joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042977
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007ef24]
jne 0x10042981
repz ret
jmp fcn.1004b70c

Function at 0x100528e1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x1005290e
call fcn.10046a51
mov dword [eax], esi
call fcn.10046a3e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10042c10
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x100528ea
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005293d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10046a64
pop ecx
call fcn.10046a3e
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x10052964
test al, 1
je 0x10052964
test byte [esp + 0xc], 2
je 0x10052964
call fcn.10046a51
mov dword [eax], 5
call fcn.10046a3e
mov dword [eax], 0xd
jmp 0x10052934
xor eax, eax
pop esi
ret
Function at 0x1005aa80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1004b0b5
xor ebx, ebx
cmp dword [0x1008aea4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1005ab55
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1005aac0
xor eax, eax
jmp 0x1005ac19
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1007106c
push edi
call esi
cmp eax, ebx
je 0x1005aab9
push eax
call fcn.1004b052
mov dword [esp], 0x1007105c
push edi
mov dword [0x1008aea4], eax
call esi
push eax
call fcn.1004b052
mov dword [esp], 0x10071048
push edi
mov dword [0x1008aea8], eax
call esi
push eax
call fcn.1004b052
mov dword [0x1008aeac], eax
lea eax, [ebp - 8]
push eax
call fcn.1004868f
test eax, eax
pop ecx
pop ecx
je 0x1005ab23
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10042b14
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1005ab55
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1004b052
cmp eax, ebx
pop ecx
mov dword [0x1008aeb4], eax
je 0x1005ab55
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1004b052
pop ecx
mov dword [0x1008aeb0], eax
mov eax, dword [0x1008aeb0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1005abce
cmp dword [0x1008aeb4], esi
je 0x1005abce
push eax
call fcn.1004b0be
pop ecx
call eax
cmp eax, ebx
je 0x1005ab9b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1008aeb4]
call fcn.1004b0be
pop ecx
call eax
test eax, eax
je 0x1005ab9b
test byte [ebp - 0x18], 1
jne 0x1005abce
lea eax, [ebp - 0xc]
push eax
call fcn.10048702
test eax, eax
pop ecx
je 0x1005abb6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10042b14
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1005abc5
or dword [ebp + 0x10], 0x200000
jmp 0x1005abff
or dword [ebp + 0x10], 0x40000
jmp 0x1005abff
mov eax, dword [0x1008aea8]
cmp eax, esi
je 0x1005abff
push eax
call fcn.1004b0be
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1005abff
mov eax, dword [0x1008aeac]
cmp eax, esi
je 0x1005abff
push dword [ebp - 4]
push eax
call fcn.1004b0be
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1008aea4]
call fcn.1004b0be
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x12a2260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x12a229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x12a22a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x12a2280
jmp 0x12a22a3
mov eax, 0x1505
jmp 0x12a22a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x12a2990
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x12a2b56
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x12a2b4f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x12a2a33
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x12a2b4f
xor eax, eax
cmp edx, 8
mov dword [esp], edx
jb 0x12a2ab4
and edx, 0x1ff8
mov dword [esp + 4], edx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add eax, 8
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 6]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 7]
add edi, esi
mov esi, ecx
xor esi, edi
and ecx, edi
lea ecx, [esi + ecx*2]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x12a2a50
add ebx, eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], ebp
mov esi, eax
sub esi, edx
jae 0x12a29eb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x12a2b02
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x12a2ae0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x12a29e0
jmp 0x12a2b0f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x12a29e0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x12a2b20
jmp 0x12a29e0
shl ecx, 0x10
or ecx, edi
jmp 0x12a2b5b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12a2b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x12a2bc8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x12a2bca
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x12df80c]
mov eax, edi
shr eax, 4
shr ebx, 4
mov ebp, ebx
and ebp, edi
and edi, 0xf
or edi, ebx
xor edi, ebp
xor eax, dword [edi*4 + 0x12df80c]
inc esi
cmp edx, esi
jne 0x12a2b90
not eax
jmp 0x12a2bca
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12a7c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x12a7c5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x12a7c63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x12a7cfb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x12a7ca9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x12a7d0a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x12a7cbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x12a7cd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x12a7c90
jmp 0x12a7cd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x12a7c90
cmp edi, ebx
jge 0x12a7cf0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x12a7c94
jmp 0x12a7cf4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x12a7c9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x12a7d92
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x12a7d92
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x12a7d44
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x12a7d30
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x12a7d92
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x12a7d50
dec eax
mov ecx, 1
xor esi, esi
jmp 0x12a7dac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x12a7c5b
test edx, edx
mov dword [esp], ecx
js 0x12a7de0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x12a7df0
inc ebp
dec edx
cmp edi, ebp
jne 0x12a7dc0
mov edx, 0xffffffff
jmp 0x12a7df2
xor edi, edi
jmp 0x12a7df5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x12a7da0
and ebp, 3
je 0x12a7e28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x12a7e10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x12a7e2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x12a7da0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x12a7e40
jmp 0x12a7da0
Function at 0x12a8990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x12a89f5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x12a89b0
mov eax, 0x270
jmp 0x12a8acf
cmp eax, 0x4e0
jb 0x12a8acf
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x12a8a10
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x12a8a60
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0x12bb020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0x12bb060
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0x12bb0e0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0x12bb121
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x12bb110
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x12bb151
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x12bb140
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0x12bb181
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x12bb170
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0x12bb1b0
movzx eax, byte [esp + 0x48]
test al, al
je 0x12bb22d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x12bb220
jmp 0x12bb231
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.012aae40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x12e3794]
mov ecx, 0xae6ce794
xor ecx, dword [0x12e379c]
add eax, ecx
inc eax
jmp eax
Function at 0x15b6060
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x15b6080
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x15b6e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x15b6e80
mov eax, dword [esp]
mov edx, dword [0x12e965c]
test edx, edx
je 0x15b6ef8
xor ebx, ebx
mov ecx, dword [0x12e9660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x15b6ed0
inc ebx
cmp edx, ebx
jne 0x15b6ec0
jmp 0x15b6ef8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x15b6ef8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x12e9664]
call fcn.015b4a80
add esp, 0x20
test edi, edi
je 0x15b6f02
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x15b6f0e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x15b71d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x15b71f0
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x698232ac]
xor ecx, eax
mov ebx, ecx
and ebx, 0x5f
add ebx, ebx
xor ecx, 0xa0
sub ebx, ecx
mov byte [esp + eax + 0x698232ac], bl
inc eax
cmp eax, 0x967dcd58
jne 0x15b7270
mov eax, dword [esp]
mov edi, dword [0x12e965c]
test edi, edi
je 0x15b72e5
xor ebx, ebx
mov ebp, dword [0x12e9660]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x15b72c1
inc ebx
cmp edi, ebx
jne 0x15b72b0
jmp 0x15b72e5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x15b72e5
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x12e9664]
call fcn.015b4a80
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d260
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x40d2c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x492054]
test esi, esi
jle 0x40d3ad
mov edi, dword [0x492058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d2f4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d3a6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40d2e0
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x40d3ea
lea ebx, [esi + esi*2]
mov esi, dword [0x492058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x492058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d3ca
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d39f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40d39f
mov eax, dword [esp + 0x20]
add ebx, dword [0x492058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40d3b4
add dword [0x492054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40d2fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x492058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x40d8b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x492408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x492400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40d905
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40d8fe
test esi, esi
je 0x40d8fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40d8e0
mov dword [esp], 0x492408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40db20
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40db58
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40db4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40db5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40db40
xor eax, eax
pop ebx
pop esi
ret