joyce8/EMBER2024-capa huggingface dataset:
Function at 0x794338
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x794459
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x79443d
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x79438f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x79436d
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x794e15
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
mov ebp, dword [edx + 0x1058]
push edi
mov edi, dword [edx + 0x1064]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x20]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x794f59
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1060]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x794f33
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x794e7e
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1058]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1058]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x794e55
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x795082
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
mov ebp, dword [edx + 0x1058]
push edi
mov edi, dword [edx + 0x1064]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x20]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x7951c6
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1060]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x7951a0
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x7950eb
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1058]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1058]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x7950c2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x7951ce
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x20]
mov eax, dword [edx + 0x20]
push esi
mov esi, dword [edx + 0x1064]
push edi
mov edi, dword [edx + 0x1058]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x795304
push ebx
mov edx, dword [edx + 0x1060]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x7952df
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x79522d
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1058]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1058]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x795209
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret

Function at 0x7a3853
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x7a3876
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x7a389c
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x7a3883
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret
Function at 0x7a3953
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x7a3985
push esi
call fcn.007ad3b3
mov eax, dword [esi + 0x40]
test eax, eax
je 0x7a397e
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x7a3a08
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x7a39f3
lea ebx, [ebx]
mov eax, dword [esi + 8]
test eax, eax
je 0x7a39ad
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x7a39ed
cmp eax, 2
je 0x7a39f3
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x7a39a3
cmp eax, 3
je 0x7a39d0
cmp eax, 1
jne 0x7a39a3
mov eax, dword [ecx + 4]
inc eax
mov edx, eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 8]
cmp edx, eax
jl 0x7a39a3
mov edx, dword [esi + 0x144]
add edx, eax
mov dword [ecx + 8], edx
jmp 0x7a39a3
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.007a3853
pop esi
ret 4
cmp ecx, 0xcc
je 0x7a3a1f
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.007a3853
pop esi
ret 4

Function at 0x7afe95
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x7afea4
xor eax, eax
jmp 0x7aff87
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x7aff67
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
inc edx
dec edi
jne 0x7afec4
pop edi
test eax, eax
je 0x7aff81
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x1011b618]
inc edx
dec eax
jne 0x7aff6b
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x8913e1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x89140f
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x891416
cmp ebx, dword [eax + 4]
jae 0x891416
xor eax, eax
jmp 0x891606
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x891427
xor eax, eax
inc eax
jmp 0x891605
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x89143d
cmp ecx, edx
jae 0x891582
cmp dword [eax + 4], 0
je 0x891446
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x89142e
cmp dword [ebp + 8], 0
je 0x891468
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x891582
cmp eax, esi
jae 0x891582
mov eax, dword [0x10013460]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x89148d
cmp dword [esi*4 + 0x10013468], edi
je 0x891586
inc esi
cmp esi, eax
jl 0x89147b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x1000d13c]
test eax, eax
je 0x891602
cmp dword [ebp - 8], 0x1000000
jne 0x891602
test byte [ebp - 0xc], 0xcc
je 0x89150b
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x891602
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x891602
cmp word [eax + 0x18], 0x10b
jne 0x891602
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x891602
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x89150b
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x89150b
test byte [ecx + 0x27], 0x80
jne 0x891582
push 1
push 0x100134a8
call dword [0x1000d01c]
test eax, eax
jne 0x89141f
mov ecx, dword [0x10013460]
test ecx, ecx
mov edx, ecx
jle 0x89153f
lea eax, [ecx*4 + 0x10013464]
cmp dword [eax], edi
je 0x89153f
dec edx
sub eax, 4
test edx, edx
jg 0x891533
test edx, edx
jne 0x891570
push 0xf
pop ebx
cmp ecx, ebx
jg 0x89154c
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x891564
lea eax, [edx*4 + 0x10013468]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x891552
cmp ecx, 0x10
jge 0x891570
inc ecx
mov dword [0x10013460], ecx
push 0
push 0x100134a8
call dword [0x1000d01c]
jmp 0x89141f
xor eax, eax
jmp 0x891605
test esi, esi
jle 0x89141f
mov ebx, dword [0x1000d01c]
push 1
push 0x100134a8
call ebx
test eax, eax
jne 0x89141f
cmp dword [esi*4 + 0x10013468], edi
je 0x8915dc
mov eax, dword [0x10013460]
lea esi, [eax - 1]
test esi, esi
jl 0x8915ca
cmp dword [esi*4 + 0x10013468], edi
je 0x8915c6
dec esi
jns 0x8915ba
test esi, esi
jge 0x8915da
cmp eax, 0x10
jge 0x8915d5
inc eax
mov dword [0x10013460], eax
lea esi, [eax - 1]
jmp 0x8915dc
je 0x8915f4
xor ecx, ecx
test esi, esi
jl 0x8915f4
lea eax, [ecx*4 + 0x10013468]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x8915e2
push 0
push 0x100134a8
call ebx
jmp 0x89141f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8abacf
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x8abafd
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x8abb04
cmp ebx, dword [eax + 4]
jae 0x8abb04
xor eax, eax
jmp 0x8abcf4
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x8abb15
xor eax, eax
inc eax
jmp 0x8abcf3
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x8abb2b
cmp ecx, edx
jae 0x8abc70
cmp dword [eax + 4], 0
je 0x8abb34
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x8abb1c
cmp dword [ebp + 8], 0
je 0x8abb56
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x8abc70
cmp eax, esi
jae 0x8abc70
mov eax, dword [0x7c133b68]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x8abb7b
cmp dword [esi*4 + 0x7c133b70], edi
je 0x8abc74
inc esi
cmp esi, eax
jl 0x8abb69
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x7c12e0cc]
test eax, eax
je 0x8abcf0
cmp dword [ebp - 8], 0x1000000
jne 0x8abcf0
test byte [ebp - 0xc], 0xcc
je 0x8abbf9
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x8abcf0
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x8abcf0
cmp word [eax + 0x18], 0x10b
jne 0x8abcf0
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x8abcf0
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x8abbf9
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x8abbf9
test byte [ecx + 0x27], 0x80
jne 0x8abc70
push 1
push 0x7c133bb0
call dword [0x7c12e000]
test eax, eax
jne 0x8abb0d
mov ecx, dword [0x7c133b68]
test ecx, ecx
mov edx, ecx
jle 0x8abc2d
lea eax, [ecx*4 + 0x7c133b6c]
cmp dword [eax], edi
je 0x8abc2d
dec edx
sub eax, 4
test edx, edx
jg 0x8abc21
test edx, edx
jne 0x8abc5e
push 0xf
pop ebx
cmp ecx, ebx
jg 0x8abc3a
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x8abc52
lea eax, [edx*4 + 0x7c133b70]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x8abc40
cmp ecx, 0x10
jge 0x8abc5e
inc ecx
mov dword [0x7c133b68], ecx
push 0
push 0x7c133bb0
call dword [0x7c12e000]
jmp 0x8abb0d
xor eax, eax
jmp 0x8abcf3
test esi, esi
jle 0x8abb0d
mov ebx, dword [0x7c12e000]
push 1
push 0x7c133bb0
call ebx
test eax, eax
jne 0x8abb0d
cmp dword [esi*4 + 0x7c133b70], edi
je 0x8abcca
mov eax, dword [0x7c133b68]
lea esi, [eax - 1]
test esi, esi
jl 0x8abcb8
cmp dword [esi*4 + 0x7c133b70], edi
je 0x8abcb4
dec esi
jns 0x8abca8
test esi, esi
jge 0x8abcc8
cmp eax, 0x10
jge 0x8abcc3
inc eax
mov dword [0x7c133b68], eax
lea esi, [eax - 1]
jmp 0x8abcca
je 0x8abce2
xor ecx, ecx
test esi, esi
jl 0x8abce2
lea eax, [ecx*4 + 0x7c133b70]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x8abcd0
push 0
push 0x7c133bb0
call ebx
jmp 0x8abb0d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x402030], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x402034], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [0x402038], eax
push 0x402020
call dword [sym.imp.USER32.DLL_RegisterClassA]
push 0
push dword [0x402030]
push 0
push 0
push 0x1b0
push 0x1b0
push 0x10
push 0x10
push 0x16cf0000
push str.OpenGL_example
push str.FASMOPENGL32
push 0
call dword [sym.imp.USER32.DLL_CreateWindowExA]
mov dword [0x402048], eax
push 0
push 0
push 0
push 0x402054
call dword [sym.imp.USER32.DLL_GetMessageA]
or eax, eax
je 0x40109f
push 0x402054
call dword [sym.imp.USER32.DLL_TranslateMessage]
push 0x402054
call dword [sym.imp.USER32.DLL_DispatchMessageA]
jmp 0x401072
push dword [0x40205c]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4caa92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x4cab67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x4cab31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x4cab5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004cab71
test eax, eax
je 0x4cab67
add ebx, 0x14
jmp 0x4cab3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x4cab71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x4caddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x4caddd
mov eax, 1
test eax, eax
je 0x4caddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x4caddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x4cadd3
mov ebx, eax
and eax, 0x80000000
jne 0x4cad4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x4caddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x4caddd
mov eax, 1
test eax, eax
je 0x4caddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x4caddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x4caca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x4caddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x4cab67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x4caddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x4caca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc