joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b3530
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
call fcn.101b3c70
push 6
push 1
push 2
mov dword [0x10c53340], eax
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x18]
mov esi, eax
xor eax, eax
push ecx
mov dword [esp + 8], eax
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
push edx
call sub.WS2_32.dll_htons_1
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
jge 0x101b359f
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x101b37b0
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x10
push esi
call fcn.101b3c70
push 0
push 2
push 2
mov dword [0x10c53344], eax
call sub.WS2_32.dll_socket
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov word [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], eax
push ecx
call sub.WS2_32.dll_htons_1
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call sub.WS2_32.dll_bind
test eax, eax
jge 0x101b381b
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x101b38a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov ecx, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x118]
mov dword [esp + 0xc], 0x10
test ecx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 1
jne 0x101b38db
push ecx
push ecx
push ecx
lea eax, [esp + 0x1c]
lea ecx, [esi + 1]
push eax
push ecx
jmp 0x101b3933
cmp ecx, 0xffffffff
jne 0x101b38f2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x101b3921
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0x10]
push eax
push 0
push 0
lea edx, [esi + 1]
push ecx
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x101b3947
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
lea eax, [esp + 0x10]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x101b398c
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x128]
push edx
push 0
push eax
push ecx
push esi
call sub.WS2_32.dll_recvfrom
test eax, eax
jg 0x101b3991
mov eax, 0xfffffffc
pop esi
add esp, 0x110
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x110
ret
Function at 0x101b3ab0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x101b3ae3
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x101b3b3b
cmp ecx, 0xffffffff
jne 0x101b3afa
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x101b3b29
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x101b3b4f
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x101b3b88
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x120]
push 0x10
push ecx
push 0
push edx
push eax
push esi
call sub.WS2_32.dll_sendto
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret

Function at 0x101b3bc0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push esi
push 0x100
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jge 0x101b3be4
xor eax, eax
pop esi
add esp, 0x104
ret
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x101b3c00
pop esi
add esp, 0x104
ret
push ebx
push ebp
mov ebp, dword [esp + 0x114]
push edi
xor ebx, ebx
jmp 0x101b3c12
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x101b3c61
push 0x100
call fcn.101dfd27
mov dword [ebp + ebx*4], eax
mov eax, dword [esi + 0xc]
add esp, 4
mov ecx, dword [eax + ebx*4]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + ebx*4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0xa
rep movsb byte es:[edi], byte [esi]
jl 0x101b3c0e
pop edi
mov eax, ebx
pop ebp
pop ebx
pop esi
add esp, 0x104
ret

Function at 0x101b3ce0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x101b3d16
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret
Function at 0x101b68b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x101b6a05
cmp di, 0x801
ja 0x101b6a05
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x101b6a05
cmp bx, 0xc
ja 0x101b6a05
mov al, byte [esp + 0x30]
test al, al
je 0x101b6904
push edi
call fcn.101b6e40
add esp, 4
cmp ax, bx
je 0x101b6904
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.101b6a10
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.101b6830
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x101b6a05
test ebx, ebx
jne 0x101b6999
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x101b69fb
test al, al
je 0x101b698c
push 0xffffffffffffffe1
jmp 0x101b698e
push 0x1f
push ebp
push edi
push esi
call fcn.101b67e0
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.101b67e0
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.101b6a10
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.101b6830
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x101b6966
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x101b8090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101fd9d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0x10c53398
lea ecx, [esp + 4]
call fcn.101ef950
push 0x10c26994
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call fcn.101ef950
push 0x10c26990
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.101ef950
push 0x10c2698c
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.101ef950
push 0x10c26988
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call fcn.101ef950
push 0x10c26984
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.101ef950
push 0x10c26980
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call fcn.101ef950
push 0x10c2697c
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call fcn.101ef950
push 0x10c26978
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call fcn.101ef950
push 0x10c26974
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call fcn.101ef950
push 0x10c26970
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call fcn.101ef950
push 0x10c2696c
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call fcn.101ef950
push 0x10c26968
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call fcn.101ef950
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x101b81c0
cmp eax, 0xc
jle 0x101b81c0
mov ecx, dword [esp + 0x48]
push 0x10c53398
call fcn.101efa1f
jmp 0x101b81ce
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.101ef9cf
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.101ef8e2
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call fcn.101ef8e2
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call fcn.101ef8e2
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.101ef8e2
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call fcn.101ef8e2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call fcn.101ef8e2
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.101ef8e2
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.101ef8e2
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.101ef8e2
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call fcn.101ef8e2
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.101ef8e2
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.101ef8e2
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call fcn.101ef8e2
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x101bead0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x10c5f530]
xor edx, edx
cmp eax, edx
jne 0x101beaf6
xor eax, eax
mov byte [eax + 0x10c5f430], al
inc eax
cmp eax, 0x100
jl 0x101beade
mov dword [0x10c5f530], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x10c5f430
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x101beb87
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x101beb5a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x101beb28
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x101beb90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x101bebe3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x101bebca
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101c5590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101fdd6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.101c5eb0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x1049f5b4
call fcn.101ef623
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x101c5623
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.101ef623
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x101c561c
push 0
mov ecx, eax
call fcn.101bc700
mov dword [esi + 0xc], eax
jmp 0x101c5625
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x101c5625
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x101f1c96
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x101f1cce
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.101efd3d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.101efd15
jmp 0x101f1cda
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x101f3387
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x101f33c9
call fcn.101f8d28
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x101f33c9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x101f33c0
xor eax, eax
jmp 0x101f33d1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.101f33d7
pop edi
pop esi
pop ebx
ret 4
Function at 0x134f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0134f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x134f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x134f06a
add dl, dl
jne 0x134f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x134f0dc
xor eax, eax
add dl, dl
jne 0x134f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x134f17d
add dl, dl
jne 0x134f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x134f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x134f075
mov eax, 1
add dl, dl
jne 0x134f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x134f0e1
sub eax, ebx
mov ebx, 1
jne 0x134f128
mov ecx, 1
add dl, dl
jne 0x134f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x134f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x134f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x134f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x134f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x134f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x134f136
cmp eax, 0x7d00
jae 0x134f16d
cmp eax, 0x500
jb 0x134f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x134f075
cmp eax, 0x7f
ja 0x134f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x134f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x134f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x134f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40b4cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [ebx + 0x24]
jmp 0x40a1ab
xor eax, dword [ebp + 0x10]
jmp 0x40b9fa
cmp al, 0x40
jmp 0x40df9b
add eax, dword [ebx + 0x1c]
jmp 0x40b5da
xor ebx, ebx
jmp 0x41055a
shl eax, 2
jmp 0x4024d7
jmp 0x40e4dd
pop edi
jmp 0x4106bc
push ebx
jmp 0x412be6
push edi
jmp 0x404aed
jmp 0x40e4dd
jne 0x4068a2
jmp 0x4095fd
sub ecx, 1
jmp 0x40823b
push edx
jmp 0x402cf1
stosb byte es:[edi], al
jmp 0x40f953
push esi
jmp 0x4127d1
mov ebp, esp
jmp 0x4079a7
mov edx, dword [edx]
jmp 0x413010
jne 0x412f95
jmp 0x41251a
cmp dword [ebp + 0x14], 0
jmp 0x40524a
jmp 0x4024d7
add eax, edi
jmp 0x413339
jmp 0x408f59
movzx eax, word [eax]
jmp 0x402a6a
call fcn.00410334
jmp 0x40f054
mov eax, dword [esi]
jmp 0x40d1e0
sub eax, dword [ebp - 0x10c]
jmp 0x405509
test ax, ax
jmp 0x40c9ee
add esp, 0xfffffef4
jmp 0x402c85
mov ecx, dword [ecx + 0xc]
jmp 0x40e736
mov eax, ecx
jmp 0x409556
cmp al, 0x5b
jmp 0x408bdf
call fcn.00410334
jmp 0x4020ec
jg 0x403bf7
jmp 0x40cc19
xor eax, eax
jmp 0x40d099
mov ebx, dword [ebx]
jmp 0x40937b
add ebx, edi
jmp 0x4105e3
mov edi, dword [ecx + 0x18]
jmp 0x40e4dd
jne 0x40e048
jmp 0x4056fb
shl eax, 1
jmp 0x40196d
jmp 0x408f59
jne 0x4025bc
jmp 0x40c6b5
je 0x4036c1
jmp 0x41321f
lea ebx, [ebx + 0x78]
jmp 0x40aee9
add eax, edi
jmp 0x405df6
mov eax, dword [ebx + 8]
jmp 0x40917c
push ebp
jmp 0x404e78
mov eax, dword [eax]
jmp 0x4055d0
add eax, edi
jmp 0x40b599
test eax, eax
jmp 0x409c30
lea edi, [ebp - 0x104]
jmp 0x40ca59
pop dword [ebp - 0x10c]
jmp 0x405389
mov edi, dword [ebp + 0xc]
jmp 0x402be9
add esi, 4
jmp 0x40e73d
jne 0x41055a
jmp 0x40cc2f
push edi
jmp 0x41053d
jne 0x40e736
jmp 0x40942c
add al, 0x20
jmp 0x403bf7
pop eax
jmp 0x405e32
add ebx, dword [ebx + 0x3c]
jmp 0x409d8f
xor ecx, ecx
jmp 0x412f31
jmp 0x413339
or eax, eax
jmp 0x4094d0
jl 0x403bf7
jmp 0x408918
add eax, edi
jmp 0x40c6ed
mov ebx, edi
jmp 0x40cd8c
mov ecx, dword [ecx]
jmp 0x40bc0e
inc ecx
jmp 0x408990
je 0x40ea0d
jmp 0x4132f5
mov ecx, dword fs:[0x30]
jmp 0x411e2a
pop ecx
jmp 0x4129f2
xor eax, dword [ebp + 0xc]
jmp 0x40cbc9
mov esi, dword [ebx + 0x20]
jmp 0x412765
pop dword [ebp - 0x108]
jmp 0x40f2ea
inc ebx
jmp 0x4072fe
leave
jmp 0x4103c4
ret 0x10
lea edx, [ecx + 0x30]
jmp 0x404ea0
mov ax, word [edx + ebx*2]
jmp 0x4021e9
push dword [ebx + 0x10]
jmp 0x40c476
pop edx
jmp 0x40ef9a
mov ecx, dword [ecx + 0xc]
jmp 0x40818e
push dword [ebx + 0x18]
jmp 0x40f788
add esi, edi
jmp 0x40cf3e
cmp dword [ebp + 8], 0
jmp 0x40e9a0
pop ebx
jmp 0x40fdc0
push ecx
jmp 0x4038a0
jmp 0x41321f
mov eax, dword [ebp + 0x10]
jmp 0x4068f5
or edx, edx
jmp 0x409c25
cmp dword [ebp - 0x108], ecx
jmp 0x403384
mov edi, dword [ebp + 8]
jmp 0x403101
pop esi
jmp 0x402c1b

Function at 0x423ace
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423791

Function at 0x423ad9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423912

Function at 0x429a8a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042974a
Function at 0x100db2b0
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
sti
push ss
or eax, 0xfbc32d26
mov bl, 0x3b
xor byte [ecx + 0x952adc0], 0x11
mov al, byte [0xe85f1bf6]
invalid
xchg edx, eax
jg 0x100db2b3
call fcn.100d3247
xor eax, 0x22ab432b
invalid
push dword [0x22ab432b]
jge 0x100db30b
cmp dword [edi + 0x30], edx
in eax, 0x2d
aad 0xfd
lds ecx, [ebp + 0x55]
in eax, dx
lds ecx, [0x9b846d35]
or al, byte [ecx - 0x1a20eac6]
les ebx, [edx + 0x12e7a992]
jge 0x100db29b
pop ds
aam 0xbb
sahf
xchg esi, eax
invalid
xchg dword [ebx - 0x29], ecx
mov ecx, 0xcb3e4650
sti
push ebp
and byte [esi - 0x3a125aaf], ch
dec ebp
xor byte fs:[edi - 0x80], 0x7c
int3

Function at 0x100e801e
Capabilities:
Encode data using xor

Disassembly:
call fcn.10100f8a
cmp dword [ecx + 0x51], 0x79
rcr ah, 0xe7
pop dword [bx + di]
add byte [ebx - 0x3f86ae87], al
fsubr st(7), st(0)
cmp edx, dword [ebp + eax*8 - 0x27ef673e]
adc byte [eax + 0x10], bh
sbb byte [eax + 0x403870b8], ah
pop ss
out dx, al
pop ebp
xor al, 0x17
mov al, byte [0xfbde7260]
rcr dword [eax], 1
popfd
out dx, al
xchg edx, eax
rcl byte [ecx + ecx*8], 0x40
scasd eax, dword es:[edi]
pop es
pop esi
mov dword [ebp - 0x73], eax
add al, 0xdb
and cl, byte [ebp + 0x24]
inc eax
xchg edi, eax
jl 0x100e801f
invalid
xor bh, byte [ecx + 0x5f]
lahf
lea esi, [esi]
je 0x100e802c
movntps xmmword [ebx + ecx*4], xmm6
cmpsd dword [esi], dword es:[edi]
iretd

Function at 0x1010ae87
Capabilities:
Encode data using xor

Disassembly:
or eax, eax
invalid
test al, 0xc9
or ebx, dword [ebp + esi*2 - 0x39]
mov ebx, 0xdb95fc5e
pop ecx
test dword [ecx], ecx
bound esp, qword [edx]
or edi, dword [ebx]
mov al, byte [0x57cb8a04]
retf
add al, 0x8a
retf
jle 0x1010ae2f
jle 0x1010ae34
add byte [eax + ebp*2], dl
jp 0x1010ae47
cmc
pop ebp
in eax, dx
push dx
pop ebp
cld
pop esi
imul edx, dword [ebx - 0x45], 0x3764605f
clc
and al, 0x2c
xor ch, dh
push dword [esp]
cmp al, 9
push dword [esp]
lea esp, [esp + 0xc]
ja 0x1010bbee
stc
call fcn.1010bbfa
mov ecx, 0x104
pushfd
push dword [esp + 8]
bt bp, 2
in eax, 2
sub al, al
call fcn.1010aafa
aas
cmp esi, dword [eax + 0x33857243]
jne 0x1010ae94
sub eax, 0xa4062989
mov ebx, 0x823c0f3d
mov al, byte [0x175bee8b]
xchg ebp, eax
fcom qword [edi + 0x31aa6c58]
aas
or dword [ebx + 0x5d3fc514], 0x5a
inc esp
mov dword [0x887f5590], eax
jg 0x1010ae52
dec esi
add eax, 0x8cd501c9
div dword [edx]
clc
xor bh, al
xor al, 0xab
push esi
mov esp, 0x67fe878c
add eax, 0x134103e9
clc
cmp eax, 0xdffdc126
sbb ch, byte [ebx]
or byte [0xd7f4578d], dh
cmp eax, 0xbcc52313
or al, 0x1c
outsb dx, byte [esi]
js 0x1010aec8
cwde
sbb byte [0xaa67a146], dh
pop ss
test dword [eax + esi*4], esi
push ds
mov al, 0xac
cdq
sbb eax, 0xf690b93b
pop edi
pushal
jp 0x1010aed1
fadd dword [eax]
add byte [edi + ebp*2 + 0x63], cl
popal
insb byte es:[edi], dx
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
dec ecx
clc
enter 0x3007, 0x7c
invalid
Function at 0x1010b7aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, dh
dec eax
push ebp
pushfd
pop eax
movzx ax, cl
test dl, 0x17
mov ebp, esp
inc ah
sub esp, 0x10
bswap eax
push esi
inc ax
aas
rol eax, 7
rol eax, 0x12
push edi
daa
btr ax, 6
neg ax
push ebx
bts ax, 3
cwde
push edx
rcr ax, 0xa
mov eax, dword [ebp + 8]
stc
cmc
clc
test eax, eax
push 0x8a51e6d4
jmp 0x1010deba
lea esp, [esp + 4]
je 0x1010b8e6
btc esi, edx
xor edx, edi
rol edx, 1
mov esi, dword [eax + 0x3c]
pushal
add esi, eax
sub dh, cl
or dh, bl
mov edx, dword [esi + 0x78]
push dword [esp + 4]
pushal
mov byte [esp + 4], ch
jmp 0x1010f494
test edx, edx
call fcn.10109100
mov dword [esp], 0x1503f2cb
push dword [esp + 0x24]
pop dword [ebp]
push eax
mov byte [esp + 4], dh
lea esp, [esp + 0x2c]
jmp 0x101110aa

Function at 0x1010fec4
Capabilities:
Check for software breakpoints

Disassembly:
sub al, 0x78
mov byte [esp], ah
neg al
not ch
rcl ch, cl
pop ecx
sub esi, 1
jnp 0x10110bf2
shrd cx, si, 0xc
xor bl, al
push 0xca9f8d2a
movzx eax, al
pop ecx
cmc
setne cl
setl ch
mov ecx, dword [eax*4 + 0x1010f796]
jmp 0x1010ff7e
cmc
pushal
pushal
rol ecx, 0x1f
pushfd
call fcn.10110715
cmc
pushal
shr al, cl
mov word [esp + 4], dx
push dword [esp + 8]
mov word [ebp + 4], ax
call fcn.1011119e
stc
mov byte [esp], 0x46
rol ecx, 0x1f
cmp cl, 0xcc
pushal
pushfd
add ecx, 0
jmp 0x10111014
test ah, cl
shld ecx, ebx, cl
pushfd
pushfd
xor bl, al
stc
rcl ch, 6
ror cx, cl
movzx eax, al
bt ax, 7
ror cx, cl
bt ebp, 1
mov ecx, dword [eax*4 + 0x1010f796]
stc
jmp 0x101103ad
call fcn.101109f1