joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002789
Capabilities:
Create directory
Delete directory
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x100a028]
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_SetErrorMode]
push edi
xor ebx, ebx
push ebx
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x7c], ebx
call esi
mov dword [ebp - 0x80], eax
or eax, 1
push eax
call esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edi, eax
mov dword [ebp - 0x78], ebx
xor edx, edx
mov ecx, 0xf4240
mov eax, edi
div ecx
lea eax, [ebp - 0x74]
push edx
push dword [ebp + 0x9c]
push 0x10021fc
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
push ebx
lea eax, [ebp - 0x74]
push eax
inc edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x1002816
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002838
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 0x3e8
jl 0x10027c7
jmp 0x1002838
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1002831
push 4
push ebx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.kernel32.dll_MoveFileExA]
mov dword [ebp - 0x7c], 1
push dword [ebp - 0x80]
call esi
mov ecx, dword [ebp + 0x90]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
pop ebx
call fcn.01005d91
add ebp, 0x94
leave
ret 4

Function at 0x1002858
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xbac]
sub esp, 0xc2c
mov eax, dword [0x100a028]
mov dword [ebp + 0xba8], eax
push 0x208
lea eax, [ebp + 0x9a0]
push eax
mov byte [ebp - 0x61], 0
mov dword [ebp - 0x70], 0x100
mov dword [ebp - 0x7c], 0x400
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100295f
push edi
lea edi, [ebp + 0x9a0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10028a5
push esi
mov esi, 0x1002254
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x9a0]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100295d
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x1002248
push edi
call esi
test eax, eax
mov dword [ebp - 0x74], eax
je 0x1002956
push 0x1002238
push edi
call esi
test eax, eax
mov dword [ebp - 0x78], eax
je 0x1002956
push ebx
push 0x1002224
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x1002955
push 0x1002208
push edi
call esi
test eax, eax
mov dword [ebp - 0x68], eax
je 0x1002955
lea eax, [ebp - 0x6c]
push eax
push 0
call ebx
test eax, eax
jne 0x1002955
cmp dword [ebp - 0x6c], 0x13
jne 0x1002955
push eax
call dword [ebp - 0x74]
mov esi, eax
test esi, esi
je 0x1002955
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x7a0]
push eax
push esi
call dword [ebp - 0x68]
test eax, eax
jne 0x1002951
mov al, byte [ebp - 0x60]
mov byte [ebp - 0x61], al
push esi
call dword [ebp - 0x78]
pop ebx
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
pop esi
pop edi
mov ecx, dword [ebp + 0xba8]
mov al, byte [ebp - 0x61]
call fcn.01005d91
add ebp, 0xbac
leave
ret
Function at 0x1002baa
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x100ad40
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x100a184]
test eax, eax
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
je 0x1002bd2
push eax
call esi
and dword [0x100a184], 0
mov eax, dword [0x100a024]
cmp eax, 0xffffffff
je 0x1002be6
push eax
call esi
or dword [0x100a024], 0xffffffff
mov esi, dword [0x100a008]
mov ebp, dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, dword [sym.imp.kernel32.dll_MoveFileExA]
mov edi, 0x100a008
jmp 0x1002c2c
mov eax, dword [esi + 4]
test eax, eax
je 0x1002c2a
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x1002c26
call ebp
cmp eax, 2
je 0x1002c26
cmp eax, 3
je 0x1002c26
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002bff
mov esi, dword [0x100a010]
mov edi, 0x100a010
jmp 0x1002c6a
mov eax, dword [esi + 4]
test eax, eax
je 0x1002c68
push eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1002c64
call ebp
cmp eax, 2
je 0x1002c64
cmp eax, 3
je 0x1002c64
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002c3d
push 0x100ad40
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1002df6
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
je 0x1002e20
push esi
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x100a1a0]
inc ecx
dec edx
jne 0x1002e08
pop edi
pop esi
ret 0xc
Function at 0x10034d4
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 0xc]
push esi
xor esi, esi
inc esi
cmp byte [eax], 0
je 0x10034f2
push dword [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
jne 0x10034f2
xor esi, esi
mov eax, dword [esp + 0x14]
cmp byte [eax], 0
je 0x100350e
push 1
push dword [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_MoveFileExA]
test eax, eax
jne 0x100350e
xor esi, esi
mov eax, esi
pop esi
ret 0x10

Function at 0x1003518
Capabilities:
Query environment variable
Set environment variable
Write file on windows

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push 0x1002388
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10035e3
push esi
mov esi, 0x100afa0
push esi
push 0x1002378
push 0x100ad60
call fcn.01002a1f
push ebx
push 0x4000002
push 1
push ebx
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [0x100a024], edx
je 0x10035e2
push ebp
push edi
mov ebp, 0x100a5a0
xor eax, eax
push ebx
mov ecx, 0xc5
mov edi, ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
mov edi, 0x314
push edi
push ebp
push edx
mov dword [0x100a5a0], 0x6e776453
mov dword [0x100a5a4], 0x10000
mov dword [0x100a5a8], 0xc0000013
mov byte [0x100a7b0], bl
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x10035cd
cmp dword [esp + 0x10], edi
jne 0x10035cd
push esi
push 0x1002388
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
jmp 0x10035e0
push dword [0x100a024]
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [0x100a024], 0xffffffff
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x1004188
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, esi
xor ebx, ebx
push edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1004199
push 0x2e
push esi
call dword [sym.imp.msvcrt.dll_strrchr]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1004206
push 0x10024b4
push edi
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x1004206
xor ebx, ebx
inc ebx
mov eax, dword [0x101b0c8]
xor edx, edx
mov ecx, 0x3e8
div ecx
inc dword [0x101b0c8]
push edx
push 0x10024ac
push edi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10041c9
push esi
push 0x100a008
call fcn.01004163
jmp 0x1004209
mov byte [esi], 0
pop edi
pop esi
mov eax, ebx
pop ebx
ret 8
Function at 0x1005d91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a028]
jne 0x1005d9a
ret
jmp 0x1005d9f
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100a028]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x101b0cc]
test eax, eax
je 0x1005dc3
call eax
cmp dword [0x101b0d0], 0
je 0x1005e0a
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x101b0d0]
pop edi
push 0x502
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005d91
add ebp, 0x2a8
leave
ret

Function at 0x100702b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007066
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007043
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007082
dec esi
je 0x100707b
dec esi
jne 0x1007087
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x100832f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x100833e
pop dword [ebp - 0x3c]
mov eax, 0x5e41847f
sub eax, 0x5d410141
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x69f957b0
sub dword [ebp - 0x4c], 0x1ba71265
mov dword [ebp - 0x48], 0x11f58ebf
add dword [ebp - 0x48], 0x203dbd86
mov dword [ebp - 0x44], 0xaf13f4d4
add dword [ebp - 0x44], 0x9d384f5a
mov dword [ebp - 0x40], 0xec073269
sub dword [ebp - 0x40], 0xec073269
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x6a8eccf4
sub eax, 0x698eabf0
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x3c3a5d4e
sub dword [ebp - 0x4c], 0xc7c7f3f8
mov dword [ebp - 0x48], 0x958dc97e
add dword [ebp - 0x48], 0xabde97f7
mov dword [ebp - 0x44], 0xcafb9da2
add dword [ebp - 0x44], 0x9873ceca
mov dword [ebp - 0x40], 0xb3f23d0
add dword [ebp - 0x40], 0xf4c0dc30
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xcbc7b8b9
add eax, 0x35386873
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34378
push 0
call eax
mov ecx, 0xc80e713f
sub ecx, 0xc80e33f4
xor ebx, ebx
add ebx, eax
mov edi, 0x3b091e81
sub edi, 0x39dc3a81
add edi, dword [ebp - 0x3c]
mov edx, 0xce2eadbe
add edx, 0x63cf1e70
xor dword [ebp - 0x14], 0xd942e7b9
mov esi, dword [edi]
mov dword [ebp - 4], 0x42ef5416
xor esi, edx
xor dword [ebp - 0x30], eax
mov dword [ebx], esi
add dword [ebp - 0x1c], 0x8e97a24a
add ebx, 0xe62fe6e1
sub ebx, 0xe62fe6dd
add edi, 4
loop 0x1008462
add eax, 0x1f0e627e
sub eax, 0x1f0d7a7f
mov ebx, eax
add eax, 5
mov ecx, 0x26976fd0
sub ecx, 0x25976fd0
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403203
pop dword [ebp - 0xc]
mov eax, 0x4dd3c26a
sub eax, 0x4d939067
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x79bff9dd
add dword [ebp - 0x1c], 0xd4924b6e
mov dword [ebp - 0x18], 0xb8d01625
add dword [ebp - 0x18], 0x79633620
mov dword [ebp - 0x14], 0xc0f945d1
sub dword [ebp - 0x14], 0x74ad01a3
mov dword [ebp - 0x10], 0x9eaa7887
sub dword [ebp - 0x10], 0x9eaa7887
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x10811b39
sub eax, 0x1040aad5
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5e4ea1e4
add dword [ebp - 0x1c], 0x1623c772
mov dword [ebp - 0x18], 0x4caefca2
add dword [ebp - 0x18], 0xf4bd64d3
mov dword [ebp - 0x14], 0x724f9e0a
add dword [ebp - 0x14], 0xf11fce62
mov dword [ebp - 0x10], 0x4d7b7cfc
sub dword [ebp - 0x10], 0x4d7b7cfc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xa2b345d1
add eax, 0x5d8d2ad7
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x363d1
push 0
call eax
mov ecx, 0x4694
xor ebx, ebx
add ebx, eax
mov esi, 0xf0463a6b
add esi, 0xffac595
add esi, dword [ebp - 0xc]
mov edi, 0x70db79c1
add edi, 0x9cd96b76
sub dword [ebp - 8], 0x99ecafc6
mov edx, dword [esi]
add dword [ebp - 8], 0x2791719e
xor edx, edi
add dword [ebp - 4], 0x46045ba1
mov dword [ebx], edx
sub dword [ebp - 4], 0xf77b2ad3
add ebx, 4
add esi, 0x7e61b83
add esi, 0xf819e481
loop 0x403321
add eax, 0x2a0c8def
sub eax, 0x2a0b80cc
mov ebx, eax
add eax, 5
mov ecx, 0xa35b3ee2
sub ecx, 0xa31b3ee2
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1006bccf
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edi
mov eax, 0x3b3ccb16
rdtsc
push ebx
add dx, 0xd67
jmp 0x1006bd02
mov dx, bx
btr ecx, ebp
rdtsc
bt edx, edi
mov ecx, 0x7cc18ed6
jmp 0x1006bcb9
lea edi, [edi + 0x5f]
rdtsc
clc
sub esp, 4
bsf cx, di
xchg dword [esp + 8], edi
jmp 0x1006bd62
rdtsc
rdtsc
mov ecx, dword [esp]
bt dx, di
mov ecx, dword [esp]
push dword [esp + 8]
ret 0xc

Function at 0x1006fa28
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
call 0x1006f8d6
Function at 0x10070936
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x5b284
jmp 0x10070994
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x10070954
pushfd
jmp 0x1006fda6
xchg al, bh
mov di, word [esp]
bswap esi
jmp 0x10070978

Function at 0x101cc808
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts dx, ax
neg bx
shr ebx, 5
mov ch, dl
pop cx
jmp 0x101cc847
lea ebx, [esp + ebx]
pushfd
stc
pop si
pop word [esp]
setge al
jmp 0x101cc829

Function at 0x101cc9b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp]
dec dh
sete ah
ror bx, cl
xchg edi, ebx
neg bh
jmp 0x101cc9a1
add esp, 9
cpuid
lea esi, [esi - 0xb0]
xchg byte [esp + 1], ch
jmp 0x101cc977
sub esp, 1
neg dx
cld
push cx
neg ah
call 0x101cc9b2
xchg bx, cx
jmp 0x101cc9df
bswap ebx
rcl ah, 2
lea ebx, [edi*4]
stc
mov di, 0x7edc
bswap ecx
jmp 0x101ccad6
mov eax, dword [esp]
mov al, dh
xchg di, bx
ror edx, cl
rdtsc
bswap ecx
jmp 0x101cca24
mov ebp, 0x816800fa
or ax, 0xe41c
cmc
sub esp, 0x10
mov ch, 0x4a
jmp 0x101cca5b
mov ecx, 0x9dd4dd75
mov ebp, 0x7fb7e07f
lea eax, reloc.USER32.dll_wsprintfW
mov si, word [esp]
lea esi, reloc.USER32.dll_wsprintfW
xchg bp, di
jmp 0x101cca10
xchg byte [esp + 7], bl
setne dl
mov bx, word [esp + 3]
mov bl, 0x8a
cpuid
mov bl, byte [esp + 0xe]
jmp 0x101ccaad
xchg ah, ch
setns al
push word [esp]
pop ebp
mov ecx, edx
bsr dx, cx
jmp 0x101cca3c
mov bh, byte [esp + 4]
mov word [esp], bp
pop esi
cmc
bsr edx, edi
jmp 0x101ccb9b
push word [esp + 0xf]
cpuid
pop dword [esp]
cpuid
pop dword [esp + 1]
pop dword [esp]
jmp 0x101cca97
pop ebx
pop ebx
mov cl, 0x48
not cx
lea ecx, [eax*4]
cmp al, 0x10
jmp 0x101cca85
mov bx, 0x5892
mov ch, 9
xchg dword [esp], edx
lea ecx, [edi + ebp]
neg dh
pop edx
jmp 0x101ccb65
bswap eax
cld
or bx, cx
bswap edi
push esi
mov ebp, dword [esp + 3]
jmp 0x101ccae8
not cl
lea ecx, [edx + edi]
mov ax, dx
lea ebx, reloc.USER32.dll_wsprintfW
stc
pop edi
jmp 0x101ccafe
push cx
cmp cl, ah
lea ecx, [ecx + 0xb6]
dec si
setp dl
jmp 0x101ccb78
push dword [esp + 4]
cpuid
mov eax, 0xc2d27a0b
lea esp, [esp + 9]
clc
ror ch, 3
jmp 0x101ccb2d
mov ecx, eax
push edi
push word [esp + 1]
add edi, ecx
mov ah, byte [esp + 1]
mov di, dx
jmp 0x101ccb43
bts esi, edi
xchg dl, ch
mov bp, word [esp + 1]
rdtsc
mov bl, ah
xchg esi, eax
jmp 0x101ccc78
push word [esp + 1]
xchg edx, ebp
xchg ecx, eax
mov eax, dword [esp]
or di, 0xfbea
setae ah
jmp 0x101ccb1b
mov esi, 0x3a3cd5ba
lea ebx, [ecx*4]
call fcn.101ccbdb
shl dh, cl
shl cl, cl
mov dl, 0x70
sub esp, 0x17
lea esp, [esp + 0x42]
rdtsc
jmp 0x101cccd5
std
mov edi, dword [esp]
call fcn.101cce4c
mov byte [0x32c7a032], al
xchg ebp, eax
mov al, byte [0x31c2a737]
into
stosb byte es:[edi], al
mov bp, word [esp]
mov dh, byte [esp]
push bx
bswap ebx
mov eax, 0xb1faa69f
mov bx, 0x713e
jmp 0x101cccbf
Function at 0x101ccbdb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, reloc.USER32.dll_wsprintfW
cld
mov dx, word [esp + 0xb]
cld
mov dh, bh
sub esp, 0x1b
jmp 0x101ccc31
sub esp, 0x13
bswap ebp
rcl bh, 2
cpuid
jmp 0x101ccbb3
btr bx, bp
mov si, 0x5e2e
cld
mov ecx, dword [esp + 0x1a]
jmp 0x101ccc10
cpuid
neg bx
pop di
mov ax, 0x4eaa
sub esp, 0xf
rcr ch, 7
jmp 0x101ccbe7
xchg byte [esp + 0x13], bh
pop dword [esp + 6]
not cx
bsf ebx, esp
mov word [esp + 0x13], cx
xchg byte [esp + 0x13], dh
jmp 0x101ccc5c
popal
xchg byte [esp + 0xa], ch
mov dx, word [esp + 0x12]
mov dh, byte [esp + 0xa]
setge cl
xchg edx, eax
jmp 0x101ccbfd
mov cx, 0xe868
mov cx, 0x4ab4
add esp, 0
mov bh, 0x37
cmp cx, ax
jmp 0x101ccca5
lea edi, [edi*4]
mov al, 0x46
pop cx
rdtsc
mov byte [esp + 4], al
xchg word [esp + 3], bx
jmp 0x101ccc46
mov word [esp + 0x15], si
xchg byte [esp + 0x16], al
mov ah, byte [esp + 0x10]
lea ebx, [ecx + esi]
sub esp, 0xf
mov word [esp + 0x22], sp
jmp 0x101ccc89

Function at 0x101d3dae
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ebx, dword [esp + 9]
add esp, 8
push esp
neg dl
push edx
jmp 0x101d3db6
mov ecx, 0x8cbb456d
push word [esp + 8]
mov esi, dword [esp + 0xf]
jmp 0x101d3e73
bswap esi
xchg dword [esp + 8], esi
jmp 0x101d3d88
btc esi, ecx
mov ax, 0x7dfd
mov dword [esp + 0xd], edx
mov dword [esp + 0xb], edx
mov eax, 0xd1f344c0
cpuid
jmp 0x101d3d97
rol ebp, cl
pop dword [esp + 0xf]
push word [esp + 0xe]
xchg al, dl
jmp 0x101d3e2c
dec ch
mov ax, word [esp + 0xc]
sub esp, 0xa
mov ebp, 0x47295038
pushfd
lea ebp, [esi + edi]
jmp 0x101d3deb
mov bx, word [esp + 0x16]
cmp eax, 0x4f31bc9d
call fcn.101d3e16
jge 0x101d3e31
push 0xd
cld
adc esp, dword [ecx - 0x60]
jecxz 0x101d3e5f
lea ecx, [ebx - 0x92]
mov bx, 0xa21a
pop dword [esp + 0xb]
pop dword [esp + 2]
mov byte [esp + 8], dh
lea ecx, [eax + ebp]
jmp 0x101d3e01
mov eax, dword [reloc.USER32.dll_wsprintfW]
call dword [ebx]
imul esp, esi, 0xcee1374
cdq
sbb ecx, dword [ebx - 0x10fe212]
lea esp, [esp + 0xa]
btc ecx, edx
push dword [esp + 8]
push word [esp + 7]
rdtsc
mov ch, byte [esp + 0xb]
jmp 0x101d3e45

Function at 0x101d4097
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x101d40eb
mov word [esp + 2], sp
dec edi
push dword [esp + 3]
cpuid
mov bp, 0x7ebe
pushal
jmp 0x101d40d5

Function at 0x101d44eb
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101cc6bb
push dword [esp + 2]
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 0x4c], esi
jmp 0x101d4520
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0x101d4534
push cx
mov byte [esp], cl
mov byte [esp], al
lea esp, [esp]
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x101d450a
mov eax, dword fs:[0x30]
jmp 0x101d4571
mov eax, dword [eax + 8]
jmp 0x101d4591
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x101d455b
push eax
jmp 0x101cc6b6
Function at 0x408bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add dword [ebp + 8], 1
call sub.KERNEL32.DLL_GetCommandLineA
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push eax
call fcn.00408f00
cmp eax, 0
jb 0x408be5
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0
je 0x408bde
mov eax, 1
jmp 0x408bef
mov eax, 2
jmp 0x408bef
cmp eax, 0xffffffff
jne 0x408bef
mov eax, 3
leave
ret 8
Function at 0x40b1b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push edi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], bl
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x41
mov byte [ebp - 0x30], 0x64
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x70
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x73
mov byte [ebp - 0x29], 0x41
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x73
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], bl
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x40b2d2
push esi
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x40b2c8
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
call esi
cmp eax, 0x6f
jne 0x40b2c8
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40b2c8
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push ebx
push ebx
call esi
test eax, eax
jne 0x40b2be
mov edi, dword [ebp - 8]
mov esi, dword [edi + 0x1c]
jmp 0x40b2b1
push dword [esi + 0xc]
push dword [ebp + 8]
call fcn.0040a476
mov esi, dword [esi + 8]
cmp esi, ebx
jne 0x40b2a3
mov edi, dword [edi + 8]
cmp edi, ebx
jne 0x40b29e
xor edi, edi
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x10001020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001039
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001074
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001070
lea ebx, [ebx]
cmp esi, eax
jae 0x10001074
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001060
cmp esi, eax
jb 0x1000107a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret