joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1055d0c0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
lea ecx, [esp]
push esi
push eax
push ecx
call fcn.1055d080
push 0
push 0x80
push 3
push 0
push 3
lea edx, [esp + 0x18]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x1055d12f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1055d116
cmp eax, 3
ja 0x1055d116
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1055d124
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x1055d140
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
mov al, 0x5c
push esi
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 7], al
push 0
mov al, 0x6e
push 0x80
push 3
mov byte [esp + 0x15], al
mov byte [esp + 0x17], al
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x55
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x1055d1e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1055d1c7
cmp eax, 3
ja 0x1055d1c7
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x1055d1d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x10563890
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, 4
sub esi, ecx
lea eax, [edi + ecx]
lea edx, [esp + ebp + 0x10]
add edi, ebx
mov cl, byte [esi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, 4
inc eax
dec ebx
jne 0x105638b3
inc ebp
cmp ebp, 4
jl 0x1056389b
cmp edi, 0xb0
jge 0x1056396a
mov ebp, 0x105422f8
xor eax, eax
lea ecx, [esp + 0x10]
inc eax
mov edx, eax
and edx, reloc.WSOCK32.dll_closesocket
jns 0x105638ee
dec edx
or edx, 0xfffffffc
inc edx
xor ebx, ebx
add ecx, 4
mov bl, byte [esp + edx*4 + 0x13]
mov dl, byte [ebx + 0x105420f8]
mov bl, byte [ecx - 4]
xor bl, dl
cmp eax, 4
mov byte [ecx - 4], bl
jl 0x105638de
mov al, byte [ebp]
mov cl, byte [esp + 0x10]
xor cl, al
add ebp, 4
mov byte [esp + 0x10], cl
mov esi, 1
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov dl, byte [eax - 1]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
add eax, 4
dec ecx
jne 0x10563928
inc esi
cmp esi, 4
jl 0x1056391f
xor esi, esi
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov ebx, dword [esp + 0x24]
mov dl, byte [eax]
add eax, 4
mov byte [edi + ebx], dl
inc edi
dec ecx
jne 0x10563948
inc esi
cmp esi, 4
jl 0x1056393f
cmp edi, 0xb0
jl 0x105638d8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10563980
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebp
push esi
call fcn.10563a10
add esp, 8
lea edi, [ebp + 0x10]
mov ebx, 9
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x105420f8]
mov byte [eax + esi - 1], dl
jl 0x105639a0
push 0
push esi
call fcn.10563a40
push esi
call fcn.10563a90
push edi
push esi
call fcn.10563a10
add esp, 0x14
add edi, 0x10
dec ebx
jne 0x1056399e
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x105420f8]
mov byte [eax + esi - 1], dl
jl 0x105639d5
push 0
push esi
call fcn.10563a40
add ebp, 0xa0
push ebp
push esi
call fcn.10563a10
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10563a10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push ebx
push esi
sub ecx, eax
mov esi, 0x10
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x10563a21
pop esi
pop ebx
ret

Function at 0x10563bb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
lea eax, [ebp + 0xa0]
push eax
push esi
call fcn.10563a10
add esp, 8
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x105421f8]
mov byte [eax + esi - 1], dl
jl 0x10563bce
push 0x10
push esi
call fcn.10563a40
add esp, 8
lea edi, [ebp + 0x90]
mov ebx, 9
push edi
push esi
call fcn.10563a10
push esi
call fcn.10563c40
add esp, 0xc
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x105421f8]
mov byte [eax + esi - 1], dl
jl 0x10563c0b
push 0x10
push esi
call fcn.10563a40
add esp, 8
sub edi, 0x10
dec ebx
jne 0x10563bf9
push ebp
push esi
call fcn.10563a10
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10563c40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor edi, edi
lea eax, [esp + edi + 0x14]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
sub eax, ecx
mov esi, 1
mov dword [esp + 0x10], eax
lea edx, [esi - 2]
and edx, 3
add edx, edi
mov al, byte [edx + ebp]
push eax
push 9
call fcn.10563b60
lea ecx, [esi + 1]
mov bl, al
and ecx, 3
add ecx, edi
mov dl, byte [ecx + ebp]
push edx
push 0xd
call fcn.10563b60
xor bl, al
mov eax, esi
and eax, 3
add eax, edi
mov cl, byte [eax + ebp]
push ecx
push 0xb
call fcn.10563b60
mov edx, dword [esp + 0x28]
xor bl, al
mov eax, dword [esp + 0x40]
mov cl, byte [edx + eax]
push ecx
push 0xe
call fcn.10563b60
add esp, 0x20
xor bl, al
mov eax, dword [esp + 0x28]
inc esi
mov byte [eax], bl
lea edx, [esi - 1]
inc eax
cmp edx, 4
mov dword [esp + 0x28], eax
jl 0x10563c66
add edi, 4
cmp edi, 0x10
jl 0x10563c4d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebp], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
pop edi
mov dword [ebp + 0xc], eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x105714b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x105714d3
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.105711a0
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.105711f0
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.10571290
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.1054f600
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x10542b54
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10571583
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.10571480
test ax, ax
je 0x1057154d
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x1057156f
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x1057156f
lea ecx, [esp + 0xa]
push esi
push ecx
call fcn.1054f710
test al, al
jne 0x10571583
jmp 0x1057157e
lea edx, [esp + 8]
push esi
push edx
call fcn.1054f670
test al, al
jne 0x10571583
mov word [esi], 0
mov ax, word [esi]
test ax, ax
je 0x1057159e
cmp ax, 0xffff
je 0x1057159e
pop esi
mov eax, 1
pop ebx
add esp, 0x40
ret 8
pop esi
xor eax, eax
pop ebx
add esp, 0x40
ret 8
Function at 0x105715b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x105715d3
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.105711a0
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.105711f0
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.10571290
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.1054f600
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x10542b54
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1057167e
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.10571480
test ax, ax
je 0x1057167e
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x1057167e
cmp byte [esp + eax + 0xa], 0x3a
jne 0x1057167e
lea edx, [esp + eax + 0xb]
push esi
push edx
call fcn.1054f670
test al, al
je 0x10571679
mov ax, word [esi]
cmp ax, 1
jl 0x10571679
cmp ax, 7
jle 0x1057167e
mov word [esi], 0
xor eax, eax
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x40
ret 8

Function at 0x10571690
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push 0x10
push eax
call fcn.105711a0
lea ecx, [esp + 0x24]
push 0x10
push ecx
call fcn.105711f0
lea edx, [esp + 0x14]
push 0x10
push edx
call fcn.10571350
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.10571310
lea ecx, [esp + 4]
lea edx, [esp + 0x34]
push ecx
push 0x10
push edx
lea eax, [esp + 0x20]
push 0x10542b54
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x10571700
lea edx, [esp + 0x34]
lea eax, [esp + 0x44]
push edx
push eax
call fcn.1054f4b0
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x50
ret 8

Function at 0x10571710
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp]
push 0x10
push eax
call fcn.105711a0
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.105711f0
lea edx, [esp + 0x10]
push 0x10
push edx
call fcn.105712d0
lea eax, [esp]
lea ecx, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor edx, edx
mov ecx, dword [esp + 0x34]
test eax, eax
setne dl
mov word [ecx], ax
mov al, dl
add esp, 0x30
ret 4
Function at 0x10571770
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
lea eax, [esp]
push esi
mov esi, dword [esp + 0x78]
push 0x10
push 0
push eax
mov word [esi], 0
call fcn.1054f620
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.105711a0
lea edx, [esp + 0x34]
push 0x10
push edx
call fcn.105711f0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.10571240
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.105713a0
lea edx, [esp + 0x54]
push 0x10
push edx
call fcn.10571430
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.105713f0
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
push 0x10
push edx
lea eax, [esp + 0x30]
push 0x10542b54
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1057185e
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push eax
call fcn.1054f4b0
test al, al
je 0x1057181f
xor eax, eax
mov word [esi], 2
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea ecx, [esp + 0x54]
lea edx, [esp + 4]
push esp
and al, 4
Function at 0x45d590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3a000]
push edi
or ebp, 0xffffffff
jmp 0x45d5b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45d5b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d5a8
mov eax, 1
add ebx, ebx
jne 0x45d5cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45d5c0
jne 0x45d5dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d5c0
xor ecx, ecx
sub eax, 3
jb 0x45d5f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45d662
mov ebp, eax
add ebx, ebx
jne 0x45d5fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45d608
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45d62c
inc ecx
add ebx, ebx
jne 0x45d618
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45d60d
jne 0x45d629
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d60d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45d64c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45d63d
jmp 0x45d5ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45d64c
add edi, ecx
jmp 0x45d5ae
pop esi
mov edi, esi
mov ecx, 0x1e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45d66a
cmp byte [edi], 0
jne 0x45d66a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45d66f
lea edi, [esi + 0x5b000]
mov eax, dword [edi]
or eax, eax
je 0x45d6de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5d22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5d298]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45d69c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5d2a0]
or eax, eax
je 0x45d6d8
mov dword [ebx], eax
add ebx, 4
jmp 0x45d6b9
call dword [esi + 0x5d29c]
mov ebp, dword [esi + 0x5d2a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45d712
sub esp, 0xffffff80
jmp 0x401820
Function at 0x1000bb40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 6]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x1000bbc7
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x1000bbbc
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x28
mov dword [ebp - 0x10], edx
jmp 0x1000bb63
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000c23d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
mov eax, ecx
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov al, byte [edx + eax]
xor byte [ecx + str.._._._..._._._.._._...], al
inc ecx
cmp ecx, 0x1800
jl 0x1000c242
pop ebp
ret

Function at 0x1000c25f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x1000c286
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
mov eax, esi
cdq
idiv edi
mov eax, dword [ebp + 0x10]
sub eax, edx
mov al, byte [eax + edi - 1]
xor byte [ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x1000c26a
pop esi
pop ebp
ret
Function at 0x1000c7ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push str.._._._..._._._.._._...
mov esi, 0x800
push esi
mov ebx, 0x10037828
push ebx
mov edi, 0x1800
call fcn.1000c25f
add esp, 0xc
xor eax, eax
xor byte [eax + 0x10037828], 0x8a
inc eax
cmp eax, esi
jl 0x1000c7e3
push esi
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.10008237
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movzx edi, ax
add esp, 0x10
test di, di
jle 0x1000c8b2
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movzx esi, ax
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movsx ebx, di
pop ecx
pop ecx
movzx ecx, ax
mov eax, dword [0x10043a0c]
shl ebx, 3
lea edi, [ebx + eax]
movsx eax, si
dec eax
mov word [edi], si
je 0x1000c87d
dec eax
je 0x1000c867
dec eax
jne 0x1000c892
movsx eax, cx
push eax
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10008382
pop ecx
pop ecx
push eax
push dword [edi + 4]
call fcn.1001f330
add esp, 0xc
jmp 0x1000c892
lea eax, [ebp - 0x10]
push eax
call fcn.10008250
pop ecx
mov ecx, dword [0x10043a0c]
mov dword [ebx + ecx + 4], eax
jmp 0x1000c892
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
pop ecx
mov ecx, dword [0x10043a0c]
mov word [ebx + ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movzx edi, ax
pop ecx
test di, di
jg 0x1000c812
mov esi, 0x800
mov ebx, 0x10037828
push esi
push 0
push ebx
call fcn.10020520
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000cf14
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx], 0
mov eax, 0x52964ee9
je 0x1000cf35
push esi
movzx edx, word [ecx]
mov esi, eax
movzx edx, dx
ror esi, 8
add esi, edx
inc ecx
xor eax, esi
cmp byte [ecx], 0
jne 0x1000cf1f
pop esi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x13fe163
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 0x28]
stc
btr bx, 0x8a
jmp 0x1234ed8
xor ebp, 0xc387565
inc ebp
mov cl, dh
cmovnp ecx, esp
cmc
not ebp
btr si, 0x41
ror edx, 0x5a
mov bl, 0xdf
rol ebp, 1
sub ebp, 0x549966b4
xor ebp, 0x68e27bce
and dx, 0x2261
test ebp, 0x42d46372
not ebp
sub ebp, 0x370d42b5
bswap ebp
not dh
cmc
rol ebp, 1
add ecx, edx
add ebp, eax
mov edi, esp
bsf esi, edi
sub esp, 0xc0
mov ecx, esi
mov ebx, ebp
mov edx, 0
cmc
btc ecx, esi
sub ebx, edx
lea esi, [0x1234f37]
sar ecx, cl
bts ecx, esi
lea ebp, [ebp - 4]
mov ecx, dword [ebp]
cmp edi, 0x6fe75bb9
stc
xor ecx, ebx
test di, 0x511c
neg ecx
clc
test ebx, 0x657a7878
cmp si, bx
xor ecx, 0x43185a03
dec ecx
bswap ecx
add ecx, 0x1a361be9
jmp 0x13f7cf5
push esi
ret
rol ecx, 2
test si, dx
stc
xor ebx, ecx
add esi, ecx
jmp 0x1354657
push eax
push esi
push ecx
cmovle esi, ebx
push edx
push ebx
rdtsc
not edx
movzx esi, dx
push edi
rdtsc
cwd
pushfd
clc
cdq
stc
push ebp
movsx edi, bx
cwde
xor bh, 0xba
mov eax, 0
rol edx, cl
shld dx, cx, 0x20
push eax
or edi, 0x54e8447a
jmp 0xf8fab8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41b8a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x41b8b7
pop dword [ebp - 0x28]
mov eax, 0x3c474824
sub eax, 0x3c058f6d
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x40303
push 0
mov eax, 0x52b9c187
add eax, 0xad889091
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x2d5b9085
add ecx, 0xd2a4bc1a
mov edx, eax
mov esi, 0xe6f67d51
sub esi, 0xe6b32951
add esi, dword [ebp - 0x28]
mov ebx, 0xe22f16cf
add ebx, 0x298b95b4
xor dword [ebp - 0x18], ebx
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0x10], edi
mov dword [edx], edi
sub dword [ebp - 4], edi
add edx, 4
add esi, 0x830dc8c1
sub esi, 0x830dc8bd
loop 0x41b916
add eax, 0x1254f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfeae6a92
add ecx, 0x191956e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x4723122e
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x724539d3
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a7cce
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1e7a7d09
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1e7a7cf0
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1e7a7d01
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1e7a7d0b
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1e7a7ce6
xor eax, eax
pop edi
pop esi
ret

Function at 0x1e7a7f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x1e7a7f4e
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a7c53
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1e7a7f7c
adc byte [ebp - 0xaf73], cl
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1e7a7c8e
lodsb al, byte [esi]
adc byte [ecx - 0x3fba722a], dh
push eax
call fcn.1e7a7c9e
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a7c53
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1e7a7c8e
mov al, 0xb1
push 0xffffffffffffff8d
inc ebp
call 0x6f62dd84
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
out dx, al
int 0xc6
inc ebp
out dx, eax
retf
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
rol esi, cl
inc ebp
stc