joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x9f2860]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x462fcb
je 0x46301e
cmp ebx, 0x20
jbe 0x463024
cmp ebx, 0x40
jbe 0x46306a
jmp 0x46310b
test ebx, ebx
je 0x463014
add eax, 0x10
test ax, 0xff0
je 0x463000
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x7e4e20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x7e5020]
jmp 0x462fe8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x462fe8
pxor xmm1, xmmword [0x9f2870]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9f2870]
pxor xmm2, xmmword [0x9f2880]
pxor xmm3, xmmword [0x9f2890]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9f2870]
pxor xmm2, xmmword [0x9f2880]
pxor xmm3, xmmword [0x9f2890]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46316a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x9f227c], 0
je 0x46481a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x462f90
jmp fcn.004085a0
Function at 0x4781c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x62000]
push edi
or ebp, 0xffffffff
jmp 0x4781e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4781e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4781d8
mov eax, 1
add ebx, ebx
jne 0x4781fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47820c
jne 0x47822b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47822b
dec eax
add ebx, ebx
jne 0x478218
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4781f0
add ebx, ebx
jne 0x478227
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47827d
xor ecx, ecx
sub eax, 3
jb 0x478243
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4782b2
sar eax, 1
mov ebp, eax
jmp 0x47824e
add ebx, ebx
jne 0x47824e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47821c
inc ecx
add ebx, ebx
jne 0x47825c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47821c
add ebx, ebx
jne 0x478269
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47825e
jne 0x47827a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47825e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47829c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47828e
jmp 0x4781de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47829c
add edi, ecx
jmp 0x4781de
pop esi
mov edi, esi
mov ecx, 0x49f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4782ba
cmp byte [edi], 7
jne 0x4782ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4782bf
lea edi, [esi + 0x76000]
mov eax, dword [edi]
or eax, eax
je 0x47832e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7d514]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7d550]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4782ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7d558]
or eax, eax
je 0x478328
mov dword [ebx], eax
add ebx, 4
jmp 0x478309
call dword [esi + 0x7d554]
mov ebp, dword [esi + 0x7d55c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x478362
sub esp, 0xffffff80
jmp 0x4025aa
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x401471
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edi, dword [0x40c050]
cdq
or di, 1
idiv edi
mov edx, dword [0x40c050]
mov ebx, esi
add edx, eax
mov eax, 0x40c054
call fcn.004013ba
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x401e7b
push eax
sub edi, fcn.00401646
push edi
push fcn.00401646
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x4014e7
mov eax, fcn.00401646
mov ebx, esi
mov edx, edi
call fcn.004013ba
mov edx, 0x1b600
mov eax, 0x40c054
mov ebx, esi
call fcn.0040127e
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401595
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x144, 0
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
mov dword [ebp - 0x24], 6
xor eax, eax
push 0x7f00
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], eax
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
push 0x7f00
push 0
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassA]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x144]
push eax
mov dword [ebp - 4], 0x14
mov byte [ebp - 0x144], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringW]
movzx ebx, word [ebp - 0x18]
call dword [sym.imp.OLE32.DLL_CoUninitialize]
lea eax, [ebx - 0x41]
leave
pop edx
pop ecx
pop ebx
ret
Function at 0x406ced
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x2d57a58f
mov esi, 0x411000
mov ebx, 0xd7ac7e29
sub esp, 0x11e4
mov edi, esp
cld
mov ecx, 0x479
ror edx, 7
sub edx, ebx
sub ebx, ecx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
dec ecx
jne 0x406d0a
push esp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x61580ebc
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x43e338d
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x448570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x1001408
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x100144b
push esi
lea ecx, [eax + 8]
call dword [sym.imp.ulib.dll_public:_class_WSTRING____thiscall_PATH::QueryFullPathString_void_const]
mov esi, eax
cmp esi, ebx
je 0x100144a
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1001442
cmp word [eax], bx
je 0x1001442
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001442
test ah, 0x10
je 0x1001442
mov bl, 1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
mov al, bl
pop ebx
ret 4
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0xac0a64
push eax
push dword fs:[0]
or ch, byte [eax + eax + 0x35ff6450]
add byte [eax], al
add byte [eax], al
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [ebx], esp
jge 0x401055
ja 0x4010fe
fld xword [esi - 7]
or al, 0xb7
dec edx
mov ch, 0xfc
outsd dx, dword [esi]
jns 0x4010cd
fcom qword [eax - 0x69d98623]
retf 0x41f8
and ecx, eax
hlt
int1
push 0xffffffffffffffb7
dec edx
mul dword [esi - 0x69]
invalid
push edx
inc edi
aas
int1
lds esi, [eax - 0x386d9885]
out 0xf1, eax
xchg edx, eax
cmp al, 0x64
loop 0x401171
sub al, 0x57
or ah, al
sti
pushal
cmpsb byte [esi], byte es:[edi]
and byte [esi + 0x7c], bl
cwde
invalid
pop ds
invalid
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40345b
pop dword [ebp - 0x30]
mov eax, 0x40345b
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe939d37
sub dword [ebp - 0x40], 0xc04157ec
mov dword [ebp - 0x3c], 0x1b691528
sub dword [ebp - 0x3c], 0xe935c8e3
mov dword [ebp - 0x38], 0x46f95829
add dword [ebp - 0x38], 0x552ec05
mov dword [ebp - 0x34], 0x45e45fe4
sub dword [ebp - 0x34], 0x45e45fe4
lea eax, [ebp - 0x40]
push eax
mov eax, 0x58a1382f
sub eax, 0x5860f7db
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x720fd162
add dword [ebp - 0x40], 0x26297f4
mov dword [ebp - 0x3c], 0xa47cf03c
sub dword [ebp - 0x3c], 0x63108ec7
mov dword [ebp - 0x38], 0x9d67a483
sub dword [ebp - 0x38], 0x39f83817
mov dword [ebp - 0x34], 0x49f10edc
add dword [ebp - 0x34], 0xb60ef124
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x9c02237b
add eax, 0x643e1cd5
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x36f0f
push 0
call eax
mov ecx, 0x7ac69c05
sub ecx, 0x7ac653b7
mov edx, eax
mov ebx, 0x942a08bd
add ebx, 0x6c167b43
add ebx, dword [ebp - 0x30]
mov edi, 0xcd9ffcf0
sub dword [ebp - 0x20], edx
mov esi, dword [ebx]
add dword [ebp - 8], 0xa214c26e
sub esi, edi
sub dword [ebp - 4], ebx
mov dword [edx], esi
xor dword [ebp - 0x28], ecx
add edx, 4
add ebx, 0x7db82f74
sub ebx, 0x7db82f70
loop 0x403572
add eax, 0x1140b
xor ebx, ebx
add ebx, eax
add eax, 0x8336cb0
sub eax, 0x8336cab
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401950
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40195a
repz ret
jmp fcn.00401c81
Function at 0x51120e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0056a160
pop ecx
test eax, eax
jne 0x511250
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00417b4d
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x511216
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x571cef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00571b65

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c5e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c9d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c9d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c9d
cmp dword [ecx + 0x74], 0xe
jbe 0x401c9d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4076b8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407755
push ebx
push esi
call fcn.00407681
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004075ca
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407702
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407754
push edi
push eax
call fcn.00405883
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407722
call fcn.00405849
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407753
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004075ca
add esp, 0x20
test eax, eax
jne 0x407741
push edi
call fcn.00405849
jmp 0x407749
push ebx
call fcn.00405849
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4079c0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x423810
push 0x423808
push str.FlsAlloc
push 0x1e
call fcn.004078de
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4079f4
push dword [ebp + 8]
mov ecx, esi
call dword [0x422460]
call esi
jmp 0x4079fa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407a3e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x423820
push 0x423818
push str.FlsGetValue
push 0x20
call fcn.004078de
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407a75
push dword [ebp + 8]
mov ecx, esi
call dword [0x422460]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40d440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d46d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d46d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x412a2e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
or ebx, 0xffffffff
push edi
mov edi, ecx
cmp esi, 8
jb 0x412ad6
mov eax, esi
shr eax, 3
mov dword [ebp - 4], eax
movzx edx, byte [edi + 2]
mov eax, ebx
movzx ecx, byte [edi + 1]
sub esi, 8
shr eax, 0x10
movzx eax, al
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
mov edx, dword [edx*4 + 0x4285b0]
shr eax, 0x18
xor edx, dword [ecx*4 + 0x427050]
movzx ecx, byte [edi + 3]
xor ecx, eax
movzx eax, byte [edi]
xor edx, dword [ecx*4 + 0x427db0]
movzx ecx, bl
xor ecx, eax
movzx eax, byte [edi + 7]
xor edx, dword [ecx*4 + 0x427930]
xor edx, dword [eax*4 + 0x428a80]
movzx eax, byte [edi + 6]
xor edx, dword [eax*4 + 0x427470]
movzx eax, byte [edi + 5]
xor edx, dword [eax*4 + 0x428ea0]
movzx eax, byte [edi + 4]
add edi, 8
xor edx, dword [eax*4 + 0x4281b0]
sub dword [ebp - 4], 1
mov ebx, edx
jne 0x412a4d
test esi, esi
je 0x412af2
movzx eax, byte [edi]
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x428a80]
inc edi
sub esi, 1
jne 0x412ada
pop edi
not ebx
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10001d20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
xor eax, eax
push esi
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
push edi
mov ecx, 0x3d69db14
lea eax, [ebp - 0x218]
mov dword [ebp - 0x244], 0
call fcn.1001a7d0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
test eax, eax
sete al
test al, al
je 0x10001dd3
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x10026968
sub edi, 0x7e80af00
lea esi, [ebp - 0x230]
call fcn.1001a850
lea edx, [ebp - 0x108]
push edx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x234], eax
jmp 0x10001e01
mov ecx, 0x3d69db14
lea eax, [ebp - 0x218]
call fcn.1001a7d0
push eax
call esi
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov word [ebp - 0x210], ax
cmp dword [ebp - 0x234], 0
jne 0x10001e38
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x23c]
mov dword [ebx], edx
mov dword [ebx + 4], eax
pop edi
mov dword [ebx + 8], ecx
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f1f5
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x238]
push edx
call esi
mov edi, 0x4bddf7b1
lea esi, [ebp - 0x230]
mov dword [ebp - 0x238], eax
call fcn.1001a890
push eax
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x238]
push 0xc
lea ecx, [ebp - 0x244]
mov esi, eax
xor eax, eax
push ecx
push edx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x21c], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [ebx + 8], edx
mov eax, ebx
pop esi
call fcn.1001f1f5
mov esp, ebp
pop ebp
ret 4

Function at 0x10002be0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4