joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422288
Capabilities:
Encode data using add xor sub operations

Disassembly:
or bh, byte [ebx - 0x68]
int1
salc
push edi
add esp, 8
add esp, 8
neg edi
or edi, 0xffffffff
push esi
xor esi, esi
jne 0x827e70
mov esi, esp
and edi, dword [esi + 4]
mov dword [esp - 0x21], esi
mov esi, dword [esi]
push esi
and esi, 0xfe2ab961
mov esi, esp
mov dword [esi - 0x32], edi
pop esi
mov dword [esp - 0x22], ecx
add esp, 8
pop esi
pop edx
pop ebx
leave
ret 0x14
push 0x40ec7b
push esi
mov esi, esp
call 0x42223b
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x11e8fe], 0
add byte [edi - 0x54], bl
jne 0x42224e
jnp 0x4221de
int1
salc
push edi
inc esp
sub eax, 0x29b0f362
scasb al, byte es:[edi]
dec edi
add esp, 8
sub dword [esi + 0x8c4834f], ebp
and dword [esi + 4], ebp
push ebx
dec ebx
mov ebx, esp
xor dword [ebx - 0x69], eax
pop ebx
jbe 0x422264
xor eax, 0
or dword [esi + 4], ebp
pop esi
mov ebp, esp
sub esp, 0x104
sub esp, 0xd
xor dword [esp + 9], eax
call 0x422288
push 0x5b
clc
sal dword [esi], 1
aaa
movsb byte es:[edi], byte [esi]
or eax, 0x910d3c2
call 0x422299
push cs
das
cmp al, 0xc5
sbb cl, byte [ebx + 0x28]
inc ecx
out 0x27, al
aam 0x7d
add esp, 8
xor eax, dword [esp + 9]
push ebx
and ebx, 0
jne 0x827f1f
or ebx, 0xffffffff
push eax
or eax, edx
mov eax, esp
mov dword [eax - 0x5b], esi
pop eax
xor ecx, 0
not ebx
or ebx, 0x486abb3
jmp 0x4222ce
or edi, edi
xor ebx, 0x55e6afca
xor ebx, 0x51600479
sub ecx, ebx
pop ebx
xor dword [esp + 9], eax
mov eax, dword [esp + 9]
add esp, 9
push 0xffffffffffffffff
sub ecx, 0
push edx
and edx, ecx
mov edx, esp
cmp dword [edx - 0xe], edi
pop edx
and dword [esp], ebx
sbb al, 0x24
push ecx
push edx
push edi
sub esp, 4
add ebx, 0
or dword [esp - 0x61], esi
xor dword [esp], esi
call 0x422320
cmp eax, 0x39008332
jle 0x4222f9
sub al, 0xf5
mov bh, bl
sbb byte [ecx - 0x18], dh
adc al, 0
add byte [eax], al
push esi
xlatb
les ebp, [ebp - 0x56cf8c1e]
iretd
Function at 0x422299
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
or bh, byte [ebx - 0x68]
int1
salc
push edi
add esp, 8
add esp, 8
neg edi
or edi, 0xffffffff
push esi
xor esi, esi
jne 0x827e70
mov esi, esp
and edi, dword [esi + 4]
mov dword [esp - 0x21], esi
mov esi, dword [esi]
push esi
and esi, 0xfe2ab961
mov esi, esp
mov dword [esi - 0x32], edi
pop esi
mov dword [esp - 0x22], ecx
add esp, 8
pop esi
pop edx
pop ebx
leave
ret 0x14
push 0x40ec7b
push esi
mov esi, esp
call 0x42223b
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x11e8fe], 0
add byte [edi - 0x54], bl
jne 0x42224e
jnp 0x4221de
int1
salc
push edi
inc esp
sub eax, 0x29b0f362
scasb al, byte es:[edi]
dec edi
add esp, 8
sub dword [esi + 0x8c4834f], ebp
and dword [esi + 4], ebp
push ebx
dec ebx
mov ebx, esp
xor dword [ebx - 0x69], eax
pop ebx
jbe 0x422264
xor eax, 0
or dword [esi + 4], ebp
pop esi
mov ebp, esp
sub esp, 0x104
sub esp, 0xd
xor dword [esp + 9], eax
call 0x422288
push 0x5b
clc
sal dword [esi], 1
aaa
movsb byte es:[edi], byte [esi]
or eax, 0x910d3c2
call 0x422299
push cs
das
cmp al, 0xc5
sbb cl, byte [ebx + 0x28]
inc ecx
out 0x27, al
aam 0x7d
add esp, 8
xor eax, dword [esp + 9]
push ebx
and ebx, 0
jne 0x827f1f
or ebx, 0xffffffff
push eax
or eax, edx
mov eax, esp
mov dword [eax - 0x5b], esi
pop eax
xor ecx, 0
not ebx
or ebx, 0x486abb3
jmp 0x4222ce
or edi, edi
xor ebx, 0x55e6afca
xor ebx, 0x51600479
sub ecx, ebx
pop ebx
xor dword [esp + 9], eax
mov eax, dword [esp + 9]
add esp, 9
push 0xffffffffffffffff
sub ecx, 0
push edx
and edx, ecx
mov edx, esp
cmp dword [edx - 0xe], edi
pop edx
and dword [esp], ebx
sbb al, 0x24
push ecx
push edx
push edi
sub esp, 4
add ebx, 0
or dword [esp - 0x61], esi
xor dword [esp], esi
call 0x422320
cmp eax, 0x39008332
jle 0x4222f9
sub al, 0xf5
mov bh, bl
sbb byte [ecx - 0x18], dh
adc al, 0
add byte [eax], al
push esi
xlatb
les ebp, [ebp - 0x56cf8c1e]
iretd
Function at 0x42577a
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
push ebx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0xdc12c045
lea esp, [esp + 0xd]
mov dword [esp], ecx
push edx
push edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x42579c
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x42579c
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x42579c
mov dword [esp - 0x1d], esi
jb 0x4257d2
sub edx, 0
cmp word [ebx + 4], 0x14c
jne 0x42579c
test word [ebx + 0x16], 2
je 0x42579c
test word [ebx + 0x16], 0x100
je 0x42579c
jmp 0x425808
push ebx
call 0x425819
sbb al, 0x25
cli
stosd dword es:[edi], eax
or byte [ecx - 0x224b783a], ah
push edx
add esp, 8
cmp word [ebx + 0x18], 0x10b
jne 0x42579c
mov edx, dword [ebx + 0x78]
cmp dword [esp - 0x23], ecx
cmp edx, 0
je 0x42579c
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.0040cc22
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x42579c
lea esi, [edx + 0x316f4195]
or esi, 0xffffffff
push ecx
xor ecx, 0x723b9e9b
mov ecx, esp
and esi, dword [ecx + 4]
xor eax, 0
mov ecx, dword [ecx]
push eax
call 0x425888
add dl, byte [ebx]
push eax
dec ecx
dec esi
outsd dx, dword [esi]
jl 0x425883
pop edx
mov ebp, dword [eax - 0x7f]
adc al, 0xbd
adc al, 0xbd
mov dl, 3
add esp, 8
add esp, 8
sub edi, edi
jne 0x425907
or edi, 0xffffffff
not edi
or edi, dword [esp]
add esp, 4
not edx
or edx, 0xffffffff
push ebx
sub ebx, ebx
jne 0x82b520
mov ebx, esp
mov dword [ebx - 9], edi
pop ebx
not edx
push eax
add eax, esi
mov eax, esp
xor edx, dword [eax + 4]
push edx
lea edx, [esi + edi*2 - 0x55f35438]
mov edx, esp
cmp dword [edx - 0x37], edi
pop edx
or dword [esp - 0x21], ecx
mov eax, dword [eax]
push ebx
and ebx, eax
mov ebx, esp
sub dword [ebx - 0xb], ecx
pop ebx
add esp, 8
pop ecx
xchg dword [esp], ebx
mov dword [esp], ebx
lea esp, [esp + 4]
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
ret 8
invalid
Function at 0x425819
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
push ebx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0xdc12c045
lea esp, [esp + 0xd]
mov dword [esp], ecx
push edx
push edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x42579c
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x42579c
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x42579c
mov dword [esp - 0x1d], esi
jb 0x4257d2
sub edx, 0
cmp word [ebx + 4], 0x14c
jne 0x42579c
test word [ebx + 0x16], 2
je 0x42579c
test word [ebx + 0x16], 0x100
je 0x42579c
jmp 0x425808
push ebx
call 0x425819
sbb al, 0x25
cli
stosd dword es:[edi], eax
or byte [ecx - 0x224b783a], ah
push edx
add esp, 8
cmp word [ebx + 0x18], 0x10b
jne 0x42579c
mov edx, dword [ebx + 0x78]
cmp dword [esp - 0x23], ecx
cmp edx, 0
je 0x42579c
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.0040cc22
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x42579c
lea esi, [edx + 0x316f4195]
or esi, 0xffffffff
push ecx
xor ecx, 0x723b9e9b
mov ecx, esp
and esi, dword [ecx + 4]
xor eax, 0
mov ecx, dword [ecx]
push eax
call 0x425888
add dl, byte [ebx]
push eax
dec ecx
dec esi
outsd dx, dword [esi]
jl 0x425883
pop edx
mov ebp, dword [eax - 0x7f]
adc al, 0xbd
adc al, 0xbd
mov dl, 3
add esp, 8
add esp, 8
sub edi, edi
jne 0x425907
or edi, 0xffffffff
not edi
or edi, dword [esp]
add esp, 4
not edx
or edx, 0xffffffff
push ebx
sub ebx, ebx
jne 0x82b520
mov ebx, esp
mov dword [ebx - 9], edi
pop ebx
not edx
push eax
add eax, esi
mov eax, esp
xor edx, dword [eax + 4]
push edx
lea edx, [esi + edi*2 - 0x55f35438]
mov edx, esp
cmp dword [edx - 0x37], edi
pop edx
or dword [esp - 0x21], ecx
mov eax, dword [eax]
push ebx
and ebx, eax
mov ebx, esp
sub dword [ebx - 0xb], ecx
pop ebx
add esp, 8
pop ecx
xchg dword [esp], ebx
mov dword [esp], ebx
lea esp, [esp + 4]
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
ret 8
invalid
Function at 0x401480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4014a6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40153a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4014f5
cmp eax, 0x40
je 0x4014f5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401499
cmp eax, 0x40
je 0x401499
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401499
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x10025900
Capabilities:
Hide graphical window

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.10002280
xor eax, eax
ret
Function at 0x416113
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416152
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416152
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416152
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416152
cmp dword [ecx + 0x74], 0xe
jbe 0x416152
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428520
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42854d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42854d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4905a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x64000]
push edi
or ebp, 0xffffffff
jmp 0x4905c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4905c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4905b8
mov eax, 1
add ebx, ebx
jne 0x4905db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4905ec
jne 0x49060b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49060b
dec eax
add ebx, ebx
jne 0x4905f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4905d0
add ebx, ebx
jne 0x490607
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49065d
xor ecx, ecx
sub eax, 3
jb 0x490623
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x490692
sar eax, 1
mov ebp, eax
jmp 0x49062e
add ebx, ebx
jne 0x49062e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4905fc
inc ecx
add ebx, ebx
jne 0x49063c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4905fc
add ebx, ebx
jne 0x490649
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49063e
jne 0x49065a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49063e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49067c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49066e
jmp 0x4905be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49067c
add edi, ecx
jmp 0x4905be
pop esi
mov edi, esi
mov ecx, 0x23d9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49069a
cmp byte [edi], 0x15
jne 0x49069a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49069f
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x490717
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa7b28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa7c18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4906cc
mov ecx, edi
jns 0x4906fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa7c1c]
or eax, eax
je 0x490711
mov dword [ebx], eax
add ebx, 4
jmp 0x4906e9
call dword [esi + 0xa7c2c]
mov ebp, dword [esi + 0xa7c20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49074b
sub esp, 0xffffff80
jmp 0x430bde
Function at 0x401230
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x40c3dc
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x41137c]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [0x41137c]
xor eax, esp
push eax
lea eax, [esp + 0x210]
mov dword fs:[0], eax
lea eax, [esi + 8]
push eax
mov dword [esp + 0xc], esi
call fcn.00401840
lea ecx, [esi + 0x20]
push ecx
mov dword [esp + 0x21c], 0
call fcn.00401840
lea edx, [esi + 0x38]
push edx
mov byte [esp + 0x21c], 1
call fcn.00401840
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.UPDATE_EVENT__d
lea edx, [esp + 0x14]
mov dword [esi + 0x54], eax
call fcn.00401ca0
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [esi + 4]
push ecx
push 4
push esi
push 0x401210
push 0
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040b396
add esp, 0x218
ret

Function at 0x407240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x407263
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [edx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret 4

Function at 0x40b37f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4117d0], 0
push esi
jne 0x40b2f2
call fcn.0040b218
test eax, eax
je 0x40b335
mov eax, dword [0x4117d0]
cmp eax, 1
jne 0x40b313
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40b335
pop esi
ret
push eax
call dword [0x4117d8]
test eax, eax
jne 0x40b37d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40b339
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4117d0]
call dword [0x4117d8]
mov edi, eax
test edi, edi
je 0x40b35e
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b37a
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4117d0]
call dword [0x4117d4]
add edi, 0x10
cmp edi, esi
jb 0x40b366
mov eax, edi
pop edi
pop esi
ret
jmp 0x40b2df

Function at 0x40b396
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41137c]
jne 0x40b3a0
repz ret
jmp fcn.0040b945
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xdca958
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdca962
pushal
call 0xdca968
pop ebp
sub ebp, 0x10
sub ebp, 0x9ca958
jmp 0xdca97e
mov eax, 0x9ca958
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
mov edx, 0x8fcbf99d
xor byte [eax], dl
inc eax
dec ecx
jne 0xdca995
jmp 0xdca9a8
push ss
push eax
push ss
adc al, 0xa1
popfd
popfd
popfd
sbb al, 0x5c
popfd
popfd
popfd
sahf
push eax
and eax, 0x9d9d9d99
daa
mov ch, 0x9d
popfd
popfd
push 0x7f
sahf
push ebp
push ss
sbb al, 0x91
popfd
popfd
popfd
sahf
pop eax
adc cl, bh
mov ecx, 0xb9991461
int 0xf5
inc ecx
retf
Function at 0x4254c5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e50f
and dword [ebp - 4], 0
cmp dword [0x44f1f0], 0
mov ebx, eax
jne 0x425576
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425627
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425627
push eax
call fcn.0041e49d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f1f0], eax
call esi
push eax
call fcn.0041e49d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f1f4], eax
call esi
push eax
call fcn.0041e49d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f1f8], eax
call esi
push eax
call fcn.0041e49d
pop ecx
mov dword [0x44f200], eax
test eax, eax
je 0x425576
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e49d
pop ecx
mov dword [0x44f1fc], eax
mov eax, dword [0x44f1fc]
cmp eax, ebx
je 0x4255ce
cmp dword [0x44f200], ebx
je 0x4255ce
push eax
call fcn.0041e518
push dword [0x44f200]
mov esi, eax
call fcn.0041e518
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4255ce
test edi, edi
je 0x4255ce
call esi
test eax, eax
je 0x4255c5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4255c5
test byte [ebp - 0xc], 1
jne 0x4255ce
or dword [ebp + 0x10], 0x200000
jmp 0x425607
mov eax, dword [0x44f1f4]
cmp eax, ebx
je 0x425607
push eax
call fcn.0041e518
pop ecx
test eax, eax
je 0x425607
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425607
mov eax, dword [0x44f1f8]
cmp eax, ebx
je 0x425607
push eax
call fcn.0041e518
pop ecx
test eax, eax
je 0x425607
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f1f0]
call fcn.0041e518
pop ecx
test eax, eax
je 0x425627
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425629
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x427432
Capabilities:
Encode data using xor

Disassembly:
pop ebp
clc
pushal
lea edi, [ebp + 0x42]
mov si, 0x256
cld
mov cl, byte [edi]
xor cl, 0x59
rol cl, 0xc4
xor cl, 0x18
mov byte [edi], cl
inc edi
dec si
jne 0x42743d
jmp 0x427495
fmul st(0)
fdivr dword [esi + 0x7d0c6bc0]
invalid
Function at 0x401530
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push edi
push 0
push 0x100000
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x6c]
push eax
push dword [edi + 0x14]
mov dword [edi + 0x1000f4], 2
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4015e8
call esi
cmp eax, 0x3e5
je 0x401612
call esi
cmp eax, 0x26
jne 0x401618
push edi
push 0
push 0
push dword [0x406380]
mov dword [edi + 0x1000f4], 6
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x4015c7
call esi
push eax
push str.read_next_block_0
push 0x4b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_ERROR:_post_queued_failed__d_n
call fcn.004014f0
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebp
ret
push str.read_next_block_0
push 0x4e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_EOF_Sent_n
call fcn.004014f0
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
ret
cmp eax, 1
jne 0x401618
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401612
push str.read_next_block_0
push 0x44
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_Read_file_continue..._n
call fcn.004014f0
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
ret
call esi
cmp eax, 0x6f8
je 0x40162a
call esi
cmp eax, 8
je 0x40162a
call esi
call esi
push eax
push str.read_next_block_0
push 0x57
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_read_next_block_ReadFile___u_n
call fcn.004014f0
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebp
ret
Function at 0x401650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
push esi
push edx
mov dword [ebx + 0x1000f4], eax
lea edi, [ebx + 0x6c]
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebx + 0xc], eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebx
push 0
push esi
push edi
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401701
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3e5
jne 0x4016c6
push str.write_block
push 0x81
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_Pending..._n
call fcn.004014f0
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
call esi
cmp eax, 0x6f8
je 0x4016d8
call esi
cmp eax, 8
je 0x4016d8
call esi
call esi
push eax
push str.write_block
push 0x94
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_ERROR:_write_block_WriteFile___u_n
call fcn.004014f0
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.write_block
test eax, eax
jne 0x401731
push 0x86
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_Success_without_pending..._n
call fcn.004014f0
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
push 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____d___s:_Write_file_continue..._n
call fcn.004014f0
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret