joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f5c00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1022a800]
xor eax, ebp
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1023d130]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100f5c4e
mov eax, dword [ebp - 0x10]
sub eax, 5
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100f5c70
mov eax, 0xa
jmp 0x100f5d57
cmp dword [ebp + 0xc], 0
je 0x100f5cbc
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x10]
add ecx, 5
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 0xc]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100f5cba
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x1c]
mov byte [edx + 1], 0xf9
jmp 0x100f5cf8
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100f5ce3
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100f5cf8
push 5
mov edx, dword [ebp - 0xc]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 0xc]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x14], cl
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f7dfb
mov esp, ebp
pop ebp
ret
Function at 0x100f5dc0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1022a800]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x100f5efe
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100f5ef4
cmp dword [ebp - 0x20], 0x10
jb 0x100f5ed8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100f5ed8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100f5ed8
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100f5e68
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
push edx
push 0
mov eax, dword [0x1023cdbc]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100f5e66
jmp 0x100f5ef4
jmp 0x100f5eb8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100f5eb8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1023cdbc]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100f5ea2
jmp 0x100f5ef4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x20], 0x1c
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100f5e02
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f7dfb
mov esp, ebp
pop ebp
ret
Function at 0x100f6030
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100f5dc0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100f60cd
mov dword [ebp - 4], 0
jmp 0x100f6079
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100f60cd
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100f60cb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100f6400
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100f6070
mov esp, ebp
pop ebp
ret

Function at 0x100f6580
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100f65f4
mov dword [ebp - 4], 0
jmp 0x100f65a0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100f65e0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100f65de
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100f6597
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x1023cdbc]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esp, ebp
pop ebp
ret
Function at 0x100f6700
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1023d128]
mov dword [ebp - 4], eax
jmp 0x100f6718
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100f672e
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100f672c
mov eax, dword [ebp - 4]
jmp 0x100f67a9
jmp 0x100f6710
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100f67a6
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100f6768
mov edx, dword [ebp - 4]
mov eax, dword [0x1023d128]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1023d128], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100f6cb0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100f6cf9
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100f6cf9
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100f6cf9
xor eax, eax
jmp 0x100f6d3a
mov dword [ebp - 4], 1
jmp 0x100f6d0b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100f6d35
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100f6d33
xor eax, eax
jmp 0x100f6d3a
jmp 0x100f6d02
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100fe7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x100fe7e5
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x100fe84b
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x100fe844
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x100fe817
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x100fe806
jmp 0x100fe844
test edx, edx
jne 0x100fe820
mov dword [ebx + 0x54], ecx
jmp 0x100fe823
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100fe830
push esi
call eax
add esp, 4
push esi
call fcn.100fed40
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x100fe7f0
lea eax, [edi + 0x6c]
test eax, eax
je 0x100fe8ce
test ebp, ebp
je 0x100fe8ce
mov ebx, dword [eax]
test ebx, ebx
je 0x100fe8c1
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x100fe877
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x100fe88b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100fe89c
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x100fe860
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x100fe8e2
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.100fe740
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x100fe8fd
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x100fe92f
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x100fe91b
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x100fe92f
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x100fe956
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x10145430
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
xorps xmm0, xmm0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [ebp + 0x318]
movups xmmword [ebx], xmm0
push esi
movq qword [ebx + 0x10], xmm0
movzx ecx, word [ebp + 0x98]
mov eax, dword [ebp + 0x9c]
shl ecx, 4
add ecx, eax
push edi
cmp eax, ecx
jae 0x1014561d
cmp dword [eax], 0x42444620
jne 0x10145475
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x10145489
add eax, 0x10
cmp eax, ecx
jb 0x10145466
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x14
ret
push dword [eax + 8]
mov edi, dword [esp + 0x30]
push edi
call fcn.100fdb90
add esp, 8
test eax, eax
jne 0x1014561d
cmp esi, 8
jb 0x1014561d
push ebx
push esi
push edi
call fcn.100fd2a0
add esp, 0xc
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1014561d
mov eax, dword [ebx]
lea ecx, [eax + esi]
mov dword [ebp + 0x31c], ecx
mov ecx, eax
movzx edi, byte [ecx + 2]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 5]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 4]
shl eax, 8
or edx, eax
movzx eax, byte [ecx + 6]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 7]
movzx ecx, byte [ecx + 1]
shl edx, 8
or edx, eax
mov eax, dword [ebx]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
cmp ecx, 1
jne 0x10145605
cmp edx, 8
jb 0x10145605
lea eax, [edx - 8]
shr eax, 2
cmp eax, edi
jb 0x10145605
lea eax, [edx + 1]
cmp eax, esi
ja 0x10145605
mov eax, dword [ebx]
sub esi, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [ebp + 0x328], edi
mov dword [ebp + 0x324], esi
lea ecx, [eax + edx]
mov dword [ebp + 0x320], ecx
lea edx, [eax + 8]
lea eax, [edx + edi*4]
mov dword [esp + 0x10], eax
cmp edi, 2
jb 0x101455c1
lea esi, [edi - 2]
xor ebx, ebx
shr esi, 1
inc esi
xor ebp, ebp
movzx ecx, byte [edx + 2]
sub edi, 2
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
movzx ecx, byte [edx + 6]
lea ebx, [ebx + eax*2]
shl ecx, 8
movzx eax, byte [edx + 7]
add edx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea ebp, [ebp + eax*2]
sub esi, 1
jne 0x10145575
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov esi, dword [ebp + 0x320]
lea ebx, [ebp + 0x318]
jmp 0x101455c3
mov esi, ecx
test edi, edi
je 0x101455e0
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea edx, [edx + eax*2]
jmp 0x101455e4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
add eax, edx
cmp eax, esi
ja 0x10145605
mov eax, dword [esp + 0x20]
pop edi
pop esi
mov byte [ebp + 0x32c], 1
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
push dword [esp + 0x30]
call fcn.100fdb50
xorps xmm0, xmm0
add esp, 8
movups xmmword [ebx], xmm0
movq qword [ebx + 0x10], xmm0
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x408936
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
or edx, edx
add ecx, ecx
call fcn.00408959
add ecx, ecx
sub edx, 0x7bcf29b5
xor dword [ebx], edi
or ecx, edx
inc ebx
cmp ebx, esi
jne fcn.00408936
dec ecx
ret
Function at 0x4327c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
jmp 0x4327da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4327e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4327d0
mov eax, 1
add ebx, ebx
jne 0x4327f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4327e8
jne 0x432804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4327e8
xor ecx, ecx
sub eax, 3
jb 0x432818
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43288a
mov ebp, eax
add ebx, ebx
jne 0x432823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x432830
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x432854
inc ecx
add ebx, ebx
jne 0x432840
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x432835
jne 0x432851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x432835
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x432874
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x432865
jmp 0x4327d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x432874
add edi, ecx
jmp 0x4327d6
pop esi
mov edi, esi
mov ecx, 0x438
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x432892
cmp byte [edi], 0xa
jne 0x432892
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x432897
lea edi, [esi + 0x30000]
mov eax, dword [edi]
or eax, eax
je 0x432906
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3203c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4328c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x32044]
or eax, eax
je 0x432900
mov dword [ebx], eax
add ebx, 4
jmp 0x4328e1
call dword [esi + 0x32040]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x432937
cmp al, 0xef
ja 0x43292a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x43290c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x432919
mov ebp, dword [esi + 0x32048]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43296b
sub esp, 0xffffff80
jmp 0x409c3c
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x4534d2
push 0x14
push 0x4744a0
call fcn.00453860
push 1
call fcn.004530b8
pop ecx
test al, al
jne 0x453389
push 7
call fcn.00453b7c
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00453083
mov byte [ebp - 0x24], al
mov eax, dword [0x8a35a4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x453382
test eax, eax
jne 0x4533f3
mov dword [0x8a35a4], ecx
push 0x465420
push 0x465408
call fcn.004591fa
pop ecx
pop ecx
test eax, eax
je 0x4533d6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4534cc
push 0x465404
push 0x4653b0
call fcn.0045919e
pop ecx
pop ecx
mov dword [0x8a35a4], 2
jmp 0x4533f8
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00453212
pop ecx
call fcn.00453e6a
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x453428
push esi
call fcn.00453188
pop ecx
test al, al
je 0x453428
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00453857
call esi
call fcn.00453e70
mov esi, eax
cmp dword [esi], edi
je 0x453446
push esi
call fcn.00453188
pop ecx
test al, al
je 0x453446
push dword [esi]
call fcn.0045860a
pop ecx
call fcn.00453c97
movzx eax, ax
push eax
call fcn.0045914b
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00453cca
test al, al
jne 0x453471
push esi
call fcn.00458642
test bl, bl
jne 0x45347a
call fcn.004585e5
push edi
push 1
call fcn.0045322f
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4534cc
call fcn.004538a6
ret
call fcn.00453d63
jmp 0x45336a
Function at 0x402810
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
shr edi, 2
xor edx, edx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
add eax, 3
mov dword [ecx], eax
add ecx, 0x10
test edi, edi
je 0x402845
mov eax, dword [esi]
lea esi, [esi + 4]
mov dword [ecx + edx*4], eax
inc edx
cmp edx, edi
jb 0x402838
mov ebx, dword [ecx + edi*4 - 4]
lea eax, [edi + 0xe]
lea eax, [edi + eax*2]
lea esi, [ecx + eax*4]
mov dword [ebp + 8], esi
xor esi, esi
mov eax, dword [ebp + 8]
nop word [eax + eax]
test esi, esi
jne 0x4028c1
movzx eax, bl
mov esi, dword [ebp - 4]
movzx edx, byte [eax + 0x465440]
mov eax, ebx
shr eax, 0x18
shl edx, 8
movzx eax, byte [eax + 0x465440]
or edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 8
shl edx, 8
movzx eax, byte [eax + 0x465440]
or edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x465440]
mov eax, 0x1b
xor ebx, esi
add esi, esi
or ebx, edx
test esi, 0x100
cmovne esi, eax
mov dword [ebp - 4], esi
mov esi, edi
jmp 0x40290e
cmp esi, 4
jne 0x402911
cmp edi, 6
jbe 0x402911
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x465440]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x465440]
shl eax, 8
or edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x465440]
or edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x465440]
or ebx, edx
mov eax, dword [ebp + 8]
xor ebx, dword [ecx]
dec esi
mov dword [ecx + edi*4], ebx
add ecx, 4
cmp ecx, eax
jne 0x402860
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4044d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x404503
call fcn.004042d0
test eax, eax
je 0x404503
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.004042b0
mov eax, dword [ebp - 8]
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x404550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x404566
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.004042d0
cmp eax, 7
jb 0x404560
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.004042b0
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4047f0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x89f674]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x404839
push str.SetDefaultDllDirectories
push 0x4655d0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404839
push 0xc00
call eax
test eax, eax
jne 0x4048d7
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4048d7
cmp eax, 0x104
ja 0x4048d7
cmp word [ebp + eax*2 - 0x2d6], 0x5c
je 0x404877
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x4048d6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov al, byte [esi]
mov ecx, edi
inc esi
test al, al
je 0x4048b0
movzx eax, al
mov word [ecx], ax
add ecx, 2
mov al, byte [esi]
inc esi
test al, al
jne 0x4048a0
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
cmp byte [esi], 0
jne 0x404897
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452a82
mov esp, ebp
pop ebp
ret