joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c40
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x10034550]
push esi
test eax, eax
push edi
jne 0x10001cb6
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x10001cb4
push 8
call fcn.1000f91d
mov esi, eax
add esp, 4
test esi, esi
jne 0x10001c70
mov edi, 8
jmp 0x10001c8d
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.1000f8f6
add esp, 4
mov dword [0x10034550], edi
mov eax, edi
pop edi
mov dword [0x10034554], 0
pop esi
ret 4
mov dword [esi + 4], edi
mov eax, dword [0x10034558]
mov dword [esi], eax
mov dword [0x10034558], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x10002210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100255a8
push 0x100134f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000229a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x10002293
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ecx], 0x4550
jne 0x10002293
cmp word [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
je 0x1000229a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100022b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1003454c], eax
je 0x100022d0
pop edi
pop esi
pop ebp
mov eax, 0x10dd
pop ebx
pop ecx
ret 8
mov eax, dword [0x10034550]
test eax, eax
jne 0x100023de
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x100022f2
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
pop ecx
ret 8
cmp dword [ebp], 0
jne 0x10002310
pop edi
mov eax, 6
mov dword [0x10034554], ebp
pop esi
pop ebp
mov dword [0x10034550], eax
pop ebx
pop ecx
ret 8
push 0x18
call fcn.1000f91d
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000232a
mov edi, 8
jmp 0x100023c3
mov eax, dword [esp + 0x1c]
mov ebx, dword [ebp]
push 0
push eax
call fcn.100016b0
mov edi, dword [ebx + 0x18]
xor ecx, ecx
mov cl, byte [ebx + 0x17]
sub edi, ecx
test ecx, ecx
je 0x100023b5
cmp ecx, 0x17
ja 0x100023b5
cmp dword [ebx + 0x1c], eax
je 0x10002361
mov eax, dword [0x10034548]
mov edi, 9
test eax, eax
jne 0x100023c9
jmp 0x100023c3
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
push edx
push 0x40
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10002386
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100023c3
mov dword [esi + 4], 1
mov dword [esi + 8], ebp
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], edi
mov eax, dword [esp + 0x10]
pop edi
mov dword [esi + 0x14], eax
mov ecx, dword [0x1003455c]
mov dword [esi], ecx
mov dword [0x1003455c], esi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov eax, dword [0x10034548]
mov edi, 9
test eax, eax
jne 0x100023c9
mov dword [0x10034550], edi
test esi, esi
je 0x100023d6
push esi
call fcn.1000f8f6
add esp, 4
mov dword [0x10034554], ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x10007ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x3e8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10007f03
push 0
push 0x100204f8
push 0x10020510
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10007f2e
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10010e70
add esp, 0xc
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x3e8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10009760
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x100337a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x100097d2
cmp dword [ebp - 4], 0
je 0x100097d2
lea edx, [ebp - 8]
push edx
push 0x40
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0xe9
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10002af0
add esp, 8
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
call fcn.1000f260
add esp, 8
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100097d6
xor ecx, ecx
jne 0x100097d2
mov esp, ebp
pop ebp
ret

Function at 0x1000f050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x1000f2a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], 0x428
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1000f309
mov edx, dword [ebp - 0x410]
cmp edx, dword [ebp + 8]
jne 0x1000f2f5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x414]
jmp 0x1000f315
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1000f2d8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f4a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
xor eax, eax
jne 0x1000f4a9
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, 1
test edx, edx
je 0x1000f577
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x1000f4ef
cmp dword [ebp - 0xc], 2
je 0x1000f506
cmp dword [ebp - 0xc], 0xff
je 0x1000f56a
jmp 0x1000f56c
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
add edx, dword [ebp + 8]
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1000f572
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x40
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10010e70
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1000f572
jmp 0x1000f577
xor ecx, ecx
jne 0x1000f56c
jmp 0x1000f577
jmp 0x1000f4b3
mov esp, ebp
pop ebp
ret 8
Function at 0x626520
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], 0xe8
push dword [esp]
lea esp, [esp + 0x34]
jnp 0x77c802
jbe 0x77a67b
bts di, 0xd
xor edi, edi
rol cl, cl
add di, dx
mov edi, dword [edx + 0x24]
bsr cx, ax
sar bx, cl
sbb ebx, 0xc9fd731e
add edi, eax
sub bx, ax
mov ebx, dword [edx + 0x20]
movsx ecx, dl
pushal
add ebx, eax
pushal
mov dword [ebp - 8], 0
bts ecx, 1
add cl, bh
shrd cx, cx, 8
mov ecx, dword [edx + 0x18]
add esp, 0x40
pushfd
sub ecx, dword [edx + 0x10]
pushfd
pushal
jmp 0x7cf67b
sbb eax, dword [ecx - 0x17d4beee]
int3
mov dl, 0xa9
daa
cld
sti
int1
push eax
or byte [esi + 0x50], al
test byte [edx], 0xc
out dx, al
shr byte [ebx - 0x65], 0x40
pop eax
mov eax, dword [0xe3d55eff]
jge 0x77c7cf
aad 0xa8
xor bh, ah
dec edx
jmp 0x77c755
leave
sub al, 0x7e
pushal
sub dh, byte [esp + eax*4]
and eax, 0x80ea8063
xchg dword [ecx], edx
xchg edi, eax
jns 0x77c812
mov dword [edi - 0x700e7b36], edx
test byte [esi - 0x31], 0x29
push esp
pop ss
and ebx, dword [ebx + 0x47]
and dh, byte [edi]
test byte [eax], al
mov eax, 0xe8be0655
imul edx, dword [ecx], 0x5ef2e6cb
out 0xf2, al
pop esi
loop 0x77c786
cli
pushal
pushal
call fcn.007780a9
mov dh, byte [edx + esi*8]
ror byte [edi + edx - 0x4a84154c], 1
dec ecx
rcl byte [esi - 0x5cca1c59], cl
jne 0x77c862
mov eax, dword [0xa177197f]
aas
and edi, ebx
int1
dec edi
popfd
jmp 0x77c839
xor al, 0xa5
jae 0x77c8a6
xchg dword [ebp - 0x61], ecx
mov ch, byte [0x524a0144]
or eax, 0x14c6ecfc
sbb dword [edx + eax*4 + 0x2e], esp
mov ebx, 0xae5057b0
jns 0x77c8ac
inc ebx
sbb eax, 0xda54e48a
jne 0x77c7fb
pop dword [ebp + 0x7c0632b4]
cld
xor al, byte [esi]
jl 0x77c862
retf 0xf913
ror ch, 0xcb
sub eax, 0xcfdd2afb
mov ecx, 0x5dfcf343
mov word [0xb0ef96e8], cs
inc eax
push 0x3cf21ac5
dec ecx
add bl, dh
std
lea ebx, [ebp + 0x2ae1f454]
jle 0x77c929
invalid
das
loopne 0x77c912
and dh, 0xf2
pop esi
xchg edi, eax
div byte [edi]
mov cl, 0xe9
aam 7
add byte [eax], al
das
add eax, 0x8d23d5d3
and byte [ecx - 0x26], bh
adc eax, 0x729cb2db
int3
cmp ah, ah
push es
mov al, 0x9e
sahf
pop eax
mov dl, 0xdc
cmp dl, byte [edx + 0x3c]
pop esi
cli
pop eax
push esi
enter 0x39b0, 0xffffffffffffffb1
popfd
movsd dword es:[edi], dword [esi]
xchg byte [esi + 0x1bbbab6], bl
add esp, esi
jb 0x77c925
cwde
mov ah, 0x10
pop ebp
adc esp, eax
sbb dword [edx + 0x269a9dd2], 0xffffffbd
stosd dword es:[edi], eax
jmp 0x77c8fb
call 0x6288ae
neg dl
rcr dx, cl
rcl dh, cl
inc dx
push ebp
btr bp, 1
bt cx, cx
mov dx, bp
xadd dx, bp
mov ebp, esp
rcl edx, cl
or dx, 0xa6ae
push eax
shl dh, 7
btr dx, 2
cmp al, bh
and dl, 0x3a
push ecx
rcl dh, cl
setbe ch
sal dh, cl
movzx dx, bl
push ebx
ror ch, cl
shl ch, 3
push edi
xor dl, 0x31
push esi
lea esi, [edx*8 - 0x6e71a520]
mov edx, dword [ebp + 8]
pushal
mov esi, dword [ebp + 0xc]
shl ch, 4
mov ecx, dword [ebp + 0x14]
cmc
call fcn.007854e3
jmp 0x7d2a81
call fcn.0079232e
movsx si, dl
mov esi, dword [esp + 0x34]
mov byte [esp], ah
lea esp, [esp + 0x38]
jmp 0x626ff7
Function at 0x62c4dd
Capabilities:
Encode data using xor

Disassembly:
fadd qword [edx + 0x28]
imul edi, dword [ebx + 0x76], 0xffffff9a
push esp
or ebx, 0x35db43b3
xchg esp, eax
cmp byte [esi], bh
dec ecx
xchg dword [eax], ecx
in al, 0x4c
xchg ebp, eax
adc al, 0xe9
mov al, 0xf6
cld
stosd dword es:[edi], eax
clc
les edi, [eax + 0x5749d4e4]
or dword [esi - 0x7c702e34], ebx
sub esi, ecx
mov al, byte es:[0xb4c6540d]
xor al, 0x62
ror byte [eax - 0x1e5e900f], 1
mov edi, 0x70760f06
dec esp
invalid
xchg esi, eax
inc eax
pop ecx
scasb al, byte es:[edi]
pop esi
mov cs, word [edi - 0x31]
cmpsb byte [esi], byte es:[edi]
xchg byte [ebx + 5], bh
popfd
clc
pop ecx
sar byte [esi - 0x23], cl
xchg ebp, eax
out 0x91, al
out 0xdd, al
adc byte [ebp - 0x179e4103], ah
xor dword [edi + 0x16], 0
call 0x78f27e
sbb eax, 0x51151fd1
lahf
jns 0x627ada
jo 0x627a93
sbb eax, dword [eax + esi*2 - 1]
loope 0x627ab7
ljmp 0x8a21:0xd72e9abc
mov esi, dword [ebp + 0xc]
mov byte [esp + 4], 0x7b
pushfd
mov dword [esp + 0x2c], eax
jmp 0x79259e
mov dword [ebp - 4], ecx
dec di
dec cx
mov ecx, dword [ebp - 8]
xadd di, si
btr si, 0xb
movzx edi, bl
bt sp, 2
add ecx, dword [ebp - 4]
neg esi
shl si, cl
lea esi, [esi*2 + 0x22d510f6]
shr ecx, 1
bswap di
shr di, 0xa
mov esi, dword [esp]
neg esi
mov edi, dword [ebx + ecx*4]
shld esi, ebx, 0xe
pushfd
not esi
pushal
add edi, eax
movzx si, cl
movzx si, bl
jmp 0x62bf56
pushfd
lodsb al, byte [esi]
pushfd
pushfd
jmp 0x627af6

Function at 0x78fb60
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x20
push 0x51f25488
cmp cx, di
repne scasb al, byte es:[edi]
call fcn.00628d6a
pop es
aas
jns 0x78fb2e
aaa
or dword [edi + 0x19], eax
invalid

Function at 0x7cc39b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, dl
rcr ah, cl
bsf ax, di
push ebp
or ax, 0xac1a
movzx eax, dl
aam 0x86
setle ah
mov ebp, esp
rol ah, 5
sub esp, 0x18
aad 0xc1
lahf
add ah, 0x21
rol al, cl
push esi
shrd ax, sp, 3
cmp al, 0xf2
aad 0x86
btr ax, 0xe
push edi
or ah, ch
push ebx
pushal
pop eax
mov ax, bx
mov dword [esp + 0x18], edx
sal ah, 3
adc al, 0xb4
neg eax
mov eax, dword [ebp + 8]
cmp ch, 0x64
cmc
pushal
jmp 0x7d3703
lea esp, [esp + 0x38]
je 0x7760f0
or dx, bp
mov si, bp
push 0x87720211
test bl, 0x49
mov esi, dword [eax + 0x3c]
movzx edx, bl
sar dl, cl
add esi, eax
xor dx, ax
bsr dx, cx
mov edx, dword [esi + 0x78]
test si, 0x7c0f
cmc
cmp ah, 0x32
pushfd
test edx, edx
pushfd
mov byte [esp], dh
pushal
call fcn.007c9df1
scasb al, byte es:[edi]
mov al, 0x9a
test al, 2
dec esp
jg 0x7ce415
test al, 0xf2
sub dword [edx - 0x34], ebx
wait
pop ebp
sub al, 0x1a
mov eax, 0xb87aa0b2
sbb bh, byte [eax - 0x47855f4e]
mov byte [ecx + 0x72], 0xde
jg 0x7ce3d0
in eax, 0x99
invalid
test eax, eax
jmp 0x7ce3c3
Function at 0x100011a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov al, al
sub ebp, 0x44227026
add ebp, dword [esp + 0x24]
or ebp, eax
sub ebp, 0x770a5d50
shl ebp, cl
mov ebp, esp
sub esp, 0x40
xchg ax, ax
jmp 0x1000138d
cmp eax, dword [ebp - 0x40]
mov al, al
jne 0x1000199f
jmp 0x10001975
push dword [sym.imp.user32.dll_GetDesktopWindow]
or eax, ecx
mov ax, 0x24c4
and eax, 0x46af555c
ror ax, cl
sub eax, dword [esp + 0x24]
push ebx
shr eax, cl
add eax, eax
shl al, cl
or ax, 0x882
xor eax, dword [esp + 0x24]
or ax, 0x16c4
and eax, 0
add eax, 0x10
shl bx, cl
rol bx, cl
shr bl, cl
dec eax
test eax, eax
jne 0x100013c4
pop ebx
pop eax
call eax
xor ecx, ecx
nop
mov dword [ebp - 0x2c], ecx
mov bl, bl
mov dword [ebp - 0x38], ecx
mov ebx, ebx
mov dword [ebp - 0x34], ecx
mov dx, dx
lea ecx, [ebp - 0x40]
nop
nop
nop
nop
nop
jmp 0x100015dc
push ecx
xchg cl, cl
push eax
xchg esp, esp
jmp 0x10001797
mov dword [ebp - 0x30], 0x78
xchg edx, edx
mov ax, cx
sub eax, esp
or eax, dword [esp + 8]
push ecx
dec eax
or eax, dword [esp + 0x20]
add eax, esp
add eax, dword [esp + 8]
push 0
sub ax, bx
ror eax, cl
pop eax
add eax, 0x1a
mov cl, 0xe2
or ecx, edi
add cx, 0x660d
rol cx, cl
xor ecx, edi
dec eax
test eax, eax
jne 0x100017c6
pop ecx
lea eax, sym.imp.user32.dll_BeginPaint
call dword [eax]
jmp 0x100011d3
xor eax, eax
mov dl, dl
cmp dword [ebp - 0x30], 0x78
xchg bl, bl
setne al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
leave
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
ret
mov dword [0x100034c8], 0x1e0f3
nop
nop
nop
nop
nop
nop
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
leave
nop
nop
nop
nop
nop
nop
nop
nop
nop
ret
Function at 0x100011e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and dword [ebp - 4], 0
cld
push ebx
mov esi, esi
add eax, edx
xchg bx, bx
mov ecx, dword [esp + 0x14]
xor ecx, dword [esp + 0x10]
mov ecx, dword [eax + 0x20]
sub ebx, 0x470d3b6f
dec bx
mov ebx, ebx
xor ebx, dword [esp + 0xc]
mov ebx, dword [eax + 0x1c]
jmp 0x100015e7
push ebp
mov cl, cl
dec ebp
mov ebp, 0x2e25a3e
mov ebp, edx
add ebp, 0x49335d8d
mov ebp, esp
sub esp, 0x10
xchg cl, cl
ror eax, cl
shl eax, cl
ror eax, cl
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0x78]
mov dl, dl
jmp 0x10001067
push esi
push ebx
pop ebx
push edi
xchg cx, cx
add edi, eax
or edi, 0xb19323c
add edi, ebp
mov edi, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
xchg dx, dx
add edi, edx
mov bx, bx
add ecx, edx
push esi
pop esi
add ebx, edx
mov bx, bx
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x100017e7
mov dword [ebp - 0x10], eax
nop
nop
nop
nop
jle 0x10001b30
and ax, 0x4e80
and al, dl
and ax, 0x4896
ror ax, cl
and eax, eax
mov eax, dword [ebp - 4]
mov esi, dword [ecx + eax*4]
xchg bx, bx
and dword [ebp - 0xc], 0
nop
add esi, edx
nop
mov al, byte [esi]
mov al, al
test al, al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
je 0x100019eb
nop
nop
nop
nop
nop
mov dword [ebp - 8], esi
mov esi, esi
and esi, eax
mov esi, dword [ebp - 0xc]
movsx eax, al
nop
nop
nop
nop
nop
nop
nop
nop
rol esi, 3
nop
nop
nop
nop
xor esi, eax
xchg dx, dx
inc dword [ebp - 8]
cld
sub eax, dword [esp + 0x18]
and eax, ebx
add eax, dword [esp + 0x24]
or eax, ecx
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov ebx, ebx
jmp 0x100019d2
test al, al
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x10001838
or ax, cx
or ax, 0x6166
mov eax, edi
and al, dl
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
nop
je 0x10001b38
inc dword [ebp - 4]
nop
jmp 0x10001b13
add eax, dword [esp]
or eax, 0x60fe79a5
inc ax
ror al, cl
mov eax, ecx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
nop
jl 0x100017f4
xor eax, eax
nop
jmp 0x10001b5d
ror al, cl
or eax, dword [esp + 0x1c]
ror al, cl
shl al, cl
mov eax, dword [ebp - 4]
nop
nop
nop
nop
nop
movzx eax, word [edi + eax*2]
nop
nop
nop
nop
nop
mov eax, dword [ebx + eax*4]
mov cx, cx
add eax, edx
mov cl, cl
add edi, 0x29f22177
shr edi, cl
ror edi, cl
pop edi
or esi, 0x744d37c7
pop esi
sub bx, bx
ror bl, cl
mov ebx, esp
rol bl, cl
pop ebx
leave
nop
nop
nop
nop
nop
nop
nop
nop
nop
ret

Function at 0x1000126d
Capabilities:
Access peb ldr_data

Disassembly:
dec dl
mov edx, dword [eax + 8]
test edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x10001239
xor eax, eax
xchg ax, ax
ret 0x10
push 0xc5ff2f46
nop
call fcn.100011e7
cld
dec cl
shl ecx, cl
add cx, 0x417f
shr ecx, cl
pop ecx
jmp eax
push dword fs:[0x30]
nop
nop
nop
nop
nop
nop
nop
and eax, edx
mov al, al
pop eax
mov eax, dword [eax + 0xc]
push esi
pop esi
mov eax, dword [eax + 0x1c]
mov esp, esp
mov eax, dword [eax]
push ecx
pop ecx
jmp 0x10001213
Function at 0x10001296
Capabilities:
Access peb ldr_data

Disassembly:
push dword fs:[0x30]
nop
nop
nop
nop
add eax, dword [esp + 8]
or ax, 0x7434
rol al, cl
pop eax
mov eax, dword [eax + 0xc]
xchg bx, bx
mov eax, dword [eax + 0x1c]
nop
mov eax, dword [eax]
xchg cx, cx
jmp 0x1000145a
push 0x1000
push ebp
pop ebp
push dword [esp + 0xc]
push edx
pop edx
push 0
nop
call eax
nop
ret 8
mov dl, al
shr dl, cl
sub dx, dx
xor dl, 0x36
mov edx, dword [eax + 8]
test edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x10001483
xor eax, eax
xchg ax, ax
jmp 0x1000134e
push 0xab16d0ae
nop
call fcn.100011e7
nop
sub cl, al
mov ecx, 0x11316c2b
dec cl
pop ecx
push dword [esp + 8]
xchg ax, ax
jmp 0x10001339
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x510164e0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x7a068e2
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401170
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x418050]
xor eax, esp
mov dword [esp + 0x210], eax
cmp dword [0x51a394], 0
push ebx
jne 0x4011a6
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00403476
add esp, 0x218
ret
mov eax, dword [0x51a5a0]
test eax, eax
je 0x4011c2
push eax
call fcn.0040493c
add esp, 4
mov dword [0x51a5a0], 0
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
call fcn.00401510
lea ebx, [esp + 8]
call fcn.004013e0
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x51a5a0], eax
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00403476
add esp, 0x218
ret

Function at 0x401210
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push ebx
push edi
push 0x519fd0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test byte [0x51a7e4], 1
jne 0x401241
mov eax, dword [esi + 0x214]
or dword [0x51a7e4], 1
mov dword [0x51a7e0], eax
mov ebx, dword [0x51a7e0]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x51a7e0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea ebx, [ebx]
mov edx, dword [ecx*4 + 0x519ff0]
test edx, edx
je 0x401275
cmp edx, eax
je 0x401286
inc ecx
cmp ecx, 0x64
jl 0x401260
cmp ecx, 0x64
jne 0x40127f
mov ecx, 0x63
mov dword [ecx*4 + 0x519ff0], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea edi, [ecx + 1]
mov ecx, dword [esi + 0x220]
push ecx
push edx
push 0x5c
push eax
call fcn.00403e6d
add esp, 8
add eax, 2
push eax
mov eax, dword [0x51a7e0]
mov ecx, eax
sub ecx, ebx
mov dword [esp + 0x48], ecx
fild dword [esp + 0x48]
push edi
test ecx, ecx
jge 0x4012c2
fadd qword [0x415fd0]
fld qword [0x415fc8]
sub eax, dword [esi + 0x214]
fdiv st(1), st(0)
sub esp, 0x10
mov dword [esp + 0x5c], eax
fxch st(1)
fstp qword [esp + 8]
fild dword [esp + 0x5c]
test eax, eax
jge 0x4012eb
fadd qword [0x415fd0]
fdivrp st(1)
lea edx, [esi + 8]
fstp qword [esp]
push 0x415bf4
push edx
push str.__s:_s___.2f___.2f__THREAD__d___s:_d___s__
push 0x80000
push 0x419ff0
call fcn.00403636
mov eax, 0x419ff0
add esp, 0x34
lea ecx, [eax + 2]
jmp 0x401320
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401320
sub eax, ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x10]
push edx
sar eax, 1
push ecx
mov edx, 0x80000
sub edx, eax
mov dword [0x51a7dc], eax
push edx
lea eax, [eax*2 + 0x419ff0]
push eax
call fcn.00403ce3
push 0x415c58
push 0x80000
push 0x419ff0
call fcn.00404679
add esp, 0x1c
lea edi, [esi + 0x434]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], 0
je 0x4013a9
mov eax, dword [esi + 0x210]
test eax, eax
je 0x4013a9
cmp dword [esi + 0x224], 2
jl 0x4013a9
push eax
push 0x419ff0
call fcn.00404161
mov ecx, dword [esi + 0x210]
push ecx
call fcn.00403b04
add esp, 0xc
cmp dword [esi + 4], 0
je 0x4013c3
cmp dword [esi + 0x228], 2
jl 0x4013c3
push 0x419ff0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4013e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x415c5c
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0
call fcn.0040354b
add esp, 0xc
test eax, eax
je 0x4014bc
mov ecx, dword [esp]
push 2
push 0
push ecx
call fcn.00404780
add esp, 0xc
test eax, eax
jne 0x4014bc
mov edx, dword [esp]
push edx
call fcn.0040460b
add esp, 4
test eax, eax
jle 0x4014bc
mov eax, dword [esp]
push 2
push 0
push eax
call fcn.00404780
add esp, 0xc
test eax, eax
jne 0x4014bc
push esi
push eax
call fcn.004038b0
mov esi, eax
add esp, 4
test esi, esi
je 0x4014bb
mov ecx, dword [esp + 4]
push edi
push ecx
push 0
push 1
push esi
call fcn.00404139
mov edx, dword [esp + 0x18]
push edx
mov edi, eax
call fcn.0040493c
push 0x415c5c
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0040354b
mov eax, dword [esp + 0x28]
add esp, 0x20
test eax, eax
je 0x4014b1
push eax
push 0x415c60
call fcn.00404161
mov ecx, dword [esp + 0x10]
push ecx
push edi
push 1
push esi
call fcn.004043ec
mov edx, dword [esp + 0x20]
push edx
call fcn.00403b04
add esp, 0x1c
push esi
call fcn.004037d3
add esp, 4
pop edi
pop esi
mov eax, dword [esp]
test eax, eax
je 0x4014d4
push 2
push 0
push eax
call fcn.00404780
mov eax, dword [esp + 0xc]
add esp, 0xc
pop ecx
ret