joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9cf596
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b7a88
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x9cf5cf
inc eax
mov dword [esi + 0x10], eax
jmp 0x9cf6e2
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x9cf5e3
mov eax, 0xffffffc7
jmp 0x9cf6e4
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x9cf5f4
cmp dword [esi + 8], eax
jne 0x9cf5e3
cmp dword [esi + 8], eax
jne 0x9cf60d
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x9cf60d
mov eax, 0xffffffc7
jmp 0x9cf6e4
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x9cf621
push eax
mov ecx, ebx
call fcn.009cedc6
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.009a47b6
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x9cf652
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.009a47d6
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.009ce536
test eax, eax
mov dword [esp + 0x38], eax
je 0x9cf685
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.MSVCRT.dll_strncpy
mov dword [esp + 0x10], 0x4c6988
call fcn.009a49b6
mov eax, dword [esp + 0x38]
jmp 0x9cf6e4
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.009cf3f6
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x9cf6c9
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.009cf416
mov esi, eax
test esi, esi
jne 0x9cf6f9
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.009cf3f6
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x9cf69b
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.MSVCRT.dll_strncpy
mov dword [esp + 0x10], 0x4c6988
call fcn.009a49b6
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.MSVCRT.dll_strncpy
mov dword [esp + 0x10], 0x4c6988
call fcn.009a49b6
mov eax, esi
jmp 0x9cf6e4
Function at 0x9dfe86
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b8378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [fcn.004ba570]
push 0
lea ecx, [esp + 0x20]
call fcn.00a22148
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.009df7e6
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00a22076
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00a1e96b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00a1e96b
push 1
push 0
push 0
mov ecx, esi
call fcn.00a1e913
push 1
push 0
push 1
mov ecx, esi
call fcn.00a1e913
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], reloc.MSVCRT.dll_strncpy
call fcn.00a221ba
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x9e0006
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b8398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00a22148
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.009df7e6
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00a22076
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [fcn.004ba570]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x9e00ca
cmp dword [esp + 0x40], 1
jne 0x9e00c8
cmp ecx, eax
jge 0x9e00ca
mov eax, ecx
cmp eax, 0xc8
jge 0x9e00d6
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.009dfe86
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [fcn.004ba56c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], reloc.MSVCRT.dll_strncpy
call fcn.00a221ba
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x9e08c6
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b8443
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00a1cda2
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x4c8418
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x4c8360
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [fcn.004ba050]
push eax
mov ecx, edi
call fcn.00a223f0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00a2390c
test eax, eax
je 0x9e09e2
mov ecx, dword [esp + 0x3c]
call fcn.00a2241d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [fcn.004ba590]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x9e09a6
push edi
mov ecx, esi
call fcn.00a1fa86
mov ecx, esi
call fcn.009e0b86
cmp dword [esp + 0x38], 1
jne 0x9e09db
or ecx, reloc.MSVCRT.dll_strncpy
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00a1fbc1
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x9e2bc6
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x9e2bf9
push esi
call fcn.009f0f96
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x9e2bf2
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x9e2c7f
mov eax, dword [esi + reloc.MSVCRT.dll_strncpy]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x9e2c68
mov eax, dword [esi + 8]
test eax, eax
je 0x9e2c1d
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + reloc.MSVCRT.dll_strncpy]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x9e2c64
cmp eax, 2
je 0x9e2c68
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x9e2c10
cmp eax, 3
je 0x9e2c43
cmp eax, 1
jne 0x9e2c10
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x9e2c10
mov edx, dword [esi + reloc.MSVCRT.dll_strncpy]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x9e2c10
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.009e2ca6
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x9e2c8e
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.009e2ca6
add esp, 4
pop esi
ret

Function at 0xa07ef6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb120
push 0x49c938
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], reloc.MSVCRT.dll_strncpy
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00a0bce6
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa08cd6
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.00a0c606
mov eax, dword [esp + reloc.MSVCRT.dll_strncpy]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push 0x4e6fc8
push ecx
call fcn.00a0d986
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [fcn.004ba27c]
mov esi, eax
cmp esi, reloc.MSVCRT.dll_strncpy
je 0xa08e83
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, reloc.MSVCRT.dll_strncpy
mov dword [esp + 0x14], eax
mov ebx, dword [fcn.004ba280]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, reloc.MSVCRT.dll_strncpy
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0xa08e83
mov ecx, dword [esp + reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp + reloc.MSVCRT.dll_strncpy]
push ecx
push 0
lea eax, reloc.MSVCRT.dll_strncpy
push edx
push eax
call fcn.00a08e96
mov ecx, dword [esp + reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp + reloc.MSVCRT.dll_strncpy]
push ecx
push 0
lea eax, reloc.MSVCRT.dll_strncpy
push edx
push eax
call fcn.00a08e96
mov ecx, dword [esp + reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp + reloc.MSVCRT.dll_strncpy]
push ecx
push 0
lea eax, reloc.MSVCRT.dll_strncpy
push edx
push eax
call fcn.00a08e96
mov ecx, dword [esp + reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp + reloc.MSVCRT.dll_strncpy]
push ecx
push 1
lea eax, reloc.MSVCRT.dll_strncpy
push edx
push eax
call fcn.00a08e96
mov ecx, dword [esp + reloc.MSVCRT.dll_strncpy]
add esp, 0x40
xor eax, eax
lea edi, reloc.MSVCRT.dll_strncpy
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, reloc.MSVCRT.dll_strncpy
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0xa08e83
mov edi, dword [esp + reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp + reloc.MSVCRT.dll_strncpy]
mov eax, dword [esp + reloc.MSVCRT.dll_strncpy]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp + reloc.MSVCRT.dll_strncpy]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [fcn.004ba368]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret

Function at 0xb51eb0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + reloc.MSVCRT.dll_strncpy], 0x8088405
inc edx
mov dword [ebx + reloc.MSVCRT.dll_strncpy], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0xb548f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
and eax, 0xff
add dword [reloc.MSVCRT.dll_strncpy], eax
imul eax, dword [reloc.MSVCRT.dll_strncpy], 0x8088405
inc eax
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
movzx ebx, al
xor bl, byte [0x5000f743]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
ret

Function at 0xb54964
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
pushal
mov byte [ebp - 1], 0
mov dword [reloc.MSVCRT.dll_strncpy], 0x12345678
mov dword [reloc.MSVCRT.dll_strncpy], 0x23456789
mov dword [reloc.MSVCRT.dll_strncpy], 0x34567890
movzx ecx, byte [0x5000f748]
test ecx, ecx
je 0xb549f1
xor esi, esi
mov dl, byte [esi + 0x5000f749]
call fcn.00b548f4
inc esi
cmp esi, ecx
jb 0xb54998
xor esi, esi
call fcn.00b5494c
xor byte [esi + 0x5000f724], al
mov dl, byte [esi + 0x5000f724]
call fcn.00b548f4
inc esi
cmp esi, 0xc
jb 0xb549aa
mov al, byte [0x5000f72f]
test word [0x5000f90e], 8
jne 0xb549e5
cmp al, byte [0x5000f919]
jne 0xb549f1
mov byte [ebp - 1], 1
jmp 0xb549f1
cmp al, byte [0x5000f913]
jne 0xb549f1
mov byte [ebp - 1], 1
popal
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0xb54a84
Capabilities:
Encode data using xor

Disassembly:
pushal
mov edi, dword [reloc.MSVCRT.dll_strncpy]
cmp dword [reloc.MSVCRT.dll_strncpy], edi
jae 0xb54a99
mov edi, dword [reloc.MSVCRT.dll_strncpy]
test edi, edi
je 0xb54ac4
sub dword [reloc.MSVCRT.dll_strncpy], edi
lea esi, reloc.MSVCRT.dll_strncpy
add esi, dword [reloc.MSVCRT.dll_strncpy]
add edi, esi
call fcn.00b5494c
xor byte [esi], al
mov dl, byte [esi]
call fcn.00b548f4
inc esi
cmp esi, edi
jb 0xb54ab1
popal
ret

Function at 0xb54ac8
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esi, reloc.MSVCRT.dll_strncpy
mov edi, esi
add edi, dword [reloc.MSVCRT.dll_strncpy]
call fcn.00b5494c
mov dl, byte [esi]
xor byte [esi], al
call fcn.00b548f4
inc esi
cmp esi, edi
jb 0xb54ad7
popal
ret
Function at 0xb552d4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
cmp byte [0x5000f840], 0
jne 0xb5533a
cmp dword [reloc.MSVCRT.dll_strncpy], 0
jle 0xb5533a
mov eax, dword [reloc.MSVCRT.dll_strncpy]
lea edx, reloc.MSVCRT.dll_strncpy
mov ecx, dword [reloc.MSVCRT.dll_strncpy]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
call fcn.00b53acc
test eax, eax
jge 0xb5533a
mov dword [reloc.MSVCRT.dll_strncpy], 5
push 0x50005b6c
push dword [0x5000f854]
push 0x50005b8c
mov eax, 0x5000f838
mov edx, 3
call fcn.00b52a44
ret
mov eax, dword [reloc.MSVCRT.dll_strncpy]
test eax, eax
je 0xb55376
add dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov esi, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
inc esi
cmp esi, dword [reloc.MSVCRT.dll_strncpy]
jb 0xb55356
mov dword [reloc.MSVCRT.dll_strncpy], eax
cmp dword [reloc.MSVCRT.dll_strncpy], 0x10000
jb 0xb553a7
mov esi, 0x5002a800
mov edi, esi
add esi, dword [reloc.MSVCRT.dll_strncpy]
sub esi, 0x8000
mov ecx, 0x8000
cld
rep movsb byte es:[edi], byte [esi]
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov dword [reloc.MSVCRT.dll_strncpy], 0
ret
Function at 0xb58150
Capabilities:
Encode data using xor

Disassembly:
cmp dword [reloc.MSVCRT.dll_strncpy], 0x8000
jle 0xb581b5
pushal
mov edx, dword [reloc.MSVCRT.dll_strncpy]
sub edx, 0x8000
mov esi, 0x5002a800
mov edi, esi
add esi, edx
mov ecx, 0x2000
cld
rep movsd dword es:[edi], dword [esi]
mov ebx, 0xffff
sub dword [ebx*4 + reloc.MSVCRT.dll_strncpy], edx
dec ebx
jns 0xb5817f
mov esi, edx
shl esi, 2
add esi, 0x50082b44
mov ebx, esi
add ebx, 0x20000
mov edi, 0x50082b44
cld
lodsd eax, dword [esi]
sub eax, edx
stosd dword es:[edi], eax
cmp esi, ebx
jb 0xb581a2
popal
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
sub eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
cmp dword [reloc.MSVCRT.dll_strncpy], 0x8000
jle 0xb581e5
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
lea edx, reloc.MSVCRT.dll_strncpy
mov ecx, dword [reloc.MSVCRT.dll_strncpy]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
call fcn.00b53af8
cmp eax, dword [reloc.MSVCRT.dll_strncpy]
je 0xb58232
mov dword [reloc.MSVCRT.dll_strncpy], 3
push 0x50008a38
push dword [0x5000f854]
push 0x50008a5c
mov eax, 0x5000f838
mov edx, 3
call fcn.00b52a44
ret
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
pushal
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov esi, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
inc esi
cmp esi, dword [reloc.MSVCRT.dll_strncpy]
jb 0xb58266
mov dword [reloc.MSVCRT.dll_strncpy], eax
popal
ret
Function at 0xb64368
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
call fcn.00b64348
lea esi, [eax + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0xb6437e
pop esi
ret

Function at 0xb67f98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, 0x100
push edi
or esi, ebx
nop
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp + 0x10], eax
mov ecx, esi
shr ecx, 7
mov edx, ebx
and edx, eax
and ecx, 1
mov eax, esi
shr eax, 8
add edx, ebx
push ecx
mov ecx, dword [ebp + 0xc]
add eax, edx
lea edi, [ecx + eax*2]
mov eax, dword [ebp + 8]
call fcn.00b67ef8
add esi, esi
mov edx, esi
xor edx, dword [ebp + 0x10]
not edx
and ebx, edx
cmp esi, 0x10000
jb 0xb67fa8
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0xb68048
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0xb68058
pop edi
pop ebx
ret

Function at 0xb68088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
push edi
or ecx, edx
add esi, esi
mov edi, edx
and edi, esi
add edi, edx
mov ebx, ecx
shr ebx, 8
add ebx, edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
shr edi, 4
sar ebx, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add ecx, ecx
mov edi, ecx
xor edi, esi
not edi
and edx, edi
cmp ecx, 0x10000
jb 0xb68099
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0xb68178
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 1
shl ebx, cl
xor eax, eax
or edx, ebx
cmp edx, 1
je 0xb681ab
mov ecx, edx
and edx, 1
shr ecx, 1
movzx ebx, word [edi + ecx*2]
neg edx
sar edx, 4
and edx, 0x7f
shr ebx, 4
xor ebx, edx
add eax, dword [esi + ebx*4]
mov edx, ecx
cmp edx, 1
jne 0xb68189
pop ebx
ret
Function at 0xb681b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0xb681fb
push ebx
push edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + edx*2]
mov ecx, esi
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add edx, edx
shr esi, 1
or edx, ecx
dec dword [ebp - 4]
jne 0xb681cd
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0xb6ad48
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
push 0
push 0
call fcn.00b6b7fc
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.00b6acf8
pop esi
pop ebp
ret 4
Function at 0x5cd86ea0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5cd932e8
push 0x5cd87d70
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x5cd942c4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [0x5cd94620], 0xfa0
mov dword [0x5cd9461c], ecx
mov dword [ebp - 4], 0
push 0x5cd94628
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5cd86f7c
cmp dword [ebp - 0xac], 6
jb 0x5cd86f73
mov byte [0x5cd94624], 1
call fcn.5cd86f80
mov dword [0x5cd94614], eax
cmp dword [ebp - 0xa0], 2
jne 0x5cd86f49
mov byte [0x5cd94618], 1
cmp dword [0x5cd9461c], 0
je 0x5cd86f7c
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.5cd87900
mov esp, ebp
pop ebp
ret
mov byte [0x5cd94624], 0
jmp 0x5cd86f2f
xor eax, eax
jmp 0x5cd86f57
Function at 0x5cd87b30
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x5cd87b6e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x5cd87b66
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x5cd87b70
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x5cd87b56
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5cd87c40
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x5cd87c71
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5cd87c71
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x5cd87c71
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret