joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79605ab0
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, 8
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xf3bcc908
mov dword [edx + ecx + 0xc], 0x6a09e667
mov eax, 8
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x84caa73b
mov dword [ecx + eax + 0xc], 0xbb67ae85
mov edx, 8
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0xfe94f82b
mov dword [eax + edx + 0xc], 0x3c6ef372
mov ecx, 8
imul ecx, ecx, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x5f1d36f1
mov dword [edx + ecx + 0xc], 0xa54ff53a
mov eax, 8
shl eax, 2
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xade682d1
mov dword [ecx + eax + 0xc], 0x510e527f
mov edx, 8
imul edx, edx, 5
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x2b3e6c1f
mov dword [eax + edx + 0xc], 0x9b05688c
mov ecx, 8
imul ecx, ecx, 6
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xfb41bd6b
mov dword [edx + ecx + 0xc], 0x1f83d9ab
mov eax, 8
imul eax, eax, 7
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x137e2179
mov dword [ecx + eax + 0xc], 0x5be0cd19
pop ebp
ret

Function at 0x79605cd0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptConfigureContext___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d2d8
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptConfigureContext
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79605d30
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptConfigureContextFunction___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d334
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptConfigureContextFunction
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79605d90
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptCreateContext___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d390
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptCreateContext
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79605df0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptDeleteContext___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d3e0
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptDeleteContext
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException
Function at 0x79605e50
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptDeriveKey___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d42c
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptDeriveKey
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79605eb0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptDestroySecret___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d478
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptDestroySecret
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79605f10
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptEnumContextFunctionProviders___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d4d4
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptEnumContextFunctionProviders
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79605f70
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptEnumContextFunctions___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d538
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptEnumContextFunctions
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79605fd0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptEnumContexts___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d58c
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptEnumContexts
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606030
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptEnumProviders___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d5dc
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptEnumProviders
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606090
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptEnumRegisteredProviders___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d634
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptEnumRegisteredProviders
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException
Function at 0x796060f0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptFinalizeKeyPair___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d690
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptFinalizeKeyPair
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606150
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptFreeBuffer___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d6e0
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptFreeBuffer
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796061b0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptGenerateKeyPair___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d730
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptGenerateKeyPair
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606210
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptQueryContextConfiguration___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d790
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptQueryContextConfiguration
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606270
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptQueryContextFunctionConfiguration___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d804
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptQueryContextFunctionConfiguration
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796062d0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptQueryContextFunctionProperty___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d874
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptQueryContextFunctionProperty
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException
Function at 0x79606330
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptQueryProviderRegistration___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d8e0
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptQueryProviderRegistration
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606390
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptRegisterConfigChangeNotify___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d948
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptRegisterConfigChangeNotify
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796063f0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptResolveProviders___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d9a8
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptResolveProviders
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606450
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptSecretAgreement___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960d9fc
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptSecretAgreement
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796064b0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptSetAuditingInterface___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960da54
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptSetAuditingInterface
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606510
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptSetContextFunctionProperty___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960dab8
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptSetContextFunctionProperty
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException
Function at 0x79606570
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptSignHash___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960db10
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptSignHash
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796065d0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BCryptUnregisterConfigChangeNotify___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960db68
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BCryptUnregisterConfigChangeNotify
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606630
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_GetAsymmetricEncryptionInterface___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960dbd4
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.GetAsymmetricEncryptionInterface
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606690
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_GetCipherInterface___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960dc30
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.GetCipherInterface
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796066f0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_GetHashInterface___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960dc7c
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.GetHashInterface
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x79606750
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_GetRngInterface___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960dcc8
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.GetRngInterface
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796067b0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_GetSecretAgreementInterface___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960dd1c
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.GetSecretAgreementInterface
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException
Function at 0x79606810
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_GetSignatureInterface___n
call sub.ntdll.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7960dd74
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.GetSignatureInterface
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sub.kernel32.dll_RaiseException

Function at 0x796072d0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0xc], eax
cmp dword [0x7960de64], 0xffffffff
je 0x796072eb
jmp 0x79607359
mov dword [0x7960de64], 0
push 0
push 0
push 0x7960de88
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x79607350
mov eax, dword [ebp - 4]
push eax
call fcn.796073e0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x79607350
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push str.DEBUGCHANNEL
call sub.kernel32.dll_GetEnvironmentVariableA
cmp eax, dword [ebp - 4]
jae 0x79607344
mov eax, dword [ebp - 8]
push eax
call fcn.79607430
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.796073c0
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call sub.kernel32.dll_SetLastError
mov esp, ebp
pop ebp
ret

Function at 0x79607f80
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x7960f3a4], 0
jne 0x79607f93
jmp 0x79607fec
push 0x7960f3a8
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x7960f3c0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x79607fe2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call sub.kernel32.dll_TlsGetValue
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x79607fd7
cmp dword [ebp - 8], 0
je 0x79607fd7
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
call edx
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
jmp 0x79607fa5
push 0x7960f3a8
call sub.kernel32.dll_LeaveCriticalSection
mov esp, ebp
pop ebp
ret
Function at 0x4010c4
Capabilities:
Encode data using xor

Disassembly:
add bh, bh
and eax, sym.imp.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
push 0x401f1c
call 0x4010bc
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, ch
xchg ebx, eax
push ds
neg byte [ebx + 0x27]
dec ebp
mov esp, ebp
fcmovbe st(0), st(0)
dec eax
jnp 0x4010ca
out dx, al
invalid
lahf
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push ebx
imul ebp, dword [esi + 0x63], 0x696e6f72
jp 0x40116b
jb 0x40110c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
int3
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
add byte [esi + 0x37], al
jb 0x4010bb
jle 0x40113d
xor al, 0x44
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x1ab034d1
mov ds, edx
add byte [ecx], 0xce
xchg ecx, eax
push ebx
jb 0x40110b
inc esi
cmpsb byte [esi], byte es:[edi]
retf
cdq
iret
add byte [eax], al
daa
or eax, 0xd220000
add byte [eax], al
add byte [ecx], cl
add byte [ebx + 0x71], dl
insb byte es:[edi], dx
push ebx
jb 0x4011f5
jb 0x401182
or eax, 0x4c001501
imul esp, dword [ebx + 0x65], 0x2061e76e
outsd dx, dword fs:[esi]
and byte [ebx + 0x71], dl
insb byte es:[edi], dx
and byte [ebx + 0x65], dl
jb 0x40120f
jb 0x40119c
sbb dword [ecx], eax
add byte [edx], al
and al, byte [ebx]
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0xda20f5f7
fstpnce st(0), st(0)
into
into
xlatb
int3
Function at 0x40de24
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x103d1cb0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103d1cba
pushal
call 0x103d1cc0
pop ebp
sub ebp, 0x10
sub ebp, 0x3d1cb0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103d1ce4
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103d1ced
mov eax, 0x3d1cb0
add eax, ebp
add eax, 0x63
mov ecx, 0x5f8
mov edx, 0xea5128cc
xor byte [eax], dl
inc eax
dec ecx
jne 0x103d1d04
jmp 0x103d1d17
inc edi
add dword [edi + 0x45], eax
invalid
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000983f
pop dword [ebp - 0x10]
mov eax, 0x1000983f
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x34487
push 0
mov eax, 0xe02aed66
add eax, 0x2fd652fe
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x9f5a9280
sub ecx, 0x9f5a5d60
xor ebx, ebx
add ebx, eax
mov edx, 0xffa3ee61
sub edx, 0xefa26861
add edx, dword [ebp - 0x10]
mov edi, 0x51be125a
add edi, 0x35cdd5c0
add dword [ebp - 0xc], ecx
mov esi, dword [edx]
xor dword [ebp - 0xc], ecx
add esi, edi
mov dword [ebx], esi
mov dword [ebp - 4], 0x77224930
add ebx, 4
add edx, 4
loop 0x1000989b
add eax, 0xc753
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x43c529
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0043c480
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x43c558
mov eax, 0xea61
jmp 0x43c5d6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x43c568
mov eax, 0xea62
jmp 0x43c5d6
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0043c480
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x43c595
mov eax, 0xea62
jmp 0x43c5d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x43c5ad
mov eax, 0xea65
jmp 0x43c5d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x43c5c2
mov eax, 0xea66
jmp 0x43c5d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x43c5d2
mov eax, 0xea67
jmp 0x43c5d6
xor eax, eax
jmp 0x43c5d6
pop edi
pop esi
pop ebx
leave
ret