joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401369
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
mov esi, dword [eax + 0xc]
jmp 0x401432
mov edx, dword [esi + 0x18]
xor edi, edi
mov eax, dword [esi + 0x30]
mov ebx, dword [esi + 0x2c]
mov esi, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [edx + 0x3c]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], esi
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x401432
shr ebx, 0x10
xor ecx, ecx
test ebx, ebx
je 0x4013e4
mov esi, dword [ebp - 4]
movsx edx, byte [esi + ecx]
ror edi, 0xd
cmp byte [esi + ecx], 0x61
mov dword [ebp - 4], edx
jl 0x4013d3
mov eax, edx
add eax, 0xffffffe0
add edi, eax
jmp 0x4013d6
add edi, dword [ebp - 4]
inc ecx
cmp ecx, ebx
jb 0x4013ba
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + edx + 0x20]
add ecx, edx
cmp dword [eax + edx + 0x18], ebx
jbe 0x401432
mov esi, dword [ecx]
xor eax, eax
add esi, edx
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov edx, eax
mov cl, byte [esi]
ror edx, 0xd
movsx eax, cl
add edx, eax
inc esi
test cl, cl
jne 0x401407
mov esi, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add eax, edi
cmp eax, dword [ebp - 0x14]
je 0x401443
mov ecx, dword [ebp - 0x1c]
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x4013f9
cmp dword [esi + 0x18], 0
jne 0x401386
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x40143e
Function at 0x40145f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, 0x726774c
call fcn.00401369
lea ecx, [ebp - 0xc]
mov dword [esi], eax
push ecx
mov dword [ebp - 0xc], 0x72657375
mov dword [ebp - 8], 0x642e3233
mov word [ebp - 4], 0x6c6c
mov byte [ebp - 2], 0
call eax
mov ecx, 0x7568345
call fcn.00401369
mov dword [esi + 4], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0x5f327377
mov dword [ebp - 0x14], 0x642e3233
mov word [ebp - 0x10], 0x6c6c
mov byte [ebp - 0xe], 0
call dword [esi]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x6376736d
push eax
mov dword [ebp - 0x20], 0x642e7472
mov word [ebp - 0x1c], 0x6c6c
mov byte [ebp - 0x1a], 0
call dword [esi]
mov ecx, 0x6b8029
call fcn.00401369
mov ecx, 0xe0df0fea
mov dword [esi + 8], eax
call fcn.00401369
mov ecx, 0x6174a599
mov dword [esi + 0xc], eax
call fcn.00401369
mov ecx, 0x5f38ebc2
mov dword [esi + 0x10], eax
call fcn.00401369
mov ecx, 0xe553a458
mov dword [esi + 0x14], eax
call fcn.00401369
mov ecx, 0x5fc8d902
mov dword [esi + 0x18], eax
call fcn.00401369
mov ecx, 0x614d6e75
mov dword [esi + 0x1c], eax
call fcn.00401369
mov ecx, 0x803428a9
mov dword [esi + 0x20], eax
call fcn.00401369
mov ecx, 0x4d7b1e12
mov dword [esi + 0x24], eax
call fcn.00401369
mov ecx, 0xff13dad9
mov dword [esi + 0x28], eax
call fcn.00401369
mov ecx, 0xed43d9d9
mov dword [esi + 0x2c], eax
call fcn.00401369
mov ecx, 0xed6bdd99
mov dword [esi + 0x34], eax
call fcn.00401369
mov ecx, 0xd0eb608d
mov dword [esi + 0x30], eax
call fcn.00401369
mov ecx, 0x2c74e98
mov dword [esi + 0x38], eax
call fcn.00401369
mov ecx, 0x70f2fa31
mov dword [esi + 0x3c], eax
call fcn.00401369
mov ecx, 0xe449f330
mov dword [esi + 0x40], eax
call fcn.00401369
mov dword [esi + 0x44], eax
pop esi
leave
ret
Function at 0x66419084
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6641912b
jmp 0x664191c1
jmp 0x66419257
jmp 0x664192ed
jmp 0x66419383
jmp 0x66419419
jmp 0x664194af
jmp 0x66419545
jmp 0x664195db
jmp 0x66419671
jmp 0x66419707
jmp 0x6641979d
jmp 0x66419833
jmp 0x664198c9
jmp 0x6641995f
jmp 0x664199f5
jmp 0x66419a8b
jmp 0x66419b21
jmp 0x66419bb7
jmp 0x66419c4d
jmp 0x66419ce3
jmp 0x66419d79
jmp 0x66419e0f
jmp 0x66419ea5
jmp 0x66419f3b
jmp 0x66419fd1
jmp 0x6641a067
jmp 0x6641a0fd
jmp 0x6641a193
jmp 0x6641a229
jmp 0x6641a2bf
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6641a35b
jmp 0x6641a3f1
jmp 0x6641a487
jmp 0x6641a51d
jmp 0x6641a5b3
jmp 0x6641a649
jmp 0x6641a6df
jmp 0x6641a775
jmp 0x6641a80b
jmp 0x6641a8a1
jmp 0x6641a937
jmp 0x6641a9cd
jmp 0x6641aa63
jmp 0x6641aaf9
jmp 0x6641ab8f
jmp 0x6641ac25
jmp 0x6641acbb
jmp 0x6641ad51
jmp 0x6641ade7
jmp 0x6641ae7d
jmp 0x6641af13
jmp 0x6641afa9
jmp 0x6641b03f
jmp 0x6641b0d5
jmp 0x6641b16b
jmp 0x6641b201
jmp 0x6641b297
jmp 0x6641b32d
jmp 0x6641b3c3
jmp 0x6641b459
jmp 0x6641b4ef
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6641b59f
jmp 0x6641b635
jmp 0x6641b6cb
jmp 0x6641b761
jmp 0x6641b7f7
jmp 0x6641b88d
jmp 0x6641b923
jmp 0x6641b9b9
jmp 0x6641ba4f
jmp 0x6641bae5
jmp 0x6641bb7b
jmp 0x6641bc11
jmp 0x6641bca7
jmp 0x6641bd3d
jmp 0x6641bdd3
jmp 0x6641be69
jmp 0x6641beff
jmp 0x6641bf95
jmp 0x6641c02b
jmp 0x6641c0c1
jmp 0x6641c157
jmp 0x6641c1ed
jmp 0x6641c283
jmp 0x6641c319
jmp 0x6641c3af
jmp 0x6641c445
jmp 0x6641c4db
jmp 0x6641c571
jmp 0x6641c607
jmp 0x6641c69d
jmp 0x6641c733
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6641c7d2
jmp 0x6641c868
jmp 0x6641c8fe
jmp 0x6641c994
jmp 0x6641ca2a
jmp 0x6641cac0
jmp 0x6641cb56
jmp 0x6641cbec
jmp 0x6641cc82
jmp 0x6641cd18
jmp 0x6641cdae
jmp 0x6641ce44
jmp 0x6641ceda
jmp 0x6641cf70
jmp 0x6641d006
jmp 0x6641d09c
jmp 0x6641d132
jmp 0x6641d1c8
jmp 0x6641d25e
jmp 0x6641d2f4
jmp 0x6641d38a
jmp 0x6641d420
jmp 0x6641d4b6
jmp 0x6641d54c
jmp 0x6641d5e2
jmp 0x6641d678
jmp 0x6641d70e
jmp 0x6641d7a4
jmp 0x6641d83a
jmp 0x6641d8d0
jmp 0x6641d966
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6641da15
jmp 0x6641daab
jmp 0x6641db41
jmp 0x6641dbd7
jmp 0x6641dc6d
Function at 0x6644d943
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x66d08018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x66d08018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6644d9f9
jmp 0x6644da8f
jmp 0x6644db25
jmp 0x6644dbbb
jmp 0x6644dc51
jmp 0x6644dce7
jmp 0x6644dd7d
jmp 0x6644de13
jmp 0x6644dea9
jmp 0x6644df3f
jmp 0x6644dfd5
jmp 0x6644e06b
jmp 0x6644e101
jmp 0x6644e197
jmp 0x6644e22d
jmp 0x6644e2c3
jmp 0x6644e359
jmp 0x6644e3ef
jmp 0x6644e485
jmp 0x6644e51b
jmp 0x6644e5b1
jmp 0x6644e647
jmp 0x6644e6dd
jmp 0x6644e773
jmp 0x6644e809
jmp 0x6644e89f
jmp 0x6644e935
jmp 0x6644e9cb
jmp 0x6644ea61
jmp 0x6644eaf7
jmp 0x6644eb8d
mov dword [ebp - 0x14], 0
jmp 0x6644ec2a
jmp 0x6644ecc0
jmp 0x6644ed56
jmp 0x6644edec
jmp 0x6644ee82
jmp 0x6644ef18
jmp 0x6644efae
jmp 0x6644f044
jmp 0x6644f0da
jmp 0x6644f170
jmp 0x6644f206
jmp 0x6644f29c
jmp 0x6644f332
jmp 0x6644f3c8
jmp 0x6644f45e
jmp 0x6644f4f4
jmp 0x6644f58a
jmp 0x6644f620
jmp 0x6644f6b6
jmp 0x6644f74c
jmp 0x6644f7e2
jmp 0x6644f878
jmp 0x6644f90e
jmp 0x6644f9a4
jmp 0x6644fa3a
jmp 0x6644fad0
jmp 0x6644fb66
jmp 0x6644fbfc
jmp 0x6644fc92
jmp 0x6644fd28
jmp 0x6644fdbe
mov dword [ebp - 0x18], 0
jmp 0x6644fe5b
jmp 0x6644fef1
jmp 0x6644ff87
jmp 0x6645001d
jmp 0x664500b3
jmp 0x66450149
jmp 0x664501df
jmp 0x66450275
jmp 0x6645030b
jmp 0x664503a1
jmp 0x66450437
jmp 0x664504cd
jmp 0x66450563
jmp 0x664505f9
jmp 0x6645068f
jmp 0x66450725
jmp 0x664507bb
jmp 0x66450851
jmp 0x664508e7
jmp 0x6645097d
jmp 0x66450a13
jmp 0x66450aa9
jmp 0x66450b3f
jmp 0x66450bd5
jmp 0x66450c6b
jmp 0x66450d01
jmp 0x66450d97
jmp 0x66450e2d
jmp 0x66450ec3
jmp 0x66450f59
jmp 0x66450fef
mov dword [ebp - 0x10], 0
jmp 0x6645108c
jmp 0x66451122
jmp 0x664511b8
jmp 0x6645124e
jmp 0x664512e4
jmp 0x6645137a
jmp 0x66451410
jmp 0x664514a6
jmp 0x6645153c
jmp 0x664515d2
jmp 0x66451668
jmp 0x664516fe
jmp 0x66451794
jmp 0x6645182a
jmp 0x664518c0
jmp 0x66451956
jmp 0x664519ec
jmp 0x66451a82
jmp 0x66451b18
jmp 0x66451bae
jmp 0x66451c44
jmp 0x66451cda
jmp 0x66451d70
jmp 0x66451e06
jmp 0x66451e9c
jmp 0x66451f32
jmp 0x66451fc8
jmp 0x6645205e
jmp 0x664520f4
jmp 0x6645218a
jmp 0x66452220
mov dword [ebp - 0x10], 0
jmp 0x66457d46
jmp 0x664522c2
jmp 0x66452358
jmp fcn.664523ee
mov eax, dword [0x66d08018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6645222c
nop
leave
ret
Function at 0x4050e0
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, 0x1854
call fcn.004167c0
mov eax, dword [0x6fd7ec]
mov ecx, dword [0x6fa6f4]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x405255
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov ebp, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x6fd7ec], 0x959
jne 0x40523b
push 0
push 0
call edi
lea eax, [esp + 0x40]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xc64]
push edx
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x464]
push ecx
push 0
push 0x403734
push 0x403770
push 0x4037b0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea edx, [esp + 0x24]
push edx
push 0
call esi
push 0
push 0
push 0
lea eax, [esp + 0x106c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 0x64]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0x4037d0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0x403830
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
push 0
push 0x403834
push 0x403840
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0x403868
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00404f00
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x405124
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1854
ret
Function at 0x408c8d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c238]
jne 0x408c97
repz ret
jmp fcn.00410eac

Function at 0x4149c1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ef46
and dword [ebp - 4], 0
cmp dword [0x43fa38], 0
mov ebx, eax
jne 0x414a72
push 0x402db0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x414b23
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402da4
push edi
call esi
test eax, eax
je 0x414b23
push eax
call fcn.0040eed4
mov dword [esp], 0x402d94
push edi
mov dword [0x43fa38], eax
call esi
push eax
call fcn.0040eed4
mov dword [esp], 0x402d80
push edi
mov dword [0x43fa3c], eax
call esi
push eax
call fcn.0040eed4
mov dword [esp], 0x402d64
push edi
mov dword [0x43fa40], eax
call esi
push eax
call fcn.0040eed4
pop ecx
mov dword [0x43fa48], eax
test eax, eax
je 0x414a72
push 0x402d4c
push edi
call esi
push eax
call fcn.0040eed4
pop ecx
mov dword [0x43fa44], eax
mov eax, dword [0x43fa44]
cmp eax, ebx
je 0x414aca
cmp dword [0x43fa48], ebx
je 0x414aca
push eax
call fcn.0040ef4f
push dword [0x43fa48]
mov esi, eax
call fcn.0040ef4f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x414aca
test edi, edi
je 0x414aca
call esi
test eax, eax
je 0x414ac1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x414ac1
test byte [ebp - 0xc], 1
jne 0x414aca
or dword [ebp + 0x10], 0x200000
jmp 0x414b03
mov eax, dword [0x43fa3c]
cmp eax, ebx
je 0x414b03
push eax
call fcn.0040ef4f
pop ecx
test eax, eax
je 0x414b03
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x414b03
mov eax, dword [0x43fa40]
cmp eax, ebx
je 0x414b03
push eax
call fcn.0040ef4f
pop ecx
test eax, eax
je 0x414b03
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43fa38]
call fcn.0040ef4f
pop ecx
test eax, eax
je 0x414b23
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x414b25
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101d2ba0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [0x101e3db8], 0x1973
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x101e3dbc]
sub eax, 0x1648
mov dword [0x101e3db8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x104
jl 0x101d2c01
jmp 0x101d2c2d
mov eax, dword [ebp - 4]
add esp, 0x18
pop ebp
ret
mov dword [ebp - 4], 0
jmp 0x101d2bf0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x101d2c14
jmp 0x101d2c2d
mov dword [0x101e3dbc], 0xe9d
jmp 0x101d2c20
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x101d2be5
mov dword [0x101e3dbc], 0x2480
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
add eax, 0xffffffe6
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
cmp ecx, 0x6c
jne 0x101d2bf8
mov dword [0x101e3dbc], 0x9c7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x101d2d2b
mov dword [0x101e3db8], 0x1f2f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x101d2d29
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x101d2d27
mov dword [0x101e3db8], 0x24a3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x101d2d25
mov dword [0x101e3db8], 0x401
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x101d2d23
mov dword [0x101e3dbc], 0x1d1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x101d2d0b
jmp 0x101d2d21
mov dword [0x101e3db8], 0x1a60
mov dword [ebp - 4], 1
jmp 0x101d2bf0
jmp 0x101d2d23
jmp 0x101d2d25
jmp 0x101d2d27
jmp 0x101d2d29
jmp 0x101d2d2b
jmp 0x101d2bf8
Function at 0x101d3a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x101e3db8], 0x513
mov dword [0x101e3dc0], 0
mov dword [0x101e3dc4], 0
mov dword [0x101e3dd0], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov eax, dword [0x101e3db8]
add eax, 0x1004
mov dword [0x101e3dbc], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
jae 0x101d3c3a
mov eax, 0x100
mov dword [0x101e3db8], 0x525
mov dword [0x101e3dbc], 0x2451
mov dword [0x101e3dbc], 0xda4
mov ecx, dword [0x101e3dc0]
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x101e3dc0], edx
mov edx, dword [0x101e3dc4]
mov esi, dword [0x101e3dc0]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x101e3dc4], edx
mov edx, dword [0x101e3db8]
add edx, 0x1e48
mov dword [0x101e3db8], edx
mov edx, dword [0x101e3dc0]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov byte [0x101e3dc8], bl
mov dword [0x101e3db8], 0x1607
mov edx, dword [0x101e3dc4]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edx
mov eax, 0x100
mov ecx, dword [ebp - 0x30]
mov dl, byte [ecx]
mov esi, dword [0x101e3dc0]
mov edi, dword [ebp - 0x1c]
mov byte [edi + esi], dl
mov esi, dword [0x101e3dbc]
add esi, 0x7cc
mov dword [0x101e3db8], esi
mov dl, byte [0x101e3dc8]
mov esi, dword [0x101e3dc4]
mov edi, dword [ebp - 0x1c]
mov byte [edi + esi], dl
mov esi, dword [0x101e3dc0]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
mov edi, dword [0x101e3dc4]
mov ebx, dword [ebp - 0x1c]
movzx edi, byte [ebx + edi]
add esi, edi
mov dword [ebp - 0x20], esi
mov dword [0x101e3db8], 0xf7b
mov esi, dword [0x101e3db8]
sub esi, 0x35d
mov dword [0x101e3dbc], esi
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, esi
cdq
mov esi, dword [ebp - 0x34]
idiv esi
mov dword [0x101e3dd0], edx
mov dword [0x101e3db8], 0x1d88
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
mov edi, dword [0x101e3dd0]
mov ebx, dword [ebp - 0x1c]
movzx edi, byte [ebx + edi]
xor edx, edi
mov cl, dl
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
mov byte [edi + edx], cl
mov dword [0x101e3db8], 0x627
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x101d3abd
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101d3eb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101e3db8]
mov dword [ebp - 0xc], eax
lea eax, [fcn.101d3eb0]
mov ecx, dword [ebp - 0xc]
sub ecx, 0x2540
mov dword [0x101e3db8], ecx
mov dword [ebp - 8], eax
mov dword [0x101e3db8], 0x8d2
jmp 0x101d3efc
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x101d3f3c
jmp 0x101d3ee2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x101d3ee2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp dword [eax + ecx], 0x4550
jne 0x101d3efa
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
jmp 0x101d3f4d
mov al, 1
test al, 1
jne 0x101d3efc
jmp 0x101d3f44
mov dword [ebp - 4], 0
jmp 0x101d3f4d
mov eax, dword [ebp - 4]
add esp, 0x20
pop ebp
ret
Function at 0x4056eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e300]
jne 0x4056f5
repz ret
jmp fcn.0040a4ac

Function at 0x40d89c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408f2c
and dword [ebp - 4], 0
cmp dword [0x4410cc], 0
mov ebx, eax
jne 0x40d94d
push 0x402234
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d9fe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402228
push edi
call esi
test eax, eax
je 0x40d9fe
push eax
call fcn.00408eba
mov dword [esp], 0x402218
push edi
mov dword [0x4410cc], eax
call esi
push eax
call fcn.00408eba
mov dword [esp], 0x402204
push edi
mov dword [0x4410d0], eax
call esi
push eax
call fcn.00408eba
mov dword [esp], 0x4021e8
push edi
mov dword [0x4410d4], eax
call esi
push eax
call fcn.00408eba
pop ecx
mov dword [0x4410dc], eax
test eax, eax
je 0x40d94d
push 0x4021d0
push edi
call esi
push eax
call fcn.00408eba
pop ecx
mov dword [0x4410d8], eax
mov eax, dword [0x4410d8]
cmp eax, ebx
je 0x40d9a5
cmp dword [0x4410dc], ebx
je 0x40d9a5
push eax
call fcn.00408f35
push dword [0x4410dc]
mov esi, eax
call fcn.00408f35
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d9a5
test edi, edi
je 0x40d9a5
call esi
test eax, eax
je 0x40d99c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d99c
test byte [ebp - 0xc], 1
jne 0x40d9a5
or dword [ebp + 0x10], 0x200000
jmp 0x40d9de
mov eax, dword [0x4410d0]
cmp eax, ebx
je 0x40d9de
push eax
call fcn.00408f35
pop ecx
test eax, eax
je 0x40d9de
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d9de
mov eax, dword [0x4410d4]
cmp eax, ebx
je 0x40d9de
push eax
call fcn.00408f35
pop ecx
test eax, eax
je 0x40d9de
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4410cc]
call fcn.00408f35
pop ecx
test eax, eax
je 0x40d9fe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40da00
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45a215
Capabilities:
Terminate process

Disassembly:
jmp fcn.004ab320
jmp 0x499240
cmp ecx, dword [0x5311c8]
jne 0x49924a
repz ret
jmp 0x458834

Function at 0x46a630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [ebp + 0xc], 0
jne 0x46a65b
xor eax, eax
jmp 0x46a7fb
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x46a7bc
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x46a664
cmp dword [ebp + 0x10], 0
je 0x46a7f5
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x511570]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
jne 0x46a7c2
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret