joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448200
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.0043b4e0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x448232
mov dword [esp + 0x2c], 0
jmp 0x44824d
mov ecx, ebp
call fcn.0043b4e0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.0043b4e0
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.0043b4f0
cmp eax, esi
jae 0x44828d
mov ecx, ebp
call fcn.0043b4f0
mov dword [esp + 0x10], eax
jmp 0x448291
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.0043b310
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x4482fd
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x4482f8
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.0043c790
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x4482eb
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.0043cc00
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x4482b8
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x4482a6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x44bab0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x44bae0
push esi
call fcn.0044bfb0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x44bad9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x44bb63
mov eax, dword [esi + 0x1a0]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x44bb4f
mov eax, dword [esi + 8]
test eax, eax
je 0x44bb04
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1a0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44bb4b
cmp eax, 2
je 0x44bb4f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44baf7
cmp eax, 3
je 0x44bb2a
cmp eax, 1
jne 0x44baf7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44baf7
mov edx, dword [esi + 0x120]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44baf7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0044bb90
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44bb83
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0044bb90
add esp, 4
pop esi
ret
Function at 0x473a20
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x473a3a
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x473a3a
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x475610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
push 1
call fcn.00477000
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x475643
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [edx + 0x258], eax
mov ecx, dword [ebp - 4]
push 0x40
mov dword [ecx + 0x25c], eax
push fcn.00499024
mov edx, dword [ebp - 4]
push edx
call fcn.004739c0
push esi
push eax
call fcn.004990a0
add esp, 0x14
test eax, eax
je 0x47567f
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push eax
push ecx
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00477220
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473a80
mov edi, dword [ebp + 8]
add esp, 0x20
cmp edi, esi
mov ebx, 0x20000
je 0x4756e9
push 0
call fcn.004741b0
mov dl, byte [esi + edi]
mov cl, byte [eax + esi]
add esp, 4
cmp dl, cl
je 0x4756d7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x70]
or ecx, ebx
mov dword [eax + 0x70], ecx
push 0
call fcn.004741b0
mov al, byte [eax + esi]
add esp, 4
inc esi
test al, al
jne 0x4756b8
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x70]
test ebx, eax
je 0x475761
test edi, edi
je 0x47575a
mov bl, byte [edi]
push 0
call fcn.004741b0
mov cl, byte [eax]
add esp, 4
cmp bl, cl
jne 0x47572d
cmp bl, 0x31
jne 0x475722
push 0
call fcn.004741b0
mov dl, byte [edi + 2]
mov cl, byte [eax + 2]
add esp, 4
cmp dl, cl
jne 0x47572d
cmp byte [edi], 0x30
jne 0x475761
cmp byte [edi + 2], 0x39
jge 0x475761
test edi, edi
je 0x47575a
push 0
call fcn.004741b0
push eax
push edi
push str.Application_built_with_libpng__.20s_but_running_with__.20s
lea eax, [ebp - 0x58]
push 0x50
push eax
call fcn.004994b2
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004737e0
add esp, 0x20
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4757af
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb4]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004771f0
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
test eax, eax
jne 0x4757a8
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x4757ec
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb0]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004771a0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
push ecx
mov dword [eax + 0xb0], 0
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004770a0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00476f80
mov edx, dword [ebp - 4]
push edx
call fcn.00475d10
add esp, 0x14
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488906
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5066e4]
cmp dword [eax + 0x224], 0
je 0x48891f
mov ecx, dword [esp + 4]
mov dword [eax + 0x228], ecx
ret
push ebp
push esi
push edi
push str._nMIRACL_error_from_routine
call fcn.00488b3a
pop ecx
mov eax, dword [0x5066e4]
mov ecx, dword [eax + 0x1c]
mov ebp, 0x5012d4
cmp ecx, 0x18
jge 0x48894c
mov eax, dword [eax + ecx*4 + 0x20]
push dword [eax*4 + 0x50001c]
jmp 0x48894d
push ebp
call fcn.00488b3a
pop ecx
mov edi, 0x502720
push edi
push 0xa
call fcn.00498d77
mov eax, dword [0x5066e4]
pop ecx
pop ecx
mov esi, dword [eax + 0x1c]
dec esi
js 0x4889b0
push ebx
lea ebx, [esi*4 + 0x20]
push str.______________called_from
call fcn.00488b3a
cmp esi, 0x18
pop ecx
jge 0x488996
mov eax, dword [0x5066e4]
mov eax, dword [ebx + eax]
push dword [eax*4 + 0x50001c]
jmp 0x488997
push ebp
call fcn.00488b3a
pop ecx
push edi
push 0xa
call fcn.00498d77
dec esi
pop ecx
sub ebx, 4
pop ecx
test esi, esi
jge 0x488975
pop ebx
mov eax, dword [esp + 0x10]
pop edi
dec eax
pop esi
cmp eax, 0x1c
pop ebp
ja case.default.0x4889c1
jmp dword [eax*4 + 0x488ac6]
push str.Number_base_too_big_for_representation_n
jmp 0x488ab9
push str.Division_by_zero_attempted_n
jmp 0x488ab9
push str.Overflow___Number_too_big_n
jmp 0x488ab9
push str.Internal_result_is_negative_n
jmp 0x488ab9
push str.Input_format_error_n
jmp 0x488ab9
push str.Illegal_number_base_n
jmp 0x488ab9
push str.Illegal_parameter_usage_n
jmp 0x488ab9
push str.Out_of_space_n
jmp 0x488ab9
push str.Even_root_of_a_negative_number_n
jmp 0x488ab9
push str.Raising_integer_to_negative_power_n
jmp 0x488ab9
push str.Attempt_to_take_illegal_root_n
jmp 0x488ab9
push str.Integer_operation_attempted_on_Flash_number_n
jmp 0x488ab9
push str.Flash_overflow_n
jmp 0x488ab9
push str.Numbers_too_big_n
jmp 0x488ab9
push str.Log_of_a_non_positive_number_n
jmp 0x488ab9
push str.Flash_to_double_conversion_failure_n
jmp 0x488ab9
push str.I_O_buffer_overflow_n
jmp 0x488ab9
push str.MIRACL_not_initialised___no_call_to_mirsys___n
jmp 0x488ab9
push str.Illegal_modulus__n
jmp 0x488ab9
push str.No_modulus_defined_n
jmp 0x488ab9
push str.Exponent_too_big_n
jmp 0x488ab9
push str.Unsupported_Feature___check_mirdef.h_n
jmp 0x488ab9
push str.Specified_double_length_type_isnt_double_length_n
jmp 0x488ab9
push str.Specified_basis_is_NOT_irreducible_n
jmp 0x488ab9
push str.Unable_to_control_Floating_point_rounding_n
jmp 0x488ab9
push str.Base_must_be_binary__MR_ALWAYS_BINARY_defined_in_mirdef.h____n
jmp 0x488ab9
push str.No_irreducible_basis_defined_n
jmp 0x488ab9
push str.Composite_modulus_n
jmp 0x488ab9
push str.Input_output_error_when_reading_from_RNG_device_node_n
jmp 0x488ab9
push str.Undefined_error_n
call fcn.00488b3a
pop ecx
push 0
call fcn.00499185
enter 0x4889, 0
ror byte [ecx - 1982070712], cl
dec eax
add dh, ah
mov dword [eax], ecx
invalid
Function at 0x496f39
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x496f59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00499a9e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x496f7c
test byte [esp + 8], 2
je 0x496f7c
call fcn.00499b11
mov dword [eax], 0xd
call fcn.00499b1a
mov dword [eax], 5
jmp 0x496f55
xor eax, eax
ret
Function at 0x4ad6e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00495d10
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4ad7ab
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4ad7ab
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4ad75e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4ad769
or bh, 8
and edi, 0x8000000
je 0x4ad784
mov eax, dword [0x50a37c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4ad7ab
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4adb80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4adbab
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4adbcf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4adbea
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x4b2250
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b2288
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b1254
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b122b
jmp 0x4b2294
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4b3b96
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b3bd8
call fcn.004c3a4d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b3bd8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b3bcf
xor eax, eax
jmp 0x4b3be0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b3be6
pop edi
pop esi
pop ebx
ret 4
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100022de
pop dword [ebp - 0x20]
mov eax, 0x100022de
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xb0d4608b
add dword [ebp - 0x30], 0x9d7de4c0
mov dword [ebp - 0x2c], 0x3a25b0e4
sub dword [ebp - 0x2c], 0x7f2649f
mov dword [ebp - 0x28], 0x8bed9f19
sub dword [ebp - 0x28], 0x3fa15aeb
mov dword [ebp - 0x24], 0xa0b3b148
sub dword [ebp - 0x24], 0xa0b3b148
lea eax, [ebp - 0x30]
push eax
mov eax, 0xe0af2f8f
sub eax, 0xd0aeff8b
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x62ff9a95
sub dword [ebp - 0x30], 0xee8d313f
mov dword [ebp - 0x2c], 0x98753677
add dword [ebp - 0x2c], 0xa8f72afe
mov dword [ebp - 0x28], 0x7d935019
sub dword [ebp - 0x28], 0x1a23e3ad
mov dword [ebp - 0x24], 0xb7df7b10
sub dword [ebp - 0x24], 0xb7df7b10
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xf026b11c
sub eax, 0xe0268114
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3368e
push 0
call eax
mov ecx, 0x72197047
sub ecx, 0x72193496
xor edx, edx
add edx, eax
mov esi, 0x53be2212
add esi, 0xbc423fee
add esi, dword [ebp - 0x20]
mov ebx, 0x25de2847
add ebx, 0x93465021
xor dword [ebp - 0x14], 0xf1170e7a
mov edi, dword [esi]
sub edi, ebx
sub dword [ebp - 0x10], eax
mov dword [edx], edi
sub dword [ebp - 4], 0xbf918c43
add edx, 0x7582413d
sub edx, 0x75824139
add esi, 4
loop 0x100023fd
add eax, 0xe197
mov ebx, eax
add eax, 5
mov ecx, 0xf39c896
add ecx, 0xc6376a
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x9e89d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e8a1c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e89e2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e8a80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e8ad2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e8ad8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa00fc5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a00c85

Function at 0xa05dbf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a05c3e

Function at 0xa0b370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0b39d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0b39d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xe3c5144
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5aaf22ca
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10001e6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10001e7a
pop dword [ebp - 0x18]
mov eax, 0x10001e7a
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4671810b
add dword [ebp - 0x28], 0x7e0c440
mov dword [ebp - 0x24], 0xda1ef2cd
add dword [ebp - 0x24], 0x58145978
mov dword [ebp - 0x20], 0xb61ca21f
add dword [ebp - 0x20], 0x962fa20f
mov dword [ebp - 0x1c], 0x208836bd
sub dword [ebp - 0x1c], 0x208836bd
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc2637918
sub dword [ebp - 0x28], 0x4df10fc2
mov dword [ebp - 0x24], 0xadf296c9
sub dword [ebp - 0x24], 0x6c863554
mov dword [ebp - 0x20], 0xc6d559f
add dword [ebp - 0x20], 0x570216cd
mov dword [ebp - 0x1c], 0x17a5151c
sub dword [ebp - 0x1c], 0x17a5151c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c67c
push 0
call eax
mov ecx, 0x170e06e9
sub ecx, 0x170dba50
xor esi, esi
add esi, eax
mov edi, 0x50386635
add edi, 0xbfca33cb
add edi, dword [ebp - 0x18]
mov ebx, 0xe1eb2051
add dword [ebp - 8], 0xe61d97b0
mov edx, dword [edi]
xor dword [ebp - 0x14], 0x9cb93a59
add edx, ebx
add dword [ebp - 0x14], edx
mov dword [esi], edx
add esi, 0xabe2aba1
add esi, 0x541d5463
add edi, 4
loop 0x10001f89
add eax, 0xa5edd80d
add eax, 0x5a134d2a
xor ebx, ebx
add ebx, eax
add eax, 0x209055b4
add eax, 0xdf6faa51
mov ecx, 0x50f68ede
sub ecx, 0x40f68ede
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc