joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d8ef
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000d98c
push ebx
push esi
call fcn.1000d8b8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000d84c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000d939
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d98b
push edi
push eax
call fcn.1000e8aa
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000d959
call fcn.1000c394
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d98a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000d84c
add esp, 0x20
test eax, eax
jne 0x1000d978
push edi
call fcn.1000c394
jmp 0x1000d980
push ebx
call fcn.1000c394
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000dbf9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015678
push 0x10015670
push str.FlsAlloc
push 0x1f
call fcn.1000db15
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000dc2d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10014158]
call esi
jmp 0x1000dc33
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000dc77
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015688
push 0x10015680
push str.FlsGetValue
push 0x21
call fcn.1000db15
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000dcae
push dword [ebp + 8]
mov ecx, esi
call dword [0x10014158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000dcb6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015690
push 0x10015688
push str.FlsSetValue
push 0x22
call fcn.1000db15
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000dcf0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10014158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10013370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001339d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001339d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402b8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x415014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c24
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c04
xor eax, eax
push ebp
push 0x402bfd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c40
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c04
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x415014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x415014], ax
mov esp, ebp
pop ebp
ret

Function at 0x40328c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x417034], 0
je 0x4032ed
cmp word [0x417208], 0xd7b2
jne 0x4032b5
cmp dword [0x417210], 0
jbe 0x4032b5
mov eax, 0x417204
call dword [0x417220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41505c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403314
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x415020], 0
jne 0x403309
push 0
push 0x415054
push 0x41505c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40405c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4040c2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403570
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a20
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4040ac
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040c9
lea eax, [ebp - 0x10]
call fcn.00403410
ret

Function at 0x404e90
Capabilities:
Accept command line arguments

Disassembly:
push edi
mov edi, edx
test eax, eax
jne 0x404ebe
sub esp, 0x104
mov ecx, esp
push 0x104
push ecx
push 0
call sub.kernel32.dll_GetModuleFileNameA
xchg ecx, eax
mov edx, esp
mov eax, edi
call fcn.00403500
add esp, 0x104
pop edi
ret
push eax
call sub.kernel32.dll_GetCommandLineA_1
pop ecx
inc ecx
call fcn.0040a1b0
mov edx, eax
call fcn.0040a1c0
loop 0x404ec6
mov ecx, eax
sub ecx, edx
cmp ecx, 2
jl 0x404eea
cmp byte [edx], 0x22
jne 0x404eea
cmp byte [eax - 1], 0x22
jne 0x404eea
inc edx
dec eax
sub eax, edx
xchg ecx, eax
xchg edi, eax
call fcn.00403500
pop edi
ret
Function at 0x405450
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x4054cc
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00403788
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00403788
push eax
mov eax, dword [ebp - 4]
call fcn.00403788
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403788
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x4054c3
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00403570
jmp 0x4054fd
mov eax, edi
call fcn.00403410
jmp 0x4054fd
mov eax, edi
mov edx, esi
call fcn.00403464
mov eax, dword [ebx + 0x19]
call fcn.00403788
push eax
mov eax, esi
call fcn.00403788
push eax
mov eax, dword [ebp - 4]
call fcn.00403788
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403788
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406118
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
inc ebp
mov bh, 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00405e84
cld
shl eax, 0x4d
lea eax, [ebp - 0x58]
push eax
call fcn.00405e94
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
or al, ch
pop es
std
invalid
inc dword [ebx - 0x7272ef3c]
push eax
invalid
invalid
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
invalid
push dword [ebx]
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
dec dword [ebx - 0xe0807bb]

Function at 0x407328
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
loope 0x40733a
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
invalid
dec ecx

Function at 0x408630
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40863c
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x408655
push eax
je 0x408656
call dword [0x41513c]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x41513c]
ret

Function at 0x40a230
Capabilities:
Get file attributes

Disassembly:
call fcn.004049b0
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40a244
dec eax
and al, 0x10
sete al
ret

Function at 0x40a2a0
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00403540
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00404fd4
ret
Function at 0x40e310
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4179c4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x40e332
shr eax, 1
xor eax, 0xedb88320
jmp 0x40e334
shr eax, 1
dec edx
jne 0x40e320
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40e319
mov byte [0x417dc4], 1
pop esi
pop ebx
ret

Function at 0x40e350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x417dc4], 0
jne 0x40e367
call fcn.0040e310
mov eax, edi
dec eax
test eax, eax
jl 0x40e390
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4179c4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x40e371
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x412520
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
xor eax, eax
push ebp
push 0x41254d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407aec
mov edx, dword [ebp - 8]
mov eax, 0x417fe8
call fcn.00403464
xor eax, eax
mov dword [0x417fe4], eax
push 0
push 0x4123f0
call sub.user32.dll_EnumWindows
mov ebx, dword [0x417fe4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412554
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403434
ret

Function at 0x412562
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push ecx
xor ebx, ebx
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push esp
push esi
call sub.kernel32.dll_GetExitCodeProcess
test esi, esi
je 0x41258b
mov eax, dword [esp]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x412ee0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x412f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x417fcc]
push dword [eax + 0x28]
push 0x412f9c
push ebx
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403648
mov edx, dword [ebp - 0x24]
mov eax, dword [0x417fc8]
call fcn.00412e38
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00404660
mov dword [ebp - 0x1a], 3
mov word [ebp - 0xe], 0x14
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.00404fe8
lea eax, [ebp - 0x28]
mov edx, 0x412fa8
call fcn.00403590
mov eax, dword [ebp - 0x28]
call fcn.00403788
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412f8e
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403434
ret

Function at 0x413054
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
xor eax, eax
push ebp
push 0x413138
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x41311d
test bl, bl
je 0x4130b4
mov ebx, 8
mov eax, dword [ebp - 4]
call fcn.00403788
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
test al, 1
je 0x4130ac
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x4130c1
mov ebx, 0xa
mov eax, dword [ebp - 4]
call fcn.00412fac
mov eax, dword [0x417fcc]
push dword [eax + ebx*4]
push 0x413150
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403648
mov edx, dword [ebp - 8]
mov eax, dword [0x417fc8]
call fcn.00412e38
mov ebx, 0xa
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00404ffc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00404fe8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004034a8
mov eax, dword [ebp - 4]
call fcn.00412fac
test al, al
jne 0x4130c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41313f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403434
ret
Function at 0x4133b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 8]
call fcn.00403778
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x413495
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00402a00
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
call fcn.00403788
mov dword [esi + 0x10], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.00404ffc
mov eax, dword [ebp - 0x48]
call fcn.00403788
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00403788
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 4], 0x200
cmp dword [ebp + 8], 1
jne 0x413443
or dword [esi + 4], 0x40
push esi
call sub.shell32.dll_ShellExecuteExA
jmp 0x413457
mov eax, dword [0x416b10]
mov eax, dword [eax]
call fcn.00408ac4
push 0x32
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41344b
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41349c
lea eax, [ebp - 0x48]
call fcn.00403410
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403434
ret
Function at 0x401380
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40b00c
push 0x80000002
call dword [0x438e6c]
test eax, eax
jne 0x4013ac
mov eax, 0xd903
jmp 0x401456
mov dword [0x438e64], 0x24e1
mov ecx, dword [0x438e64]
sub ecx, 0x24e1
mov dword [0x438e64], ecx
mov edx, 1
test edx, edx
je 0x401456
mov eax, dword [0x438e64]
cmp eax, dword [ebp + 0xc]
jb 0x4013e1
jmp 0x401456
cmp dword [0x438e64], 0
jne 0x4013ff
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x4013ff
xor eax, eax
jmp 0x401456
mov ecx, dword [ebp + 8]
add ecx, dword [0x438e64]
mov edx, dword [ecx]
add edx, dword [0x438e64]
mov eax, dword [ebp + 8]
add eax, dword [0x438e64]
mov dword [eax], edx
mov dword [ebp - 8], 0x17528a5
mov ecx, dword [0x438e64]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 2]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x438e64]
push ecx
call fcn.00401150
add esp, 8
mov edx, dword [0x438e64]
add edx, 4
mov dword [0x438e64], edx
jmp 0x4013c8
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4aed40ce
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x43974436
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10001ee8
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
and dword [ebp + 8], 0
push edi
mov edi, dword [eax + 4]
mov dword [ebp - 0xc], edi
mov edi, dword [eax]
mov dword [ebp - 8], edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
sub dword [ebp + 8], 0x61c88647
dec dword [ebp - 4]
mov eax, edx
shl eax, 4
add eax, dword [ebp - 8]
mov edi, edx
shr edi, 5
add edi, dword [ebp - 0xc]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, edx
xor eax, edi
add ecx, eax
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 0x14]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, ecx
xor eax, edi
add edx, eax
cmp dword [ebp - 4], 0
ja 0x10001f1d
pop edi
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
leave
ret

Function at 0x1000219d
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0xb8]
sub esp, 0x138
mov eax, dword [0x13dc750]
xor eax, ebp
mov dword [ebp + 0xb4], eax
mov eax, dword [ebp + 0xcc]
mov ecx, dword [ebp + 0xc0]
push ebx
push esi
mov esi, dword [ebp + 0xc8]
mov dword [ebp - 0x80], eax
push edi
xor edi, edi
lea eax, [ebp - 0x7c]
mov dword [esi + 4], edi
mov dword [esi], edi
sub eax, ecx
mov ebx, 0x12c
mov dl, byte [ecx]
test dl, dl
je 0x100021f0
inc edi
mov byte [eax + ecx], dl
inc ecx
cmp edi, ebx
jb 0x100021e1
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp + edi - 0x7c], 0
call fcn.100020d2
mov edi, eax
pop ecx
test edi, edi
je 0x1000228a
mov edx, dword [ebp + 0xc4]
cmp byte [edx], 0
je 0x1000224a
mov byte [ebp + edi - 0x7c], 0x2a
inc edi
mov eax, edi
cmp edi, ebx
jae 0x10002230
mov cl, byte [edx]
test cl, cl
je 0x10002230
mov byte [ebp + eax - 0x7c], cl
inc eax
inc edx
cmp eax, ebx
jb 0x10002220
mov byte [ebp + eax - 0x7c], 0
lea eax, [ebp + edi - 0x7c]
push eax
call fcn.100020d2
pop ecx
add edi, eax
jmp 0x1000224a
mov byte [ebp + edi - 0x7c], 0
inc edi
mov eax, edi
and eax, 0x80000007
jns 0x10002258
dec eax
or eax, 0xfffffff8
inc eax
jne 0x10002244
mov eax, edi
cdq
and edx, 7
add eax, edx
mov edi, eax
sar edi, 3
xor ebx, ebx
test edi, edi
jle 0x1000228a
mov eax, dword [ebp + ebx*8 - 0x7c]
xor dword [esi], eax
push dword [ebp - 0x80]
mov eax, dword [ebp + ebx*8 - 0x78]
xor dword [esi + 4], eax
push esi
call fcn.10001fb0
inc ebx
cmp ebx, edi
pop ecx
pop ecx
jl 0x1000226d
mov ecx, dword [ebp + 0xb4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000fc25
add ebp, 0xb8
leave
ret

Function at 0x10006506
Capabilities:
Hash data with md5

Disassembly:
xor edx, edx
push 0x40
lea eax, [ecx + 0x18]
push edx
push eax
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x10], edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
call fcn.1000f840
add esp, 0xc
ret
Function at 0x1000bdef
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x110
mov eax, dword [0x13dc750]
xor eax, ebp
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x68]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x70]
mov dword [ebp - 0xac], ecx
mov ecx, dword [ebp + 0x78]
push edi
push dword [ebp + 0x6c]
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp + 0x7c]
mov dword [ebp - 0xb0], ecx
push eax
mov ecx, esi
call fcn.10009cb7
lea edi, [ebp - 0x34]
lea edx, [ebp + 0xc]
sub edi, esi
mov ecx, esi
sub edx, esi
mov dword [ebp - 0xa8], 0x40
mov al, byte [ecx]
mov bl, al
xor bl, 0x36
xor al, 0x5c
mov byte [edi + ecx], bl
mov byte [edx + ecx], al
inc ecx
dec dword [ebp - 0xa8]
jne 0x1000be2f
lea ecx, [ebp - 0xa0]
call fcn.10006506
push 0x40
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xa0]
call fcn.10008563
mov edi, dword [ebp - 0xb0]
test edi, edi
je 0x1000bea8
cmp dword [ebp - 0xa4], 0
je 0x1000be8d
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xa0]
push dword [ebp - 0xac]
call fcn.10008563
test edi, edi
jle 0x1000bea8
mov ebx, edi
push 1
push 0x13d7284
lea ecx, [ebp - 0xa0]
call fcn.10008563
dec ebx
jne 0x1000be93
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp + 0x74]
sub ecx, edi
sub ecx, eax
add edi, eax
add edi, dword [ebp - 0xac]
push ecx
push edi
lea ecx, [ebp - 0xa0]
call fcn.10008563
push 0x10
lea ecx, [ebp - 0xa0]
call fcn.10008604
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.1000f8c0
add esp, 0xc
lea ecx, [ebp - 0xa0]
call fcn.10006506
push 0x40
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0xa0]
call fcn.10008563
push 0x10
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.10008563
push 0x10
lea ecx, [ebp - 0xa0]
add esi, 0x40
call fcn.10008604
push eax
push esi
call fcn.1000f8c0
mov ecx, dword [ebp + 0x5c]
add esp, 0xc
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000fc25
add ebp, 0x60
leave
ret 0x18
Function at 0x401430
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e98d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.004016d0
test al, al
jne 0x4014a2
push 0
push str.Failure
push str.Failed_to_get_dll_path
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor bl, bl
jmp 0x401580
mov eax, dword [ebp - 0x18]
xor bl, bl
push 4
push 0x3000
lea eax, [eax*2 + 2]
push eax
push 0
push esi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
push 0
test edi, edi
je 0x40156e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x2c]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
test eax, eax
je 0x40154b
push 0
push edi
push str.LoadLibraryW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x40153d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push edi
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x401580
push 0
push str.Failure
push str.Failed_to_create_remote_thread
jmp 0x401555
push str.Failure
push str.Failed_to_write_process_memory
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x401580
push str.Failure
push str.Failed_to_allocate_virtual_memory
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4015b6
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4015ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4015d4
push edx
push ecx
call fcn.00401efa
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401ebc
mov esp, ebp
pop ebp
ret
call fcn.004058a3
int3