joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b2030]
jne 0x40107a
repz ret
jmp fcn.00401ac1

Function at 0x409195
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bf5
and dword [ebp - 4], 0
cmp dword [0x4b4794], 0
mov ebx, eax
jne 0x409246
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092f7
push eax
call fcn.00404b83
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b4794], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b4798], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b479c], eax
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x4b47a4], eax
test eax, eax
je 0x409246
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x4b47a0], eax
mov eax, dword [0x4b47a0]
cmp eax, ebx
je 0x40929e
cmp dword [0x4b47a4], ebx
je 0x40929e
push eax
call fcn.00404bfe
push dword [0x4b47a4]
mov esi, eax
call fcn.00404bfe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40929e
test edi, edi
je 0x40929e
call esi
test eax, eax
je 0x409295
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409295
test byte [ebp - 0xc], 1
jne 0x40929e
or dword [ebp + 0x10], 0x200000
jmp 0x4092d7
mov eax, dword [0x4b4798]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4092d7
mov eax, dword [0x4b479c]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b4794]
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b010
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x4b2030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c9201c]
push ebx
mov ebx, dword [0x2c91e68]
push esi
mov esi, dword [0x4b2f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b051
push str.toxoporeh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c9201c]
mov dword [0x4b48f4], esi
cmp eax, 0x114e
jne 0x40b07b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.liyezejozonoduhu
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2c9201c]
cmp eax, 0x2f
jne 0x40b0b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
call fcn.0040af50
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401070
add esp, 0x428
ret
Function at 0x10003ebd
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov esi, ecx
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
je 0x10003fbd
cmp dword [eax + 8], ebx
je 0x10003fbd
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb edi, edi
neg edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10015970
test eax, eax
jne 0x10003f1b
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003ee7
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003ee7
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10003f62
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x10003f62
cmp dword [esi + 0x2c], ebx
jne 0x10003f62
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 8], ebx
cmp edi, ebx
je 0x10003fbd
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003fbd
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003f73
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 8]
push 0x3e8
push edi
mov dword [eax + 8], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003faf
mov dword [esi + 0x20], ebx
jmp 0x10003fbd
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.10023451
ret

Function at 0x10004070
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov ebx, ecx
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10015970
test eax, eax
jne 0x100040b5
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004084
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10004084
mov ecx, dword [ebx + 0x24]
xor eax, eax
cmp dword [ebp + 8], eax
sete al
inc eax
mov dword [ecx + 0x18], eax
mov edi, dword [ebx + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100040f1
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100040f1
mov ecx, ebx
call fcn.10003ebd
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004102
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10023451
ret 4
Function at 0x1000b950
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b971
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b96d
xor eax, eax
ret

Function at 0x1000b97f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b9a0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b99c
xor eax, eax
ret

Function at 0x10015970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001597f
pop dword [ebp - 8]
mov eax, 0xc1d93de7
add eax, 0x4e281b98
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xde874123
sub dword [ebp - 0x18], 0x9034fbd8
mov dword [ebp - 0x14], 0xa7175bd1
add dword [ebp - 0x14], 0x8b1bf074
mov dword [ebp - 0x10], 0xc50e46cf
sub dword [ebp - 0x10], 0x78c202a1
mov dword [ebp - 0xc], 0xb43439
add dword [ebp - 0xc], 0xff4bcbc7
lea eax, [ebp - 0x18]
push eax
mov eax, 0xbb9a9bb7
sub eax, 0xab982a2b
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xf9e9104b
add dword [ebp - 0x18], 0x7a89590b
mov dword [ebp - 0x14], 0x5398b6e2
sub dword [ebp - 0x14], 0x122c556d
mov dword [ebp - 0x10], 0x24eff203
add dword [ebp - 0x10], 0x3e7f7a69
mov dword [ebp - 0xc], 0x2d8e239a
add dword [ebp - 0xc], 0xd271dc66
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xcc8f1b68
add eax, 0x43735618
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x41f87
push 0
call eax
mov ecx, 0x4dba
mov esi, eax
mov edx, 0xf680a569
add edx, 0x1982f297
add edx, dword [ebp - 8]
mov ebx, 0x36949a3e
add ebx, 0x7343c914
add dword [ebp - 4], ecx
mov edi, dword [edx]
add dword [ebp - 4], 0x3bb68b88
xor edi, ebx
sub dword [ebp - 4], ecx
mov dword [esi], edi
xor dword [ebp - 4], ebx
add esi, 0xf1c8dcb2
add esi, 0xe372352
add edx, 0x1e5f2b8b
add edx, 0xe1a0d479
loop 0x10015a9b
add eax, 0xba52f475
sub eax, 0xba51caba
xor ebx, ebx
add ebx, eax
add eax, 0x3fc0eabe
add eax, 0xc03f1547
mov ecx, 0xff652db6
add ecx, 0x109ad24a
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1001cacd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
mov eax, 0x10025ac4
call fcn.100233e2
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
mov eax, edi
call fcn.10015970
pop ecx
test eax, eax
jne 0x1001cba6
mov eax, dword [edi + 4]
mov dword [ebp - 0x5c], eax
inc dword [eax + 0x38]
mov dword [ebp - 0x58], edi
inc dword [edi + 0x14]
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x54], eax
xor eax, eax
mov word [ebp - 0x4c], ax
mov word [ebp - 0x3c], ax
push 4
add edi, 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], edi
pop edi
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x52535048
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], ebx
call fcn.10015970
mov dword [ebp - 0x24], eax
xor eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 8
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x54]
push edi
push eax
mov dword [ebp - 0x20], 0x55524544
call fcn.10015970
or dword [ebp - 4], 0xffffffff
add esp, 0x18
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.1001bc6e
mov eax, esi
call fcn.10023465
ret
Function at 0x1001e1a1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10025ae9
call fcn.100233ac
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebx], esi
call edi
test eax, eax
jne 0x1001e2e2
cmp dword [ebp - 0x1c], 1
jne 0x1001e2e2
mov eax, dword [ebp - 0x14]
shr eax, 1
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10015970
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x1001e2d4
push dword [ebp - 0x14]
push esi
push eax
call fcn.10015970
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1001e2d4
cmp dword [ebp - 0x1c], 1
jne 0x1001e2d4
shr dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10015970
pop ecx
mov dword [ebx], eax
cmp eax, esi
je 0x1001e2d4
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push esi
push eax
call fcn.10015970
lea eax, [ebp - 0x20]
push eax
push 0x1002ac24
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_wcstok_s]
mov edi, eax
add esp, 0x18
cmp edi, esi
je 0x1001e2ba
push edi
call fcn.10015970
pop ecx
test al, al
je 0x1001e2ba
mov eax, dword [ebp - 0x14]
push edi
inc eax
push eax
push dword [ebx]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e2d4
push dword [ebx]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], esi
jmp 0x1001e2d4
cmp dword [ebp - 0x18], esi
je 0x1001e2e2
push dword [ebp - 0x18]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023451
ret
Function at 0x1001e2e8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x438
mov eax, 0x10025b04
call fcn.10023418
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call sub.MSVCR100.dll_memset
fldz
add esp, 0x18
fstp qword [ebp - 0x444]
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSoftGrid
mov ebx, 0x104
push 0x80000002
mov dword [ebp - 0x438], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e531
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x428], esi
push esi
jmp 0x1001e402
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll__wtof]
fldz
fcomp st(1)
pop ecx
fnstsw ax
test ah, 5
jp 0x1001e3e2
fld qword [ebp - 0x444]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x1001e3e2
lea eax, [ebp - 0x21c]
fstp qword [ebp - 0x444]
push eax
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e3e4
fstp st(0)
inc dword [ebp - 0x428]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
call edi
mov dword [ebp - 0x430], eax
cmp eax, esi
je 0x1001e39a
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x430], 0x103
jne 0x1001e531
mov ebx, dword [sym.imp.MSVCR100.dll_wcslen]
push str.ClientUserInterface
call ebx
mov edi, str.SoftwareMicrosoftSoftGrid_
push edi
mov dword [ebp - 0x430], eax
call ebx
mov ecx, dword [ebp - 0x430]
lea ebx, [ecx + eax + 0x105]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10015970
add esp, 0xc
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x1001e531
push ebx
push esi
push eax
call fcn.10015970
push edi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR100.dll_wcscat_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push dword [ebp - 0x428]
call edi
push str.ClientUserInterface
push ebx
push dword [ebp - 0x428]
call edi
add esp, 0x30
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e525
push dword [ebp - 0x434]
push str.LaunchCommand
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x43c]
push 0x1002ac28
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023474
ret
Function at 0x10021388
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100327bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100331a8], 0
jne 0x10021493
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 4
jbe 0x1002147d
cmp dword [ebp - 0x94], 5
je 0x1002143c
cmp dword [ebp - 0x94], 6
jne 0x10021489
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021430
dec eax
je 0x10021424
dec eax
je 0x10021418
dec eax
jne 0x10021489
mov dword [0x100331a8], 0x6b
jmp 0x10021493
mov dword [0x100331a8], 0x6a
jmp 0x10021493
mov dword [0x100331a8], 0x69
jmp 0x10021493
mov dword [0x100331a8], 0x68
jmp 0x10021493
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021471
dec eax
je 0x10021465
dec eax
je 0x10021459
mov dword [0x100331a8], 0x67
jmp 0x10021493
mov dword [0x100331a8], 0x66
jmp 0x10021493
mov dword [0x100331a8], 0x65
jmp 0x10021493
mov dword [0x100331a8], 0x64
jmp 0x10021493
mov dword [0x100331a8], 1
jmp 0x10021493
mov dword [0x100331a8], 0x6c
mov ecx, dword [ebp - 4]
mov eax, dword [0x100331a8]
xor ecx, ebp
call fcn.1002336a
leave
ret

Function at 0x1002336a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100327bc]
jne 0x10023374
repz ret
jmp fcn.10023b89

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x32001866
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3205cfc4]
jne 0x32001870
repz ret
jmp fcn.32043968

Function at 0x3201c775
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x3201c784
pop dword [ebp - 0x24]
mov eax, 0xe784a5b1
add eax, 0x4a7d21d3
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x19e7a1f6
sub dword [ebp - 0x34], 0xcb955cab
mov dword [ebp - 0x30], 0x16410068
add dword [ebp - 0x30], 0x1bf24bdd
mov dword [ebp - 0x2c], 0x77564860
add dword [ebp - 0x2c], 0xd4f5fbce
mov dword [ebp - 0x28], 0x1c9b130e
sub dword [ebp - 0x28], 0x1c9b130e
lea eax, [ebp - 0x34]
push eax
mov eax, 0x2bcb2f35
sub eax, 0xf9c69e89
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xf32817
add dword [ebp - 0x34], 0x737f413f
mov dword [ebp - 0x30], 0x545fdad4
sub dword [ebp - 0x30], 0x12f3795f
mov dword [ebp - 0x2c], 0xb3a81802
add dword [ebp - 0x2c], 0xafc7546a
mov dword [ebp - 0x28], 0xa0fc36ba
add dword [ebp - 0x28], 0x5f03c946
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xdca07028
sub eax, 0xaa9bdf88
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x476be
push 0
call eax
mov ecx, 0x4ac8
mov edx, eax
mov esi, 0xff83cb0
add esi, 0x220ec150
add esi, dword [ebp - 0x24]
mov ebx, 0x8fea0b04
sub ebx, 0x883bf8f3
xor dword [ebp - 8], 0x97e83b3c
mov edi, dword [esi]
add dword [ebp - 0x14], ebx
add edi, ebx
sub dword [ebp - 0xc], edx
mov dword [edx], edi
add edx, 4
add esi, 0xc1d5cbc9
sub esi, 0xc1d5cbc5
loop 0x3201c8a0
add eax, 0x2dc4f245
add eax, 0xd23c2bae
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x32000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x41db4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x41db5d
pop dword [ebp - 0x50]
mov eax, 0x13c50224
add eax, 0xec7cd939
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xf01699e4
sub dword [ebp - 0x60], 0xa1c45499
mov dword [ebp - 0x5c], 0x92d4da86
add dword [ebp - 0x5c], 0x9f5e71bf
mov dword [ebp - 0x58], 0x80135461
sub dword [ebp - 0x58], 0x33c71033
mov dword [ebp - 0x54], 0xcc166a60
add dword [ebp - 0x54], 0x33e995a0
lea eax, [ebp - 0x60]
push eax
mov eax, 0x2b2a1ae5
sub eax, 0x2ae7ba91
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4e972c2c
add dword [ebp - 0x60], 0x25db3d2a
mov dword [ebp - 0x5c], 0x47ed1f15
add dword [ebp - 0x5c], 0xf97f4260
mov dword [ebp - 0x58], 0xb2759494
add dword [ebp - 0x58], 0xb0f9d7d8
mov dword [ebp - 0x54], 0x534d1108
sub dword [ebp - 0x54], 0x534d1108
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4514e
push 0
call eax
mov ecx, 0xbf6f8510
sub ecx, 0xbf6f1fcc
xor edi, edi
add edi, eax
mov edx, 0xf4d57d20
add edx, 0xb6e6ce0
add edx, dword [ebp - 0x50]
mov esi, 0x61a227d4
sub esi, 0xbfc88cca
add dword [ebp - 0x10], ebx
mov ebx, dword [edx]
xor dword [ebp - 8], ecx
sub ebx, esi
sub dword [ebp - 0x24], 0x1158cf5f
mov dword [edi], ebx
sub dword [ebp - 0xc], ecx
add edi, 0x87b5b893
add edi, 0x784a4771
add edx, 0x36efa52c
sub edx, 0x36efa528
loop 0x41dc7c
add eax, 0x187e3
xor ebx, ebx
add ebx, eax
add eax, 0xfb060433
sub eax, 0xfb06042e
mov ecx, 0xb1550126
sub ecx, 0xb1150126
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10033ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x100a980
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x100a910]
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x1003428
mov ecx, dword [esi + 8]
cmp dword [eax + 4], ecx
je 0x10033e0
mov eax, dword [eax]
cmp eax, ebx
jne 0x10033d3
jmp 0x1003428
mov edx, dword [esi + 0x10]
lea edi, [eax + 8]
mov ecx, edi
cmp dword [ecx], edx
je 0x10033f7
inc ebx
add ecx, 8
cmp ebx, 8
jl 0x10033e8
jmp 0x10033fe
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jne 0x1003428
xor ecx, ecx
cmp dword [edi], 0
je 0x1003416
inc ecx
add edi, 8
cmp ecx, 8
jl 0x1003406
jmp 0x1003428
mov dword [eax + ecx*8 + 8], edx
mov edx, dword [esi + 4]
mov dword [eax + ecx*8 + 0xc], edx
mov dword [ebp - 4], 1
xor edi, edi
cmp dword [ebp - 4], edi
jne 0x1003478
push 0x48
call fcn.01003d0a
cmp eax, edi
pop ecx
je 0x1003478
mov ecx, dword [0x100a910]
mov dword [eax], ecx
mov dword [0x100a910], eax
mov ecx, dword [esi + 8]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push 0x1002fd8
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x1003478
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100a980
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret