joyce8/EMBER2024-capa huggingface dataset:
Function at 0x135140
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x1351b9
cmp dword [ecx], 0x10101010
jne 0x1351b9
cmp dword [esi], 0x1b7c3f4a
jne 0x135194
mov eax, dword [esi + 8]
test eax, eax
je 0x135194
mov edi, dword [ebp + 0x10]
mov dword [esi + 4], ecx
test edi, 0x200
jne 0x13517f
push dword [ecx + 0x50]
push dword [ebp + 0x14]
push eax
call fcn.00153810
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], edi
pop edi
pop esi
pop ebp
ret
call fcn.000ee7f0
mov ecx, 0x8000004
call fcn.000ee550
push str.tsk_fs_block_set:_fs_block_unallocated
call fcn.000ee5f0
mov eax, 1
add esp, 4
pop edi
pop esi
pop ebp
ret
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1351f8
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.tsk_fs_block_set:_fs_info_unallocated
mov dword [esi], 0x8000004
call fcn.000ee5f0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x135350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x48]
test ecx, ecx
jne 0x135376
test eax, eax
je 0x13543d
push 0
push dword [esi + 0x50]
add eax, 1
adc ecx, 0
push ecx
push eax
call fcn.00171bf0
cmp ebx, edx
jb 0x13543a
ja 0x13539a
cmp edi, eax
jb 0x13543a
call fcn.000ee7f0
mov eax, dword [0x1aa224]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x1353dd
push 0xc08
call fcn.0015c8ae
add esp, 4
mov ebx, eax
push 0xc08
push 0
push ebx
call fcn.00153d90
add esp, 0xc
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebx], 0x8000004
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x44]
add ecx, 1
push 0
push dword [esi + 0x50]
adc eax, 0
push eax
push ecx
call fcn.00171bf0
mov ecx, dword [ebp + 0xc]
cmp ecx, edx
ja 0x135421
jb 0x135408
cmp edi, eax
jae 0x135421
push ecx
push edi
push str.tsk_fs_read:_Offset_missing_in_partial_image:__llu_
call fcn.000ee5f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push edi
push str.tsk_fs_read:_Offset_is_too_large_for_image:__llu_
call fcn.000ee5f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
cmp dword [esi + 0x58], 0
jne 0x135449
cmp dword [esi + 0x5c], 0
je 0x135465
cmp dword [esi + 0x50], 0
je 0x135465
push dword [ebp + 0x10]
mov ecx, esi
push ebx
push edi
call fcn.00135220
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
add ecx, edi
push dword [ebp + 0x10]
adc eax, ebx
push eax
push ecx
mov ecx, dword [esi + 4]
call fcn.001349c0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x135490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
mov eax, edi
mov ecx, dword [esi + 0x50]
div ecx
test edx, edx
je 0x135510
call fcn.000ee7f0
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x1354ed
push 0xc08
call fcn.0015c8ae
add esp, 4
mov edi, eax
push 0xc08
push 0
push edi
call fcn.00153d90
add esp, 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [edi], 0x8000004
push dword [esi + 0x50]
push dword [ebp + 0x10]
push str.tsk_fs_read_block:_length__Iu_not_a_multiple_of__d
call fcn.000ee5f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, dword [esi + 0x4c]
jb 0x1355b4
ja 0x13552a
cmp ebx, dword [esi + 0x48]
jbe 0x1355b4
call fcn.000ee7f0
mov eax, dword [0x1aa224]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x13556d
push 0xc08
call fcn.0015c8ae
add esp, 4
mov edi, eax
push 0xc08
push 0
push edi
call fcn.00153d90
add esp, 0xc
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 0xc]
mov dword [edi], 0x8000004
cmp eax, dword [esi + 0x44]
ja 0x13559b
jb 0x135582
cmp ebx, dword [esi + 0x40]
ja 0x13559b
push eax
push ebx
push str.tsk_fs_read_block:_Address_missing_in_partial_image:__llu_
call fcn.000ee5f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push str.tsk_fs_read_block:_Address_is_too_large_for_image:__llu_
call fcn.000ee5f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x58], 0
jne 0x1355e8
cmp dword [esi + 0x5c], 0
jne 0x1355e8
push eax
push ebx
push 0
push ecx
call fcn.00171bf0
add eax, dword [esi + 8]
mov ecx, dword [esi + 4]
adc edx, dword [esi + 0xc]
push edi
push edx
mov edx, dword [ebp - 4]
push eax
call fcn.001349c0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push 0
push ecx
call fcn.00171bf0
push edi
push edx
mov edx, dword [ebp - 4]
mov ecx, esi
push eax
call fcn.00135220
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x135610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
movzx ecx, byte [esi + 0x4248]
mov word [esi + 0x4192], cx
cmp ecx, 9
jb 0x13574a
cmp ecx, 0xc
ja 0x13574a
mov eax, 1
shl ax, cl
mov word [esi + 0x4190], ax
movzx ecx, byte [esi + 0x4249]
movzx eax, word [esi + 0x4192]
add eax, ecx
cmp eax, 0x19
jle 0x135699
call fcn.000ee7f0
mov ecx, 0x800000a
call fcn.000ee550
push str.Not_an_exFAT_file_system__invalid_cluster_size_
call fcn.000ee5f0
add esp, 4
cmp dword [0x1aa220], 0
je 0x1357ca
movzx eax, byte [esi + 0x4194]
push eax
push str.exfatfs_get_fs_size_params
push str._s:_Invalid_cluster_size___d__n
jmp 0x1357b7
mov al, 1
shl al, cl
mov byte [esi + 0x4194], al
cmp dword [esi + 0x98], 1
jne 0x1356d4
movzx ecx, byte [esi + 0x4233]
movzx eax, byte [esi + 0x4232]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x4231]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x4230]
jmp 0x1356fa
movzx ecx, byte [esi + 0x4230]
movzx eax, byte [esi + 0x4231]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x4232]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x4233]
shl ecx, 8
add ecx, eax
mov dword [esi + 0x4198], ecx
test ecx, ecx
jne 0x135744
call fcn.000ee7f0
mov ecx, 0x800000a
call fcn.000ee550
push str.Not_an_exFAT_file_system__invalid_sectors_per_FAT_
call fcn.000ee5f0
add esp, 4
cmp dword [0x1aa220], 0
je 0x1357ca
push dword [esi + 0x4198]
push str.exfatfs_get_fs_size_params
push str._s:_Invalid_number_of_sectors_per_FAT___d__n
jmp 0x1357b7
xor al, al
pop edi
pop esi
pop ebx
ret
call fcn.000ee7f0
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x135789
push 0xc08
call fcn.0015c8ae
add esp, 4
mov edi, eax
push 0xc08
push 0
push edi
call fcn.00153d90
add esp, 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Not_an_FATFS_file_system__invalid_sector_size_
mov dword [edi], 0x800000a
call fcn.000ee5f0
add esp, 4
cmp dword [0x1aa220], 0
je 0x1357ca
movzx eax, word [esi + 0x4190]
push eax
push str.exfatfs_get_fs_size_params
push str._s:_Invalid_sector_size_base_2_logarithm___d___not_in_range__9___12__n
push 2
call fcn.00158e14
add esp, 4
push eax
call fcn.000a3930
add esp, 0x10
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x139630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 4], ecx
lea eax, [edi + edi]
mov ecx, eax
mov dword [ebp - 8], eax
call fcn.000f2310
mov ebx, eax
test ebx, ebx
je 0x1397a9
lea eax, [edi + edi]
push eax
push esi
push ebx
call fcn.00153810
add esp, 0xc
xor esi, esi
test edi, edi
jle 0x13970e
mov edx, dword [ebp + 0x14]
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x98]
mov eax, 0x100
cmp edi, 1
jne 0x1396a7
movzx ecx, byte [ebx + esi*2 + 1]
imul ecx, eax
movzx eax, byte [ebx + esi*2]
add cx, ax
movzx eax, cx
jmp 0x1396bc
movzx ecx, byte [ebx + esi*2]
movzx edx, byte [ebx + esi*2 + 1]
imul ecx, eax
add dx, cx
movzx eax, dx
mov edx, dword [ebp + 0x14]
test ax, ax
je 0x1396de
test dl, 1
je 0x1396d3
cmp ax, 0x2f
jne 0x1396d3
mov edx, 0x3a
jmp 0x1396e3
test dl, 2
je 0x139704
cmp ax, 0x20
jae 0x139704
mov edx, 0x5e
mov eax, edx
shr eax, 8
movzx ecx, al
movzx eax, dl
cmp edi, 1
jne 0x1396f8
shl ecx, 8
jmp 0x1396fb
shl eax, 8
mov edx, dword [ebp + 0x14]
add ecx, eax
mov word [ebx + esi*2], cx
inc esi
cmp esi, dword [ebp + 8]
jl 0x139680
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edi
push 0
push esi
call fcn.00153d90
add esp, 0xc
mov dword [ebp + 8], esi
lea eax, [esi + edi]
mov dword [ebp - 0xc], ebx
lea edx, [ebp - 0xc]
push 0
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 8]
add eax, ebx
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
call fcn.000f1de0
mov esi, eax
push ebx
mov dword [ebp + 8], esi
call fcn.00158d47
add esp, 0x14
test esi, esi
je 0x1397b2
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x139793
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [ebp + 8]
mov dword [esi], 0x800000d
push str.hfs_UTF16toUTF8:_unicode_conversion_failed___d_
call fcn.000ee5f0
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x145790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
jne 0x14581b
call fcn.000ee7f0
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1457db
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 0x8000006
test edi, edi
je 0x145802
mov eax, dword [ebp + 8]
test eax, eax
je 0x145802
push eax
push edi
push 0x19e708
call fcn.000ee5f0
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x19e6f0
push 0x19e718
call fcn.000ee5f0
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x145880
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov esi, ecx
push 0x19e744
mov edx, str.a_fatfs
call fcn.00145790
add esp, 4
test al, al
jne 0x14594e
push 0x19e72c
mov edx, str.a_fatfs
mov ecx, esi
call fcn.00145790
mov edi, dword [ebp + 0xc]
add esp, 4
mov ebx, dword [ebp + 8]
test al, al
jne 0x1458e7
cmp edi, dword [esi + 0x24]
jb 0x1458e7
ja 0x1458d2
cmp ebx, dword [esi + 0x20]
jb 0x1458e7
cmp edi, dword [esi + 0x2c]
ja 0x1458e7
jb 0x1458de
cmp ebx, dword [esi + 0x28]
ja 0x1458e7
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.000ee7f0
mov eax, dword [0x1aa224]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x14592a
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 8]
mov dword [esi], 0x8000006
push edi
push ebx
test eax, eax
je 0x14593c
push eax
jmp 0x145941
push 0x19e744
push 0x19e760
call fcn.000ee5f0
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1491d0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, edx
push esi
mov dword [ebp - 0xc], eax
mov edx, 0x38
mov word [ebp - 8], ax
mov byte [ebp - 6], al
lea eax, [ebp - 0xc]
push edi
push eax
push ecx
mov ecx, str.80_
call fcn.00149150
movzx ecx, byte [ebp - 0xc]
add esp, 8
movzx eax, byte [ebp - 0xb]
mov esi, 1
movzx edx, byte [ebp - 9]
mov edi, 0x18732c
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0xa]
shl ecx, 8
or ecx, eax
mov eax, edx
shr eax, 4
and edx, 0xf
shl ecx, 4
or ecx, eax
shl edx, 8
movzx eax, byte [ebp - 8]
or edx, eax
mov dword [ebp - 0x94], ecx
movzx eax, byte [ebp - 7]
shl edx, 8
or edx, eax
movzx eax, byte [ebp - 6]
shl edx, 8
or edx, eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], edx
nop dword [eax]
cmp byte [edi + esi - 1], 2
mov ecx, dword [eax - 4]
mov edx, ecx
jne 0x149299
sar edx, 0x1a
and edx, 3
shl ecx, 2
or edx, ecx
mov ecx, dword [eax]
mov dword [eax + 4], edx
mov edx, ecx
sar edx, 0x1a
and edx, 3
shl ecx, 2
jmp 0x1492b2
sar edx, 0x1b
add ecx, ecx
and edx, 1
or edx, ecx
mov ecx, dword [eax]
mov dword [eax + 4], edx
mov edx, ecx
sar edx, 0x1b
and edx, 1
add ecx, ecx
or edx, ecx
inc esi
mov dword [eax + 8], edx
add eax, 8
cmp esi, 0x11
jl 0x149270
push 0x60
push 0
push ebx
call fcn.00153d90
add esp, 0xc
xor esi, esi
nop
mov ecx, dword [ebp + esi*8 - 0x8c]
mov eax, ecx
mov edx, dword [ebp + esi*8 - 0x88]
sar eax, 0x14
mov byte [ebp - 0xc], al
mov eax, ecx
sar ecx, 4
sar eax, 0xc
mov byte [ebp - 0xa], cl
mov ecx, edx
mov byte [ebp - 0xb], al
movzx eax, byte [ebp + esi*8 - 0x8c]
sar ecx, 0x18
shl al, 4
and cl, 0xf
or cl, al
mov eax, edx
sar eax, 0x10
mov byte [ebp - 8], al
movzx eax, byte [ebp + esi*8 - 0x88]
sar edx, 8
mov byte [ebp - 6], al
lea eax, [ebp - 0xc]
mov byte [ebp - 9], cl
mov ecx, 0x1a9240
mov byte [ebp - 7], dl
mov edx, 0x30
push ebx
push eax
call fcn.00149150
inc esi
add esp, 8
add ebx, 6
cmp esi, 0x10
jl 0x1492d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0x149590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], edx
push eax
push ecx
xorps xmm0, xmm0
mov edx, 0x40
mov ecx, 0x1a9270
movq qword [ebp - 0x94], xmm0
call fcn.00149150
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x90]
add esp, 8
mov ebx, 0x10
cmp dword [ebp + 0xc], 0
je 0x149630
mov eax, dword [esi]
mov edx, edi
mov dword [esi + 4], eax
mov ecx, esi
lea eax, [ebp - 8]
push eax
call fcn.00149360
movzx ecx, byte [esi - 4]
add esp, 4
mov eax, dword [ebp - 8]
add edi, 6
xor cl, al
mov byte [esi + 8], cl
movzx ecx, byte [esi - 3]
xor cl, ah
movzx eax, byte [esi - 2]
xor al, byte [ebp - 6]
mov byte [esi + 0xa], al
movzx eax, byte [esi - 1]
xor al, byte [ebp - 5]
mov byte [esi + 9], cl
mov byte [esi + 0xb], al
add esi, 8
sub ebx, 1
jne 0x1495e5
jmp 0x14967c
add edi, 0x5a
mov eax, dword [esi]
mov edx, edi
mov dword [esi + 4], eax
mov ecx, esi
lea eax, [ebp - 8]
push eax
call fcn.00149360
movzx ecx, byte [esi - 4]
add esp, 4
mov eax, dword [ebp - 8]
sub edi, 6
xor cl, al
mov byte [esi + 8], cl
movzx ecx, byte [esi - 3]
xor cl, ah
movzx eax, byte [esi - 2]
xor al, byte [ebp - 6]
mov byte [esi + 0xa], al
movzx eax, byte [esi - 1]
xor al, byte [ebp - 5]
mov byte [esi + 9], cl
mov byte [esi + 0xb], al
add esi, 8
sub ebx, 1
jne 0x149633
pop edi
pop esi
xor eax, eax
pop ebx
movzx ecx, byte [ebp + eax - 0x10]
mov byte [ebp + eax - 0xc], cl
movzx ecx, byte [ebp + eax - 0x14]
mov byte [ebp + eax - 8], cl
inc eax
cmp eax, 4
jl 0x149681
mov eax, dword [ebp - 0x98]
xorps xmm0, xmm0
push eax
mov edx, 0x40
mov ecx, 0x1a92b0
movq qword [eax], xmm0
lea eax, [ebp - 0xc]
push eax
call fcn.00149150
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret

Function at 0x1684bf
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.001683c4

Function at 0x1698b8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00169737

Function at 0x16bd8d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0016b6fb

Function at 0x16bd98
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0016b936
Function at 0x42dd14
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xchg byte [ecx + 0x28], al
sbb esi, esp
and byte [edi + 0x23], dh
invalid
leave
lodsb al, byte [esi]
jecxz 0x42dc94
adc byte [ecx + 0x4f], ah
invalid
pop edi
test al, 0x3b
cld
fisubr word [bp - 0x22bb]
into
adc byte [ebx - 0x709a04f8], bh
adc al, 0xab
popal
jmp 0x42dd4a
aas
jo 0x42dcd1
sbb al, 0xa3
cmc
ret 0x61ab
Function at 0x43a064
Capabilities:
Encode data using xor

Disassembly:
in al, dx
mov ebp, 0x7322885c
sub byte [ebx], 0x9b
sbb dword [ebx + 0x17f945eb], edx
mov al, byte [0xd9912864]
sbb byte [ecx], cl
sal byte [ebp - 0x4a4c1c9b], 0x28
test eax, 0x951c6b11
xchg ecx, eax
dec eax
mov dl, 0x2d
les eax, [ecx + 0x5985af94]
mov eax, 0xe1a72738
clc
adc byte [ebx + 0x88042bb], ah
mov ebx, 0x64088042
cwde
mov ebx, 0x64088042
cwde
push 0x80c716b9
mov ch, 0xc2
cmp byte [ebx], 0xa8
jo 0x43a030
adc dword [esi - 0x156cd642], esi
invalid
Function at 0x485cb4
Capabilities:
Encode data using xor

Disassembly:
dec edi
mov edx, ebp
rcl byte [esi + ebx*2 + 0x4e], cl
push esp
pop esi
dec esi
and byte [edi], 0xb1
mov ah, cl
mov ebp, 0xff4411f5
dec ecx
leave
das
fsubr dword [eax - 0x39099c25]
fdivr qword [esi - 0x3c]
cmp eax, 0xfd585c33
pop esp
pop eax
std
pop esp
pop eax
std
or byte [ecx - 0x5d], ah
cdq
adc edx, dword [edx]
scasb al, byte es:[edi]
enter 0xffffffffffffda77, 0x1b
jo 0x485c98
adc esi, edi
daa
cli
xchg ecx, eax
cmp dword [eax], ebx
pop esp
in al, dx
xor bh, ah
and dh, byte [edx - 0x2a]
jae 0x485c94
xchg ebp, eax
sub al, 0x8b
aad 0xe7
mov ah, 0x15
mov byte [esi], cl
jnp 0x485d12
idiv edi
invalid
fst dword [ebp + 0x52]
adc eax, 0x6e7a6ee0
jmp 0x485d48
dec edi
sar byte [esi + 0xf], 0xbe
test dword [esi], ebx
or byte [eax - 0x359d447b], 0x6f
test al, 0xd
sbb edi, dword [eax - 0x4e]
pop ebx
aaa
cmp al, 0xb
mov edx, 0xc5b51330
sub byte [ebx - 0x2f5a7125], cl
and al, 0xee
sbb dl, ch
dec ebp
sbb edi, dword [edx + 0x4d4a2e93]
cld
push es
sahf
or byte [ebp - 0x3f], ah
xchg cl, bh
xchg edx, eax
in al, dx
jo 0x485d95
clc
jl 0x485dea
jno 0x485df3
clc
add edx, dword [ecx]
mov word [esp + esi + 0x468d49c5], ss
cmp ebp, dword [esi + 0x189dc546]
imul edi, ebx, 0xffffff85
xchg esp, eax
xor al, 0xc5
dec ecx
lea eax, [esi + 0x3b]
scasb al, byte es:[edi]
inc esi
lds ebx, [ebp - 0x7a0494e8]
aas
leave
mov dl, 0x43
outsb dx, byte [esi]
call dword [esi]
lcall 0x1e55, 0x4be8d307
cmpsb byte [esi], byte es:[edi]
ret
sbb eax, 0x95b38bc6
das
out 0xd7, al
push 0xfa26ef12
int1
mov dword [0x802e6576], eax
jno 0x485e4d
push ebx
jnp 0x485e0d
loop 0x485d8e
xor edx, dword [ebx - 0xf]
push edx
fistp qword [ebx + 0x2b90a7a9]
fistp qword [ebx + 0x2b90a7a9]
adc dl, bh
js 0x485dd4
invalid
sar dword [edx + ebx*8 - 0x1fd91b6f], cl
inc eax
not edx
cmpsd dword [esi], dword es:[edi]
xlatb
retf 0xbd61
mov bl, 0x47
int1
and edi, dword [esi]
invalid
Function at 0x401210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, edx
mov dword [ebp - 0x18], ecx
call edi
push dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 0x1fffff
call ebx
mov esi, eax
mov edi, 0x401200
mov eax, 0x4011e0
mov dword [ebp - 8], esi
sub eax, 0x4011d0
sub edi, 0x4011e0
push 1
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
call fcn.004093a3
add esp, 8
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0xc]
push eax
push 0x4011d0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call esi
push 1
push edi
call fcn.004093a3
add esp, 8
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
push 0x4011e0
push dword [ebp - 8]
call esi
push dword [ebp - 0x18]
push 0
push 0x1fffff
call ebx
mov ebx, dword [ebp - 4]
push 0x40
push 0x3000
push ebx
push 0
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push dword [ebp - 8]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 1], esi
mov eax, dword [ebp - 0x1c]
mov dword [edi + 5], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
mov esi, dword [ebp - 0x18]
push esi
call edi
test eax, eax
je 0x401313
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x427004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor edx, edx
mov dword [ebp - 0x220], ecx
push esi
push edi
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x218], edx
pushal
mov eax, dword fs:[0x30]
mov dword [ebp - 0x214], eax
popal
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0xc]
xor eax, eax
mov dword [ebp - 0x21c], ecx
mov ebx, dword [ebp - 0x21c]
sub eax, 0
je 0x4040e2
sub eax, 1
je 0x4040ca
sub eax, 1
jne 0x4040f7
lea ebx, [ecx + 0x1c]
mov ecx, 0x10
mov eax, ebx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], eax
jmp 0x404103
lea ebx, [ecx + 0x14]
mov ecx, 8
mov eax, ebx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], eax
jmp 0x404103
lea ebx, [ecx + 0xc]
xor ecx, ecx
mov eax, ebx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], eax
jmp 0x404103
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x208]
mov edi, dword [ebx]
cmp edi, eax
je 0x4041a5
nop dword [eax]
mov esi, edi
xor eax, eax
sub esi, ecx
mov ebx, edi
movzx ecx, word [esi + 0x24]
test ecx, 0xfffffffe
jbe 0x404143
cmp eax, 0x200
jge 0x404148
mov ecx, dword [esi + 0x28]
mov cl, byte [ecx + eax*2]
mov byte [ebp + eax - 0x204], cl
inc eax
movzx ecx, word [esi + 0x24]
shr ecx, 1
cmp eax, ecx
jl 0x404124
cmp eax, 0x200
jae 0x4041ee
push dword [ebp - 0x220]
mov byte [ebp + eax - 0x204], 0
lea eax, [ebp - 0x204]
push eax
call fcn.00407310
add esp, 8
test eax, eax
je 0x40418f
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x210]
test eax, eax
cmovne esi, eax
mov dword [ebp - 0x210], esi
mov eax, dword [edi]
mov edi, eax
mov ecx, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x20c]
jne 0x404110
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp eax, 3
jge 0x4041c2
mov ecx, dword [ebp - 0x21c]
jmp 0x4040a3
mov edx, dword [ebp - 0x210]
test edx, edx
je 0x4041dd
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a9e
mov esp, ebp
pop ebp
ret
call fcn.00405bce
int3