joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c5bc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100c5bd1
pop dword [ebp - 0x34]
mov eax, 0x100c5bd1
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xfed70978
add dword [ebp - 0x44], 0x4f7b3bd3
mov dword [ebp - 0x40], 0x8aaa4dc9
sub dword [ebp - 0x40], 0x58770184
mov dword [ebp - 0x3c], 0x84a570ae
add dword [ebp - 0x3c], 0xc7a6d380
mov dword [ebp - 0x38], 0x3b2ae9bc
sub dword [ebp - 0x38], 0x3b2ae9bc
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xbe9267a
add dword [ebp - 0x44], 0x688942dc
mov dword [ebp - 0x40], 0x31b9fa9e
sub dword [ebp - 0x40], 0xf04d9929
mov dword [ebp - 0x3c], 0xeb231635
sub dword [ebp - 0x3c], 0x87b3a9c9
mov dword [ebp - 0x38], 0xa80cf42d
sub dword [ebp - 0x38], 0xa80cf42d
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xace42348
add eax, 0x6330ef54
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x71490
push 0
call eax
mov ecx, 0x41e7
mov edi, eax
mov ebx, 0xf8df11e9
sub ebx, 0xe8608fe9
add ebx, dword [ebp - 0x34]
mov esi, 0xbab766c4
add esi, 0xbdd69734
sub dword [ebp - 0x14], 0xd3040159
mov edx, dword [ebx]
xor dword [ebp - 0x1c], 0xb31cdd11
xor edx, esi
xor dword [ebp - 0x1c], 0x839b7c19
mov dword [edi], edx
xor dword [ebp - 0x24], 0x8f1d075d
add edi, 0xa422c3fc
sub edi, 0xa422c3f8
add ebx, 0xa63a2aa1
add ebx, 0x59c5d563
loop 0x100c5ce3
add eax, 0x97e8fa70
sub eax, 0x97e80001
mov ebx, eax
add eax, 0x767007c4
sub eax, 0x767007bf
mov ecx, 0x20233f78
add ecx, 0xefdcc088
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x101236a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1012373b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x101236f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x101236f2
cmp esi, ebx
jge 0x101236f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10123735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10123735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x10151aac]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x10151aac]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1012374d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10123970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d058c], 0
mov eax, dword [ebp + 8]
je 0x10123998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x101239b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100c5bc2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10143940
leave
ret 4

Function at 0x10123b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d058c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10123bb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10123c15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100c5bc2
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100c5bc2
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100c5bc2
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10143940
leave
ret 0x10
Function at 0x10123c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d058c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10123c5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10123c8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10123c8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100c5bc2
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10123c8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10143940
leave
ret 8
Function at 0x10132ac0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
xor ebx, ebx
inc edx
mov edi, dword [esi]
cmp dword [edi + 0x254], ebx
je 0x10132b20
cmp dword [edi + 0x264], ebx
je 0x10132b19
cmp byte [0x107d058c], 0
push edi
push dword [edi + 0x250]
je 0x10132b08
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x10132b0e
call dword [sym.imp.kernel32.dll_FindNextFileA]
mov ecx, dword [esi]
xor edx, edx
inc edx
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
jmp 0x10132c00
mov eax, dword [edi + 0x25c]
test eax, eax
je 0x10132c8f
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [esi]
cmp dword [ecx + 0x260], ebx
je 0x10132b6e
lea eax, [ebp - 0x234]
push eax
call fcn.100c5bc2
mov eax, dword [esi]
push dword [eax + 0x260]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov ecx, dword [esi]
add esp, 0xc
test byte [ecx + 0x268], 1
push 0x10
pop eax
lea edx, [eax + 0x70]
cmove eax, edx
mov dword [ecx], eax
cmp byte [0x107d058c], 0
je 0x10132b9a
push dword [esi]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x10132bbc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.100c5bc2
push dword [esi]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x250], eax
xor eax, eax
mov ecx, dword [esi]
cmp dword [ecx + 0x250], 0xffffffff
setne al
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10132bea
mov dword [eax + 0x250], ebx
mov eax, dword [esi]
xor edx, edx
inc edx
mov dword [eax + 0x254], edx
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10132c00
mov dword [esi + 4], edx
mov ecx, eax
cmp dword [eax + 0x264], ebx
je 0x10132c27
cmp byte [0x107d058c], 0
jne 0x10132c27
push dword [eax + 0x258]
add eax, 0x2c
push eax
call fcn.100c5bc2
mov ecx, dword [esi]
xor edx, edx
inc edx
mov eax, dword [ecx]
mov dword [ecx + 0x26c], eax
mov edi, dword [esi]
mov ebx, dword [edi + 0x26c]
shr ebx, 4
and ebx, edx
je 0x10132c5c
push esi
xor ebx, ebx
call fcn.100c5bc2
xor edx, edx
inc edx
cmp word [eax], 0x2e
je 0x10132c58
test byte [edi + 0x268], 3
jne 0x10132c66
mov ebx, edx
jmp 0x10132c66
test byte [edi + 0x268], 1
cmovne ebx, edx
mov eax, dword [edi + 0x264]
test eax, eax
je 0x10132c8a
push 0
test ebx, ebx
pop ebx
jne 0x10132ae0
test byte [edi + 0x26c], 2
jne 0x10132ae0
test eax, eax
setne al
jmp 0x10132c91
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10143940
leave
ret 4
Function at 0x10005520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000da70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.10001090
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test ebx, ebx
mov esi, eax
je 0x10005600
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push edx
mov edi, eax
mov dword [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString_1
mov bl, 1
push 0x5c
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::TrimRight
push 0x1002a390
lea ecx, [ebp + 0xc]
call sub.MFC42u.DLL_CString::operator
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push eax
call sub.MFC42u.DLL_CString::operator
lea ecx, [ebp + 0xc]
call sub.MFC42u.DLL_CString::MakeLower
mov ecx, dword [ebp + 0xc]
push 0x1001
push ecx
lea ecx, [ebp - 0x24]
call sub.MFC42u.DLL_CFile::CFile
mov edx, dword [ebp - 0x24]
push esi
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call dword [edx + 0x40]
lea ecx, [ebp - 0x24]
call sub.MFC42u.DLL_CFile::Flush
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.1000ca48
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.1000c796
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1000da9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x20]
xor edx, edx
mov ecx, eax
mov dl, ah
shr ecx, 0x10
and ecx, 0xff
and edx, 0xff
push ecx
and eax, 0xff
push edx
push eax
lea eax, [esp + 0x10]
push 0x1002a394
push eax
mov dword [esp + 0x28], 1
call sub.MFC42u.DLL_CString::Format
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.1000c796
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100056e0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x1000dab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_1
push 1
push 0x5c
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::Find_1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000575b
lea ecx, [esp + 8]
push esi
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::Left
mov eax, dword [eax]
push 0
push eax
call edi
lea ecx, [esp + 8]
call fcn.1000c796
inc esi
lea ecx, [esp + 0x1c]
push esi
push 0x5c
call sub.MFC42u.DLL_CString::Find_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x10005728
mov edx, dword [esp + 0x1c]
push 0
push edx
call edi
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call fcn.1000c796
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10005790
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1000dadb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
lea eax, [esp + 4]
push 0x104
push eax
call fcn.10001090
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_1
push str..pdf
push str..wbx64
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0
call sub.MFC42u.DLL_CString::Replace
push str..pdf
push str..wbx
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::Replace
push str..pdf
push str..uwbx
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::Replace
mov edx, dword [esp]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
mov dword [esp + 0x214], 0xffffffff
call fcn.1000c796
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x10008590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1000e268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call sub.MFC42u.DLL_CString::CString
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push esi
mov byte [esp + 0x2c], 2
call sub.MFC42u.DLL_CString::CString_1
push 0x5c
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call sub.MFC42u.DLL_CString::TrimRight
push 0x1002b2e8
lea ecx, [esp + 0x34]
call sub.MFC42u.DLL_CString::CString_4
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x2c], 4
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 3
call fcn.1000c796
push esi
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
push str.x.js
lea ecx, [esp + 0xc]
push esi
push ecx
mov ecx, edi
mov byte [esp + 0x34], 5
call sym.DownloadButton.uwbx_public:_class_CString___thiscall_CWebBuilderExtension::PrepareImagesFolder_unsigned_short_int_const___unsigned_short_int_const__
mov edx, dword [esp + 8]
mov byte [esp + 0x28], 6
mov eax, dword [edx - 8]
test eax, eax
je 0x10008665
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42u.DLL_CString::operator_1
mov ecx, dword [esp + 0xc]
push ecx
push 0x1002b2e0
push str.downloadbutton.min.js
call fcn.10005520
push esi
push 0x1002b2ac
push str.downloadbutton_getfile.php
call fcn.10005520
add esp, 0x18
lea ecx, [esp + 8]
mov byte [esp + 0x28], 5
call fcn.1000c796
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.1000c796
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.1000c796
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.1000c796
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call fcn.1000c796
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
call fcn.1000c796
mov ecx, dword [esp + 0x20]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x418f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420de0], ecx
add edx, 1
cmp edx, 0x100
jb 0x418f42
cmp edx, 0x800
jae 0x41902b
mov edi, edi
mov eax, dword [edx*4 + 0x4209e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420de0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x420ddc], eax
jb 0x419000
mov dword [0x420dbc], 0x4196e0
call fcn.00419170
test eax, eax
jne 0x419048
mov dword [0x420dbc], 0x419600
ret

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x4f2d348b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x1887449b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x5bd61de
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xb6468a0
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4304ab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4304ea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4304ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4304ea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4304ea
cmp dword [ecx + 0x74], 0xe
jbe 0x4304ea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x436068
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x436105
push ebx
push esi
call fcn.00436031
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00435fc5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4360b2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x436104
push edi
push eax
call fcn.004349cb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4360d2
call fcn.00434a19
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x436103
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00435fc5
add esp, 0x20
test eax, eax
jne 0x4360f1
push edi
call fcn.00434a19
jmp 0x4360f9
push ebx
call fcn.00434a19
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x437314
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43f0d8
push 0x43f0d0
push str.FlsAlloc
push 0x1f
call fcn.004371d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437348
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d134]
call esi
jmp 0x43734e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x437392
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43f0e8
push 0x43f0e0
push str.FlsGetValue
push 0x21
call fcn.004371d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4373c9
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4373d1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43f0f0
push 0x43f0e8
push str.FlsSetValue
push 0x22
call fcn.004371d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43740b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43d134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43c7d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43c7fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43c7fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000c010
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1001e298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, ecx
push esi
mov dword [esp + 0xc], ebp
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
xor ecx, ecx
mov dword [ebp + 0x94], eax
mov eax, dword [esp + 0x24]
cmp ebx, ecx
mov dword [esp + 0x18], ecx
mov dword [ebp], 0x10020650
mov dword [ebp + 0x88], 0x28
mov dword [ebp + 0x84], edx
mov byte [ebp + 0x8c], cl
mov dword [ebp + 0x90], ecx
mov dword [ebp + 0x98], eax
mov dword [ebp + 0x9c], ecx
jne 0x1000c0b3
push edi
push 9
call fcn.1001c850
mov ebx, eax
mov edi, 0x10028fd4
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 8], al
xor ecx, ecx
pop edi
mov eax, ecx
xor edx, edx
mov esi, 0xa
div esi
mov eax, ecx
and eax, 7
mov dl, byte [edx + 0x10028fc8]
xor dl, byte [eax + ebx]
inc ecx
cmp ecx, 0x28
mov byte [ecx + ebp + 3], dl
jb 0x1000c0b3
mov ecx, dword [esp + 0x10]
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10