joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cf10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x16], 0x747865
mov word [esp + 0x11], 0x7373
mov dword [esp + 0xd], 0x65636f72
mov word [esp + 0x14], 0x4e32
mov byte [esp + 0xc], 0x50
mov byte [esp + 0x13], 0x33
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [section..rdata]
test eax, eax
je 0x1000cf7d
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x14
ret

Function at 0x1000cf90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x10], 0x33737365
mov dword [esp + 0x16], 0x74737269
mov word [esp + 0xd], 0x6f72
mov word [esp + 0x14], 0x4632
mov byte [esp + 0xc], 0x50
mov byte [esp + 0xf], 0x63
mov byte [esp + 0x1a], 0
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [section..rdata]
test eax, eax
je 0x1000d002
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x14
ret

Function at 0x1000d020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
mov word [esp + 4], 0x7243
mov dword [esp + 0x10], 0x3233706c
mov word [esp + 0xe], 0x6568
mov dword [esp + 9], 0x6f6f5465
mov word [esp + 7], 0x7461
mov word [esp + 0x18], 0x6873
mov word [esp + 0x1b], 0x74
mov dword [esp + 0x14], 0x70616e53
mov byte [esp + 0xd], 0x6c
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 6], 0x65
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [section..rdata]
test eax, eax
je 0x1000d0a8
push 0
push 2
call eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10001e2b
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
xor ecx, esp
or eax, 0xffffffff
call fcn.10001e2b
add esp, 0x20
ret
Function at 0x1000d0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
push esi
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x18]
push eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x2e], 0x416e6f
mov dword [esp + 0x29], 0x74616d72
mov dword [esp + 0x22], 0x49656d75
mov dword [esp + 0x1d], 0x6f567465
mov word [esp + 0x27], 0x6f66
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x1c], 0x47
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [section..rdata]
test eax, eax
je 0x1000d170
push 0x105
push dword [esp + 0x18]
push dword [esp + 0x18]
push ebp
push ebx
push 0x105
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10001e2b
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x24
ret

Function at 0x1000d190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.10011ac0
mov ecx, eax
call fcn.100119f0
test eax, eax
je 0x1000d21f
lea ecx, [esp + 0x10]
push ecx
push eax
mov word [esp + 0x1b], 0x7551
mov dword [esp + 0x25], 0x417845
mov dword [esp + 0x1e], 0x61567972
mov word [esp + 0x23], 0x6575
mov word [esp + 0x18], 0x6552
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x22], 0x6c
call dword [section..rdata]
test eax, eax
je 0x1000d21f
push ebp
push ebx
push 0
push 0
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10001e2b
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10001e2b
add esp, 0x18
ret

Function at 0x1000d240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, edx
call fcn.10011ac0
mov ecx, eax
call fcn.100119f0
test eax, eax
je 0x1000d2be
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x14], 0x4b6e6570
mov dword [esp + 0x1a], 0x417845
mov word [esp + 0x18], 0x7965
mov word [esp + 0x11], 0x6765
mov byte [esp + 0x10], 0x52
mov byte [esp + 0x13], 0x4f
call dword [section..rdata]
test eax, eax
je 0x1000d2be
push edi
push dword [esp + 0x28]
push 0
push esi
push 0x80000002
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10001e2b
add esp, 0x14
ret
Function at 0x1000d360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
mov dword [esp + 0x10], 0x6c6f5674
mov dword [esp + 8], 0x646e6946
mov dword [esp + 0xc], 0x73726946
mov dword [esp + 0x15], 0x41656d
mov byte [esp + 0x14], 0x75
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [section..rdata]
test eax, eax
je 0x1000d3ca
push 0x104
push esi
call eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10001e2b
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10001e2b
add esp, 0x18
ret

Function at 0x1000d3e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, edx
call fcn.10011ac0
mov ecx, eax
call fcn.10011990
test eax, eax
je 0x1000d46c
lea ecx, [esp + 4]
push ecx
push eax
mov word [esp + 0x16], 0x6c61
mov dword [esp + 0x1d], 0x74615072
mov dword [esp + 0x11], 0x63657053
mov dword [esp + 0xc], 0x65474853
mov dword [esp + 0x19], 0x65646c6f
mov word [esp + 0x22], 0x41
mov byte [esp + 0x21], 0x68
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x10], 0x74
mov byte [esp + 0x18], 0x46
call dword [section..rdata]
test eax, eax
je 0x1000d46c
push 0
push 0x25
push esi
push 0
call eax
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10001e2b
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x1c
ret

Function at 0x1000e270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x34], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call fcn.1000c860
mov ecx, eax
call fcn.1000ce70
add esp, 4
test eax, eax
je 0x1000e312
lea eax, [esp + 8]
push eax
lea edx, [esp + 0x24]
mov dword [esp + 0x2b], 0x76697250
mov dword [esp + 0x31], 0x656765
mov dword [esp + 0x24], 0x65446553
mov word [esp + 0x28], 0x7562
mov byte [esp + 0x2a], 0x67
mov word [esp + 0x2f], 0x6c69
call fcn.1000cdc0
add esp, 4
test eax, eax
je 0x1000e312
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
sub esp, 0xc
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call fcn.1000cd20
add esp, 0x10
mov ecx, dword [esp + 4]
call fcn.1000c6f0
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10001e2b
add esp, 0x3c
ret

Function at 0x1000f0a0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], 0x1001b348
call fcn.10007c80
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x100118d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x10011915
lea eax, [esp + 4]
push eax
mov word [esp + 0x10], 0x6c
mov dword [esp + 0xb], 0x642e3233
mov word [esp + 9], 0x6964
mov byte [esp + 8], 0x47
mov byte [esp + 0xf], 0x6c
call dword [0x10016014]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.10001e2b
add esp, 0x10
ret

Function at 0x100119f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x10011a38
lea eax, [esp + 4]
push eax
mov word [esp + 0xc], 0x6970
mov dword [esp + 0xf], 0x6c642e32
mov word [esp + 0x13], 0x6c
mov dword [esp + 8], 0x61766441
mov byte [esp + 0xe], 0x33
call dword [0x10016014]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret

Function at 0x10011a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10011a9f
lea eax, [esp + 4]
push eax
mov dword [esp + 0x11], 0x6c6c64
mov word [esp + 0xb], 0x656e
mov word [esp + 0xe], 0x3233
mov word [esp + 8], 0x654b
mov byte [esp + 0xa], 0x72
mov byte [esp + 0xd], 0x6c
mov byte [esp + 0x10], 0x2e
call dword [0x10016018]
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_394
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_105
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100090a4
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x10]
and dword [eax], 0
push 0xfffffffffffffffb
pop ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push esi
call fcn.100091a5
add esp, 0xc
test eax, eax
je 0x10009162
and dword [esp + 8], 0
push ebx
mov ebx, dword [esp + 0x20]
push edi
push ebx
call sub.glib_lite.dll_Ordinal_394
mov edi, eax
pop ecx
test edi, edi
je 0x10009160
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009159
cmp dword [esp + 0x10], ebx
jne 0x1000913f
push sub.glib_lite.dll_Ordinal_105
push edi
push dword [esp + 0x18]
push 0
push ebx
push edi
push 0
call sub.gstreamer_lite.dll_Ordinal_25
mov ecx, eax
add esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [eax], ecx
test ecx, ecx
je 0x10009146
mov eax, dword [esi + 0x110]
xor ebp, ebp
mov dword [ecx + 0x40], eax
mov eax, dword [esi + 0x114]
mov dword [ecx + 0x44], eax
jmp 0x10009146
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
mov eax, dword [esp + 0x10]
add dword [esi + 0x110], eax
adc dword [esi + 0x114], 0
jmp 0x10009160
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x100092c3
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push 0x120
call sub.glib_lite.dll_Ordinal_394
mov edi, eax
pop ecx
test edi, edi
je 0x1000934d
push edi
xor ebp, ebp
push ebp
push 0x1001d834
push 0x10023880
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x10009352
push ebx
push ebp
mov ebx, 0x4000100
push ebx
push 2
push ebp
push 5
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
push ebp
push ebx
push 3
push ebp
push 7
push Ordinal_1
push edi
mov dword [edi + 0x108], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp dword [edi + 0x108], 0xffffffff
mov dword [edi + 0x104], eax
pop ebx
je 0x10009352
cmp eax, 0xffffffff
je 0x10009352
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x110], ebp
mov dword [edi + 0x114], ebp
mov eax, edi
pop edi
pop ebp
ret
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
jmp 0x1000934f

Function at 0x10010530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [eax*4 + 0x1001e2c8]
push esi
push edi
push 0xffffffffffffff80
mov dword [esp + 0x18], ecx
lea edi, [ecx + ecx]
pop esi
mov ebx, esi
xor edx, edx
sar ebx, 0x1f
mov eax, ebx
xor eax, esi
sub eax, ebx
cmp eax, edi
cmovl edx, eax
mov al, bl
sub edx, ecx
mov ecx, edx
sar ecx, 0x1f
xor dl, cl
sub al, dl
add al, cl
mov ecx, dword [esp + 0x14]
add al, cl
xor al, bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0x80
jle 0x1001054d
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10017901
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x18]
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [ebx + 0x14], edi
jne 0x10017934
lea eax, [esp + 0xc]
push eax
push edi
push ebx
push 0x10017955
push edi
push edi
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebx + 0x14], eax
test eax, eax
je 0x10017934
inc edi
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10017a33
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
cmp edi, 0xffffffff
je 0x10017a61
test edi, edi
je 0x10017a61
call dword [sym.imp.kernel32.dll_GetTickCount]
jmp 0x10017a65
mov eax, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x3c], eax
push 0
test esi, esi
lea eax, [esp + 0x18]
push 0
setne bl
push eax
inc ebx
push ebx
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov esi, eax
cmp esi, ebx
jb 0x10017bf2
cmp dword [esp + 0x44], ebp
push 0x48
pop ecx
push 0x40
pop eax
cmove ecx, eax
push 0xa
mov dword [esp + 0x14], ecx
pop edx
cmp edi, edx
mov eax, edi
push ecx
cmova eax, edx
push eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x1c]
push 0
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov esi, eax
cmp esi, ebx
je 0x10017ad6
cmp esi, 0x102
jne 0x10017b85
cmp dword [esp + 0x40], edi
je 0x10017b85
mov esi, dword [esp + 0x44]
test esi, esi
je 0x10017b05
jmp 0x10017aeb
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push dword [esp + 0x4c]
lea eax, [esp + 0x24]
push dword [esp + 0x50]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x10017ae0
xor esi, esi
lea eax, [esp + 0x1c]
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp edi, 0xffffffff
je 0x10017b3c
test edi, edi
je 0x10017b3c
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, eax
mov ecx, edi
sub edx, dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
sub ecx, edx
xor eax, eax
cmp edx, edi
cmovbe eax, ecx
mov edi, eax
test ebp, ebp
jne 0x10017b66
mov ebp, dword [sym.imp.kernel32.dll_GetCurrentThread]
call ebp
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
mov dword [esp + 0x4c], eax
cmp eax, 2
jae 0x10017b63
push 2
call ebp
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
xor ebp, ebp
inc ebp
push esi
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov ecx, dword [esp + 0x10]
mov esi, eax
push 0xa
pop edx
cmp esi, ebx
jae 0x10017a9f
test ebp, ebp
je 0x10017bf2
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 8
call dword [sym.imp.USER32.dll_GetQueueStatus]
shr eax, 0x10
test al, 8
je 0x10017bf2
mov eax, dword [0x100239a4]
test eax, eax
jne 0x10017bc6
push str.AMUnblock
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x100239a4], eax
test eax, eax
je 0x10017be0
push 1
push eax
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
mov eax, dword [0x100239a4]
jne 0x10017bc6
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x14
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001aefd
pop dword [ebp - 0x50]
mov eax, 0xa9b16dfe
sub eax, 0x99afbf01
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xc952cd24
add dword [ebp - 0x60], 0x84ff7827
mov dword [ebp - 0x5c], 0x33f2bab9
sub dword [ebp - 0x5c], 0x1bf6e74
mov dword [ebp - 0x58], 0xf363e067
add dword [ebp - 0x58], 0x58e863c7
mov dword [ebp - 0x54], 0xabd4f405
add dword [ebp - 0x54], 0x542b0bfb
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x6dea07bb
sub dword [ebp - 0x60], 0xf9779e65
mov dword [ebp - 0x5c], 0xbcb17c78
sub dword [ebp - 0x5c], 0x7b451b03
mov dword [ebp - 0x58], 0x5641926
add dword [ebp - 0x58], 0x5e0b5346
mov dword [ebp - 0x54], 0xcfee1eda
sub dword [ebp - 0x54], 0xcfee1eda
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x5a9ab93b
add eax, 0xb56706c5
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x39a5a
push 0
call eax
mov ecx, 0x8edc086e
sub ecx, 0x8edbb78f
mov edx, eax
mov ebx, 0xcd032c46
sub ebx, 0xbd00c446
add ebx, dword [ebp - 0x50]
mov edi, 0x8a2ea7bd
sub edi, 0xe190d4d7
mov esi, dword [ebx]
xor dword [ebp - 0x24], 0x394f5413
sub esi, edi
sub dword [ebp - 0x48], edi
mov dword [edx], esi
add dword [ebp - 0x14], 0xa577b36b
add edx, 4
add ebx, 0xd447f216
sub ebx, 0xd447f212
loop 0x1001b01a
add eax, 0x1364f
xor ebx, ebx
add ebx, eax
add eax, 0xafb28ec6
add eax, 0x504d713f
mov ecx, 0xf2c07175
add ecx, 0x1d3f8e8b
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x2623467e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x9b94465
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219