joyce8/EMBER2024-capa huggingface dataset:
Function at 0x131c14a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x46d884
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x30]
mov ecx, dword [edx + 4]
add ecx, eax
mov esi, ecx
mov edx, esi
movzx ebx, word [edx + 0xc]
movzx edx, word [edx + 0xe]
add ebx, edx
mov edx, ebx
mov ebx, dword [ebp + 8]
mov ebx, ecx
add ebx, 0x10
dec edx
test edx, edx
jl 0x131c1645
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], 0
movzx eax, word [esi + 0xc]
cmp eax, dword [ebp - 8]
setle byte [ebp - 9]
mov eax, dword [ebp - 4]
sub eax, 1
jb 0x131c1520
je 0x131c1544
dec eax
je 0x131c1568
jmp 0x131c1597
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov ecx, dword [ebx]
mov al, byte [ebp - 9]
call fcn.131c1468
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.13158804
jmp 0x131c1597
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov ecx, dword [ebx]
mov al, byte [ebp - 9]
call fcn.131c1468
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
call fcn.13158804
jmp 0x131c1597
cmp byte [ebp - 9], 0
jne 0x131c158f
lea edx, [ebp - 0x20]
mov eax, 0x46cb10
call fcn.1315a604
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x46ca94]
call fcn.13160a54
call fcn.13158080
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
mov dword [eax - 0x10], edx
mov edx, dword [ebx + 4]
test edx, 0x80000000
jbe 0x131c15b9
mov eax, dword [ebp + 8]
push eax
mov eax, edx
and eax, 0x7fffffff
mov edx, dword [ebp - 4]
inc edx
call fcn.131c14a8
pop ecx
jmp 0x131c1636
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov ecx, eax
add ecx, edx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
push edx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
push edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 4]
push edx
mov edx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
add eax, dword [edx]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x14]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x14]
mov eax, dword [0x46c0ac]
call fcn.131c0278
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 8]
mov dword [eax + 0xc], edx
mov edx, dword [esi]
mov dword [eax + 0x28], edx
movzx edx, word [esi + 8]
shl edx, 0x10
movzx ecx, word [esi + 0xa]
add edx, ecx
mov dword [eax + 0x20], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x14]
mov edx, dword [edx + 0x78]
xchg edx, eax
call fcn.13179578
add ebx, 8
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x131c1506
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d88b
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.13158790
ret
Function at 0x131c2798
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
cmp edx, dword [ebp + 8]
jne 0x131c27b9
mov esi, eax
mov eax, edx
test eax, eax
jbe 0x131c27b5
mov dl, byte [esi]
xor dl, 8
mov byte [ecx], dl
inc esi
inc ecx
dec eax
jne 0x131c27a9
mov al, 1
jmp 0x131c27bb
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x131c27c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
cmp edx, dword [ebp + 8]
jne 0x131c27e1
mov esi, eax
mov eax, edx
test eax, eax
jbe 0x131c27dd
mov dl, byte [esi]
xor dl, 8
mov byte [ecx], dl
inc esi
inc ecx
dec eax
jne 0x131c27d1
mov al, 1
jmp 0x131c27e3
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x131c2d94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x131c2dad
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x131c2da6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x131c2dbf
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x131c2db8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.131c2988
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x131c2dd9
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.131c2a98
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x131c2e5e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x131c2e7b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.131c2a18
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x131c2ea4
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x131c2ebc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x131c2ed5
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x131c2ece
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x131c2ee9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131c2880
test bl, bl
jne 0x131c2fbc
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x49cf28
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x131c2f20
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x131c2f34
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131c2d94
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x131c2f66
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x131c2f15
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x131c2f89
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x131c2f9a
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x131c2fae
jmp 0x131c3077
cmp bl, 1
jne 0x131c3077
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x49cf82
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x131c2fdc
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x131c2ff0
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131c2d94
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x131c3022
sub ebx, 6
inc dword [ebp - 8]
jne 0x131c2fd1
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x131c3049
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x131c305a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x131c306e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131c2904
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x131c5740
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call fcn.1315ad60
push eax
call fcn.1315ae28
mov ebx, eax
call fcn.1315ad70
push eax
call fcn.1315aea0
mov esi, eax
push 0x100
call fcn.1315ad60
push eax
call fcn.1315b050
push 0xf
call fcn.1315ad70
push eax
call fcn.1315b060
push 0xa
call fcn.13161f08
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call fcn.13161f08
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call fcn.1315ad70
push eax
call fcn.1315b060
push ebx
call fcn.1315ad60
push eax
call fcn.1315b050
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x471a04]
fstp qword [ebp - 0x10]
wait
fld qword [ebp - 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x131dcf78
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x131dcf81
mov eax, dword [esp + 0x2000]
add esp, 4
mov esi, edx
lea edi, [esp]
push ecx
mov ecx, 0x800
rep movsd dword es:[edi], dword [esi]
pop ecx
dec ecx
test ecx, ecx
jl 0x131dcfd2
inc ecx
mov edx, esp
mov ebx, dword [eax]
movzx esi, byte [edx]
xor ebx, esi
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49a728]
mov esi, dword [eax]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov dword [eax], ebx
inc edx
dec ecx
jne 0x131dcfab
add esp, 0x2000
pop edi
pop esi
pop ebx
ret
Function at 0x1320adc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.132050e4
xor eax, eax
push ebp
push 0x409dc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x409d8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.13204f68
test eax, eax
jne 0x1320ae20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1320af19
lea eax, [ebp - 0x1d4]
call fcn.1320ad10
lea eax, [ebp - 0x1d4]
mov edx, 0x409de0
call fcn.13204f70
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.13203b04
mov eax, dword [0x40b40c]
mov byte [eax], 2
lea eax, [ebp - 0x1d8]
call fcn.1320ad10
lea eax, [ebp - 0x1d8]
mov edx, 0x409de0
call fcn.13204f70
mov eax, dword [ebp - 0x1d8]
call fcn.13206e48
test al, al
je 0x1320ae90
lea eax, [ebp - 0x1d0]
call fcn.132038a0
call fcn.132037ac
jmp 0x1320aea0
lea eax, [ebp - 0x1d0]
call fcn.13203894
call fcn.132037ac
mov eax, dword [ebp + 8]
call fcn.13204f68
mov ebx, eax
test ebx, ebx
jle 0x1320aedd
mov esi, 1
lea eax, [ebp - 0x1dc]
mov edx, dword [ebp + 8]
movzx edx, byte [edx + esi - 1]
xor dx, 0x30e
call fcn.13204eb4
mov edx, dword [ebp - 0x1dc]
lea eax, [ebp - 4]
call fcn.13204f70
inc esi
dec ebx
jne 0x1320aeb3
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.13205280
call fcn.13203bc0
call fcn.132037ac
lea eax, [ebp - 0x1d0]
call fcn.13203bcc
call fcn.132037ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1320af19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409dce
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.13204d0c
lea eax, [ebp - 4]
call fcn.13204ce8
lea eax, [ebp + 8]
call fcn.13204ce8
ret

Function at 0x132139c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x13213a60
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.13211a8c
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.132119fc
lea edx, [ebp + 0x30]
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x132139ec
cmp byte [esp], 0
je 0x13213a31
mov eax, edi
call fcn.132119fc
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x13213a6c
mov eax, edi
call fcn.132119fc
push eax
mov eax, edi
call fcn.132119fc
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.132101e4
mov edx, ebx
mov eax, edi
call fcn.13211a8c
jmp 0x13213a6c
mov eax, edi
mov edx, 0x405efc
call fcn.13211568
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1321404c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.13211994
xor eax, eax
push ebp
push 0x40652e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.13211568
mov eax, ebx
call fcn.132119f4
mov eax, dword [ebx]
call fcn.132117a4
test eax, eax
jle 0x13214098
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x1321408d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406535
lea eax, [ebp - 4]
call fcn.13211514
ret

Function at 0x13214354
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
xor edx, edx
push ebp
push 0x40680c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [eax], 0x5a4d
jne 0x13214382
lea edx, [eax + 0x3c]
mov ebx, dword [edx]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x13214382
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13214398
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x13217570
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call fcn.13212f3c
cmp eax, 0x1c
jne 0x132175ec
cmp dword [esp + 0x10], 0x1000
jne 0x132175ec
cmp dword [esp + 4], 0
je 0x132175ec
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call fcn.13212e1c
test eax, eax
je 0x132175ec
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x132175ec
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x132175ec
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1327f364
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push 0xf
call fcn.132802a8
pop ecx
push 0
push 4
push 0x13292618
mov eax, dword [0x13292614]
push eax
mov edx, dword [0x132925bc]
push edx
call sub.KERNEL32.DLL_ReadProcessMemory
or dword [0x13292618], 0xa0
push 0
push 4
push 0x13292618
mov ecx, dword [0x13292614]
push ecx
mov eax, dword [0x132925bc]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
mov ebx, 1
push 0xffffffffffffffff
lea eax, [ebp - 0x60]
push eax
call sub.KERNEL32.DLL_WaitForDebugEvent
test eax, eax
je 0x1327f416
cmp dword [ebp - 0x60], 1
jne 0x1327f3e6
lea edx, [ebp - 0x60]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.1327f230
add esp, 0xc
mov ebx, eax
jmp 0x1327f3f8
cmp dword [ebp - 0x60], 5
jne 0x1327f3f8
mov dword [0x1328d0a4], 1
jmp 0x1327f458
test ebx, ebx
je 0x1327f403
mov eax, 0x10002
jmp 0x1327f408
mov eax, 0x80010001
push eax
mov edx, dword [ebp - 0x58]
push edx
mov ecx, dword [ebp - 0x5c]
push ecx
call sub.KERNEL32.DLL_ContinueDebugEvent
call dword [0x13292624]
test eax, eax
jne 0x1327f429
cmp dword [0x13292620], 0
jne 0x1327f3b4
push 0x1328d0f1
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
mov ecx, 0x1328d0fc
xor eax, eax
mov edx, ecx
xor byte [edx], al
inc eax
inc edx
cmp eax, 0xf
jl 0x1327f43e
push ecx
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
push 0
push 0
call ebx
jmp 0x1327f450
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1327fef8
Capabilities:
Accept command line arguments
Create process on windows
Create thread

Disassembly:
push ebx
push ecx
push 0x10
push 0
push 0x132925bc
call fcn.1328174c
add esp, 0xc
push 0x44
push 0
push 0x132925cc
call fcn.1328174c
add esp, 0xc
mov dword [0x132925cc], 0x44
or dword [0x132925f8], 0x100
push 0x64
push 0x13292628
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
mov dword [0x13292754], ebx
push 0x132925bc
push 0x132925cc
push 0
push 0
push 0x14
push 1
push 0
push 0
push ebx
push 0x13292628
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, eax
push esp
push 0
push 0
push 0x1327fdc8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
test ebx, ebx
jne 0x1327ff93
push 0x1328d1d8
call fcn.1327ff98
pop ecx
pop edx
pop ebx
ret
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x13280fec
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x13286860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x132868c2
call fcn.13286810
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.1328182c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.1328182c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x13286940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x1328ee7c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x13286a1a
cmp dword [0x1328ee78], 0
jne 0x13286a1a
cmp dword [0x1328f084], 0
je 0x132869d4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.13286710
add esp, 8
mov ebx, eax
test eax, eax
jne 0x132869ba
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.13286710
add esp, 8
mov ebx, eax
test eax, eax
jne 0x132869ba
lea ebx, [ebp - 0x84]
jmp 0x132869bb
inc ebx
call fcn.132868fc
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x13286a55
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x1328ee80
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.1328182c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x1328ee83
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x13286a55
cmp dword [0x1328ee78], 0
je 0x13286a34
cmp dword [0x1328ee78], 0xffffffff
je 0x13286a55
push esi
call dword [0x1328ee78]
pop ecx
mov eax, dword [0x1328ee7c]
test eax, eax
je 0x13286a55
cmp dword [0x1328ee7c], 0xffffffff
je 0x13286a55
cmp byte [eax], 0
je 0x13286a55
push esi
push eax
call fcn.13286860
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x13289ae8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x1328f960
test edx, edx
jne 0x13289b07
xor eax, eax
jmp 0x13289c25
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x13289b24
push esi
push edx
push eax
call fcn.13289c2c
add esp, 0xc
jmp 0x13289c25
push esi
push edx
push eax
call fcn.13289eec
add esp, 0xc
jmp 0x13289c25
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x422769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x426190
cmp edx, dword [eax]
je 0x42278b
add eax, 8
inc ecx
cmp eax, 0x426220
jl 0x42277c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x426190]
jne 0x4228b9
mov eax, dword [0x426bb0]
cmp eax, 1
je 0x422893
test eax, eax
jne 0x4227bc
cmp dword [0x4260e4], 1
je 0x422893
cmp edx, 0xfc
je 0x4228b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4227f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00423670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00423490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x422836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00423490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42545c
push edi
call fcn.00423f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00423670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00423680
lea eax, [ebp - 0xa0]
push 0x42543c
push eax
call fcn.00423680
push dword [esi + 0x426194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00423680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00423e75
add esp, 0x2c
pop edi
jmp 0x4228b9
lea eax, [ebp + 8]
lea esi, [esi + 0x426194]
push 0
push eax
push dword [esi]
call fcn.00423490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219