joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019a327
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101bb5c0]
jne 0x1019a331
repz ret
jmp fcn.1019be1b

Function at 0x1019d10f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a42c
and dword [ebp - 4], 0
cmp dword [0x101bcb28], 0
mov ebx, eax
jne 0x1019d1c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019d271
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019d271
push eax
call fcn.1019a3ba
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101bcb28], eax
call esi
push eax
call fcn.1019a3ba
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101bcb2c], eax
call esi
push eax
call fcn.1019a3ba
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101bcb30], eax
call esi
push eax
call fcn.1019a3ba
pop ecx
mov dword [0x101bcb38], eax
test eax, eax
je 0x1019d1c0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a3ba
pop ecx
mov dword [0x101bcb34], eax
mov eax, dword [0x101bcb34]
cmp eax, ebx
je 0x1019d218
cmp dword [0x101bcb38], ebx
je 0x1019d218
push eax
call fcn.1019a435
push dword [0x101bcb38]
mov esi, eax
call fcn.1019a435
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019d218
test edi, edi
je 0x1019d218
call esi
test eax, eax
je 0x1019d20f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019d20f
test byte [ebp - 0xc], 1
jne 0x1019d218
or dword [ebp + 0x10], 0x200000
jmp 0x1019d251
mov eax, dword [0x101bcb2c]
cmp eax, ebx
je 0x1019d251
push eax
call fcn.1019a435
pop ecx
test eax, eax
je 0x1019d251
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019d251
mov eax, dword [0x101bcb30]
cmp eax, ebx
je 0x1019d251
push eax
call fcn.1019a435
pop ecx
test eax, eax
je 0x1019d251
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101bcb28]
call fcn.1019a435
pop ecx
test eax, eax
je 0x1019d271
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019d273
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1019ec48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x101bb04c], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019fb69
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019ec8e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101bb048], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019edb8
jmp 0x1019ecff
xor eax, eax
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov edx, dword [ebp - 0x38]
add edx, 2
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x30], eax
jb 0x1019ed11
jmp 0x1019edb8
mov al, byte [ebp - 0x41]
test al, 1
jne 0x1019ed8b
jmp 0x1019ecc9
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x101bb04c], 0x1dce
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x41], cl
je 0x1019ecf2
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x41]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x1019ed35
jmp 0x1019ecf2
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov dword [0x101bb048], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101bb04c], 0x92b
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019f0de
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019f123
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1019f1dd
jmp 0x1019f1f0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1019f17a
jmp 0x1019f163
mov eax, 0x18d0
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
je 0x1019f1ff
jmp 0x1019f1f0
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x1019f123
mov eax, dword [ebp - 0x20]
mov dword [0x101bb04c], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1019f1f0
mov dword [0x101bb048], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1019f1f0
mov dword [0x101bb048], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1019f1f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019f10b
jmp 0x1019f1f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1019f13b
mov eax, 0x1088
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1019f1ff
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x101bb048], ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1019f3c2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101bb054], 0
mov byte [0x101bb058], 0
mov edi, dword [0x101bb048]
add edi, 0xfffff8e9
mov dword [0x101bb04c], edi
mov dword [0x101bb050], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1019f4cb
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101bb05c], 0
mov edi, dword [0x101bb054]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101bb05c], esi
mov dword [0x101bb048], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101bb054], edx
mov dword [0x101bb04c], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101bb058], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101bb058]
mov esi, dword [0x101bb054]
mov byte [ebx + esi], cl
mov esi, dword [0x101bb050]
add esi, 1
mov dword [0x101bb050], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f414
jmp 0x1019f507
xor eax, eax
mov dword [0x101bb050], 0
mov dword [ebp - 0x20], eax
jmp 0x1019f414
mov eax, dword [ebp - 0x1c]
mov dword [0x101bb048], 0x7c1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101bb04c], 0x17ea
mov eax, dword [0x101bb050]
add eax, 1
mov dword [0x101bb050], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f4cb
jmp 0x1019f4b7
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019f8a3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101bb04c], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1019f90f
lea eax, [ebp - 0x24]
mov dword [0x101bb04c], 0x1a22
mov ecx, dword [0x101bb048]
add ecx, 0xffffefe3
mov dword [0x101bb048], ecx
mov dword [ebp - 0x34], eax
call fcn.1019edc3
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1019e9ca
cmp eax, 0
mov dword [ebp - 0x38], eax
jne 0x1019f93b
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101a0929]
mov dh, byte [eax + 0x101a08fa]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x1019f8c7
jmp 0x1019f90f
mov dword [0x101bb048], 0x2091
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1019f21c
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101bb048], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x54], ecx
mov dword [0x101bb04c], 0x8aa
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x4c], ecx
add ecx, 0x195b
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1019f9da
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1019fce7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x1e25
xor ebx, ebx
mov dword [0x101bb050], 0
mov dword [0x101bb054], 0
mov dword [0x101bb060], 0
mov dword [0x101bb048], 0xfa3
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1019fe71
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
mov edi, eax
add edi, 1
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x101bb050], edx
mov dword [0x101bb048], 0x3264
mov ebx, dword [ebp - 0x24]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101bb054], edx
mov ecx, dword [0x101bb04c]
add ecx, 0xfffff82b
mov dword [0x101bb04c], ecx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101bb058], cl
mov dword [0x101bb048], 0x26b4
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x101bb04c], 0x112a
mov cl, byte [0x101bb058]
mov edx, dword [0x101bb054]
mov byte [ebx + edx], cl
mov edx, dword [0x101bb050]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101bb054]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x101bb04c], 0x55d
and ecx, 0xff
mov dword [0x101bb060], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x101bb048], 0x65f
mov dword [0x101bb04c], 0xffffdf97
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1019fe64
mov eax, dword [0x101bb054]
mov ecx, dword [0x101bb050]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], edx
jmp 0x1019fd52
mov eax, dword [0x101bb048]
add eax, 0xe82
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [0x101bb048], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019fe81
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov edx, dword [0x101bb048]
mov esi, edx
add esi, 0xffffdde0
mov dword [0x101bb04c], esi
add edx, 0xffffe928
mov dword [0x101bb048], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1019f5d9
lea ecx, [0x1019f35b]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x38], edx
mov dword [esp + 0x74], 0x155c00
mov edx, dword [0x101bb034]
mov dword [esp + 0x64], edx
mov edx, dword [0x101bb038]
mov dword [esp + 0x44], edx
mov edx, dword [0x101bb03c]
mov dword [esp + 0x80], edx
mov edx, dword [0x101bb040]
mov dword [esp + 0x34], edx
mov dword [0x101bb048], 0x5bd
mov edx, dword [0x101bb044]
mov dword [esp + 0x6c], edx
mov dword [0x101bb04c], 0xfffff4b2
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1019ff49
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1019ff49
mov eax, dword [esp + 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1019ff2b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
jne 0x1019ff2b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x78], edx
mov dword [0x101bb048], 0xe1c
call fcn.1019f0de
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x1019ff3f
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1019f8a3
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0xc], eax
jmp 0x1019ff3f
Function at 0x405d96
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dcd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405da7
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dfe
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de0
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001de4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10001df3
pop dword [ebp - 8]
mov eax, 0xc925dbb6
add eax, 0x46da423d
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x7caa0cc8
add dword [ebp - 0x18], 0xd1a83883
mov dword [ebp - 0x14], 0xfdd84d24
sub dword [ebp - 0x14], 0xcba500df
mov dword [ebp - 0x10], 0xb7619462
add dword [ebp - 0x10], 0x94eaafcc
mov dword [ebp - 0xc], 0xe00ccc05
add dword [ebp - 0xc], 0x1ff333fb
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x5bbce091
sub dword [ebp - 0x18], 0xe74a773b
mov dword [ebp - 0x14], 0xba62a5a2
sub dword [ebp - 0x14], 0x78f6442d
mov dword [ebp - 0x10], 0xba362f55
sub dword [ebp - 0x10], 0x56c6c2e9
mov dword [ebp - 0xc], 0x2ef0a095
add dword [ebp - 0xc], 0xd10f5f6b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x36270
push 0
call eax
mov ecx, 0x1186c3d4
add ecx, 0xee7982da
mov edx, eax
mov edi, 0x3c52e934
sub edi, 0x2c528534
add edi, dword [ebp - 8]
mov esi, 0xc8ca1a35
xor dword [ebp - 4], edx
mov ebx, dword [edi]
add dword [ebp - 4], esi
xor ebx, esi
mov dword [edx], ebx
add edx, 0x61aed5
sub edx, 0x61aed1
add edi, 0x8df32b4f
add edi, 0x720cd4b5
loop 0x10001f05
add eax, 0x79002638
sub eax, 0x78ff18ad
mov ebx, eax
add eax, 0x6f281435
sub eax, 0x6f281430
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4016a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esi
mov esi, ebx
xor eax, ebx
mov eax, esi
mov eax, esi
xor ebx, eax
mov esi, esi
mov ebx, eax
xor ebx, esi
dec edi
sbb esi, 0x7a
rcr ebx, 0x73
not eax
and ebx, 0xcc
add eax, 0xcc
and esi, 0xaf
sbb esi, 0x7b
ror esi, 0xe7
dec ebx
and edx, 0x37
neg eax
mov eax, 0xbe
mov eax, 0x1d
rcl eax, 0xe9
dec eax
not ebx
sbb edx, 0xac
sub ebx, 0xdd
not edi
rcr ebx, 0xc0
dec edx
ror edx, 0xab
bswap eax
sbb eax, 0xa8
ror ebx, 0x45
bswap edi
dec esi
not eax
neg ebx
imul eax
or ebx, 6
bswap ebx
inc edi
rcl esi, 0x12
and esi, 0x8c
dec eax
mov edx, 0x80
bswap edx
rol edi, 0
rol edx, 0xf3
or edx, 0x77
rol edi, 0x31
inc eax
inc eax
dec eax
ror ebx, 0x34
inc edx
neg esi
add edi, 0x84
xor ecx, ecx
xor edi, edi
mov esi, ebx
xor ebx, eax
mov eax, ebx
xor eax, eax
mov ebx, eax
xor ebx, ebx
ror ebx, 0xb8
ror esi, 0x2f
imul edx
rcr edi, 0x1f
mov edi, 0x2b
ror ebx, 0x86
inc esi
rcr eax, 0xc2
neg esi
bswap esi
inc edi
or esi, 0xa7
not edx
imul esi
mov esi, 0x57
inc edx
sbb ebx, 0x95
not ebx
sub esi, 0x2f
inc ebx
bswap eax
inc edi
inc ebx
ror ebx, 0xd4
sbb eax, 0x7d
inc eax
rol edx, 0x1e
not ebx
neg esi
and eax, 0xb
not edx
bswap eax
bswap edi
rcr ebx, 0x86
neg eax
mov eax, 0xc0
sub eax, 0xd9
rcr esi, 0x15
sbb eax, 0x62
or esi, 0x46
add ebx, 0x63
not ebx
or edi, 0xb2
add edi, 0xd3
mov ebx, 0x88
sbb ebx, 0x61
add edx, 0x8b
or ebx, 0x16
rol edi, 0x13
neg esi
xor esi, eax
xor esi, ebx
xor eax, eax
mov esi, eax
xor eax, esi
xor ebx, esi
xor eax, esi
xor eax, eax
mov eax, eax
mov ecx, dword [ebp + 0xc]
sbb edi, 0x1f
rcr ebx, 0xaa
add edi, 0x86
mov esi, 0x92
not eax
dec eax
inc edi
not ebx
ror edx, 0x5e
neg ebx
neg edi
dec edx
not ebx
rcl esi, 0x4b
bswap edi
rcr ebx, 0x8d
inc edi
dec edi
or esi, 0xef
sub esi, 0x5c
dec edx
ror edx, 0x8f
rcr edi, 0xd3
imul eax
bswap edi
rcl edx, 0xe6
dec ebx
ror ebx, 0x67
rcl ebx, 0xc4
rcr ebx, 0xa9
bswap edx
rcl esi, 0xde
rol eax, 0xb9
not edx
dec edx
ror eax, 0x6d
sub eax, 0xea
neg edx
add eax, 0x7c
mov ebx, 0x8e
mov eax, 0xe1
add edx, 0x98
and edx, 3
mov edi, 0xa4
rcl edi, 0xd7
and eax, 0x3d
or edx, 0x49
add eax, 0xdb
sub eax, 0xf1
neg edx
mov edi, dword [ebp + 8]
xor ebx, eax
xor eax, esi
xor eax, eax
xor ebx, ebx
mov ebx, ebx
mov eax, ebx
xor eax, ebx
xor eax, esi
mov ebx, ebx
not byte [edi]
mov esi, eax
xor ebx, eax
xor eax, esi
xor ebx, esi
mov ebx, ebx
mov eax, ebx
xor esi, esi
mov eax, ebx
mov esi, esi
xor ebx, esi
xor esi, eax
xor ebx, esi
sub byte [edi], 1
add byte [edi], 0x34
xor esi, eax
xor ebx, eax
xor esi, ebx
xor ebx, ebx
mov ebx, eax
mov ebx, eax
xor ebx, esi
mov ebx, esi
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40189f
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403448
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x413050]
test eax, eax
je 0x403487
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403487
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403487
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403487
cmp dword [ecx + 0x74], 0xe
jbe 0x403487
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40f8e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f90d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f90d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x44181d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44184b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441869
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00441787
jmp 0x441869
mov eax, dword [esi + 0x14]
test eax, eax
je 0x441869
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00441787
test edi, edi
mov eax, edi
jne 0x441853
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56b49c]
test ecx, ecx
je 0x44191c
jmp 0x44181c
ret 8

Function at 0x401020
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp word [esi], 0x22
jne 0x4010b0
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x401053
cmp ax, 0x22
je 0x401059
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401041
cmp word [esi], 0x22
jne 0x40105c
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x401076
cmp ax, 0x20
ja 0x401076
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401064
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
movzx eax, word [ebp - 0x14]
jne 0x401096
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp word [esi], 0x20
jbe 0x40105c
add esi, 2
jmp 0x4010b0
Function at 0x1005d425
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1005d434
pop dword [ebp - 0x3c]
mov eax, 0xc0058be8
add eax, 0x5000484c
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x1b3bdeb1
add dword [ebp - 0x4c], 0x3316669a
mov dword [ebp - 0x48], 0xd2f2ad70
add dword [ebp - 0x48], 0x5f409ed5
mov dword [ebp - 0x44], 0xede99709
add dword [ebp - 0x44], 0x5e62ad25
mov dword [ebp - 0x40], 0x725ec1c8
add dword [ebp - 0x40], 0x8da13e38
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x38f81c04
sub dword [ebp - 0x4c], 0xc485b2ae
mov dword [ebp - 0x48], 0x58ae2651
add dword [ebp - 0x48], 0xe8be3b24
mov dword [ebp - 0x44], 0x49caff5a
add dword [ebp - 0x44], 0x19a46d12
mov dword [ebp - 0x40], 0xb1c4f82d
add dword [ebp - 0x40], 0x4e3b07d3
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d0b0
push 0
call eax
mov ecx, 0x468e
xor ebx, ebx
add ebx, eax
mov edx, 0xf7af1ae6
add edx, 0x185c751a
add edx, dword [ebp - 0x3c]
mov edi, 0xf475c4bc
sub edi, 0xa01b74b0
add dword [ebp - 0xc], 0x15846c8c
mov esi, dword [edx]
xor dword [ebp - 0x1c], esi
add esi, edi
xor dword [ebp - 0x34], edi
mov dword [ebx], esi
xor dword [ebp - 0x14], edx
add ebx, 0x550a973a
sub ebx, 0x550a9736
add edx, 0xacd1cfb4
add edx, 0x532e3050
loop 0x1005d548
add eax, 0x10d0b
mov ebx, eax
add eax, 0x1bb9d4df
add eax, 0xe4462b26
mov ecx, 0xdf459109
add ecx, 0x30ba6ef7
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret