esi]
mov dword [edi], ecx
jne 0x42b9cc
xor ecx, ecx
inc ecx
cmp dword [esi], ecx
jle 0x42b9cc
add ecx, ecx
cmp ecx, dword [esi]
jl 0x42b9c6
imul eax, ecx, 0x18
mov ecx, ebx
push 0
push eax
call fcn.00406b1f
mov ebx, eax
mov dword [edi + 4], ebx
pop ecx
pop ecx
test ebx, ebx
jne 0x42b9f5
mov ecx, dword [ebp - 0xc]
mov edx, edi
call fcn.0040690a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [esi], 0
mov ecx, dword [esi + 4]
mov dword [ebp - 4], ecx
jle 0x42ba77
mov edi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
mov dword [ebp - 8], eax
sub ebx, ecx
mov edx, dword [ecx]
mov ecx, edi
push dword [ebp + 8]
call fcn.0042b96b
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + ecx], eax
mov edx, dword [ecx + 4]
mov ecx, edi
call fcn.00406c95
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx - 0xc], eax
mov ecx, edi
mov edx, dword [edx + 8]
call fcn.00406c95
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edx - 8], eax
mov al, byte [ecx + 0xc]
and dword [edx], 0xfffffffe
mov byte [edx - 4], al
mov eax, dword [ecx + 0x10]
xor eax, dword [edx]
and eax, 2
xor dword [edx], eax
mov eax, dword [ecx + 0x14]
add ecx, 0x18
mov dword [edx + 4], eax
add edx, 0x18
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
cmp eax, dword [esi]
jl 0x42ba0b
mov edi, dword [ebp - 0x14]
mov eax, edi
jmp 0x42b9f0
Function at 0x457e1a
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x486f61
call fcn.00486b34
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x457e3a
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x457e45
mov ecx, dword [ecx]
push eax
push ecx
call fcn.0046f635
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x457e79
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x457e62
mov ecx, dword [ecx]
push esi
push eax
push 1
push ecx
call fcn.00471597
push esi
call fcn.0046f96d
add esp, 0x14
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x458cde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x42], 0x65725c17
push edi
mov cl, 0x17
mov dword [ebp - 0x3e], 0x247b7279
mov dword [ebp - 0x3a], 0x7b733925
mov eax, ebx
mov word [ebp - 0x36], 0x7b
xor byte [ebp + eax - 0x41], cl
inc eax
cmp eax, 0xc
jae 0x458d17
mov cl, byte [ebp - 0x42]
jmp 0x458d08
lea eax, [ebp - 0x41]
mov byte [ebp - 0x35], bl
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x458d2c
mov eax, ebx
jmp 0x458d38
mov edx, str.GetSystemTimes
mov ecx, eax
call fcn.00401390
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x458dff
mov eax, dword [ebp - 0x20]
xor esi, esi
or esi, dword [ebp - 0x2c]
or eax, ebx
mov edi, dword [ebp - 0x28]
xor edx, edx
or edx, dword [ebp - 0x24]
or edi, ebx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 8], eax
or ecx, ebx
xor eax, eax
mov dword [ebp - 0x18], edx
or eax, dword [ebp - 0x34]
add esi, eax
mov ebx, esi
adc edi, ecx
sub ebx, dword [0x4a40c8]
mov eax, edi
sbb eax, dword [0x4a40cc]
mov dword [ebp - 0xc], eax
jne 0x458d94
test ebx, ebx
jne 0x458d94
xorps xmm1, xmm1
jmp 0x458dcd
mov ecx, edx
mov edx, dword [ebp - 8]
sub ecx, dword [0x4a40b8]
sbb edx, dword [0x4a40bc]
call fcn.00486ef0
mov edx, dword [ebp - 0xc]
mov ecx, ebx
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x10], xmm0
call fcn.00486ef0
movss xmm1, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x49d4f0]
xor ebx, ebx
mov eax, dword [ebp - 8]
subss xmm0, xmm1
mov dword [0x4a40c8], esi
mov dword [0x4a40cc], edi
mov dword [0x4a40b8], edx
mov dword [0x4a40bc], eax
mulss xmm0, dword [0x49d5b8]
jmp 0x458e07
movss xmm0, dword [0x49d5f8]
cvtps2pd xmm0, xmm0
push ecx
push ecx
movsd qword [esp], xmm0
push 0x49d2ac
movsd qword [ebp - 0x1c], xmm0
call fcn.004573ca
mov esi, dword [ebp + 8]
add esp, 0xc
mov edi, eax
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
lea ebx, [edi + 1]
push 0
push ebx
call fcn.004625cc
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x458e4b
mov eax, dword [esi]
movsd xmm0, qword [ebp - 0x1c]
push ecx
push ecx
movsd qword [esp], xmm0
push 0x49d2ac
push ebx
push eax
call fcn.004573ae
add esp, 0x14
mov ecx, esi
push 0
push edi
call fcn.00461b40
push ecx
mov edi, 0x496990
mov ecx, esi
push edi
call fcn.00403966
cmp eax, 0xffffffff
je 0x458e9a
push ecx
push edi
mov ecx, esi
call fcn.00403966
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x458e96
mov ecx, dword [esi]
mov byte [ecx + eax], 0x2e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x464392
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x4643c0
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.004693e0
movzx eax, word [ebx*8 + 0x49d0ba]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x49d0b8]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x49d0bc]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x49d0be]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x464423
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x46442e
cmp ebx, 8
jl 0x46442e
mov eax, dword [ebp + 8]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x464495
cmp eax, 0xffffffff
je 0x464495
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x464470
mov ecx, esi
call fcn.00464614
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x464478
jmp 0x4644a5
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46474c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, ebx
push edi
mov dword [ebp - 4], ecx
mov edi, ebx
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
jmp 0x464961
cmp eax, 3
jb 0x4647cb
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x464808
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x464808
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x4647f2
mov dword [esi + 0x6afa0], eax
mov edx, ecx
mov ecx, esi
call fcn.004644aa
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x4648ed
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.00463e45
pop ecx
mov ecx, dword [esi + 0x6af90]
sub ecx, edi
mov dword [ebp - 8], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x4648b2
cmp ecx, 3
jb 0x4648b2
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x46484a
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
jmp 0x4648e8
mov edx, dword [esi + 0x6af84]
add edx, edi
mov edi, ebx
mov dword [esi + 0x6af84], edx
movzx ecx, byte [esi + edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 8]
jmp 0x464912
movzx eax, byte [esi + ecx + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.00463e45
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
pop ecx
test eax, eax
je 0x464944
mov eax, dword [esi + 0x6af74]
xor ecx, ecx
sub edx, eax
push ebx
push edx
lea edx, [esi + 0x1af70]
add edx, eax
test eax, eax
cmovs edx, ecx
mov ecx, esi
call fcn.00463c6d
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x46495e
mov ecx, esi
call fcn.00464614
mov eax, dword [esi + 0x6af90]
mov ecx, dword [ebp - 4]
test eax, eax
jne 0x464774
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x46497b
lea ebx, [esi + 0x1af70]
add ebx, ecx
mov eax, dword [esi + 0x6af84]
mov edx, ebx
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00463c6d
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret