joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41d020
mov edi, dword [esp + 0x28]
test edi, edi
je 0x41d0c1
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x41d0f0
cmp eax, 3
jne 0x41d00a
mov eax, dword [0x4a2090]
cmp eax, 0xffffffff
je 0x41d00a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41d00a
test byte [eax + 0x20], 0x30
je 0x41d112
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x41d214
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41d094
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41d086
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x41d199
mov eax, ebx
call sym._push_pthread_mem.part.2
jmp 0x41d199
mov eax, dword [0x4e8e00]
test eax, eax
je 0x41d00a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x4e8e00], 0
sub esp, 4
jmp 0x41d00a
mov dword [esp + 4], sym._SetThreadName_VEH_4
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x4e8e00], eax
jmp 0x41d00a
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41d1c0
test eax, eax
je 0x41d130
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x41d1f0
test byte [ebx + 0x24], 4
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
je 0x41d200
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41d175
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
call sym._replace_spin_keys.constprop.10
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x41d0b5
mov eax, dword [0x4a2090]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41d00a
test eax, eax
je 0x41d1d0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call sym._pthread_mutex_destroy
lea eax, [ebx + 0x38]
call sym._replace_spin_keys.constprop.10
jmp 0x41d00a
call sym.__pthread_cleanup_dest.part.8
jmp 0x41d14c
mov dword [esp], edi
call sym._pthread_mutex_destroy
mov eax, esi
call sym._replace_spin_keys.constprop.10
jmp 0x41d00a
call sym.__pthread_cleanup_dest.part.8
jmp 0x41d062
Function at 0x41d22a
Capabilities:
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [ecx]
mov dword [esp], 0x4a2088
mov esi, eax
mov dword [ebp - 0x1c], eax
lea ebx, [esi + 0x1c]
call sym._pthread_mutex_lock
mov dword [esp], ebx
call sym._pthread_mutex_lock
cmp dword [0x4e8e24], 1
je 0x41d260
call sym.__pthread_once_raw.part.5.constprop.11
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x4a2090]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp], ebx
call sym._pthread_mutex_unlock
lea eax, [esi + 0x70]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.__setjmp3
test eax, eax
je 0x41d333
mov dword [esp], 0x4a2088
call sym._pthread_mutex_lock
mov esi, dword [ebp - 0x1c]
lea ebx, [esi + 0x1c]
mov dword [esp], ebx
call sym._pthread_mutex_lock
mov eax, esi
mov esi, dword [esi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41d2d3
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
je 0x41d37d
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x68], 1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d31a
mov dword [esp], 0
call ebx
push eax
mov dword [esp], 0x4a2088
call sym._pthread_mutex_unlock
test eax, eax
je 0x41d310
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov dword [esp], 0x4a2088
call sym._pthread_mutex_unlock
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
test eax, eax
je 0x41d3c8
mov edx, dword [edx + 4]
mov dword [esp], edx
call eax
mov ebx, eax
mov dword [esp], 0x4a2088
call sym._pthread_mutex_lock
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], ebx
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41d2af
call sym.__pthread_cleanup_dest.part.8
jmp 0x41d2af
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0xdeadbeef
mov dword [esp], ebx
call sym._pthread_mutex_unlock
mov dword [esp], ebx
call sym._pthread_mutex_destroy
test edi, edi
je 0x41d3ab
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xb0], 0
jne 0x41d3ab
call sym._push_pthread_mem.part.2
mov eax, dword [0x4a2090]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41d308
mov ebx, pe_nt_image_headers32
jmp 0x41d353
Function at 0x49c5b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
Function at 0x468b3c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689b3

Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x101c5f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.101c73cd
xor ecx, ecx
mov edx, eax
mov esi, dword [0x101ef98c]
mov edi, esi
add edi, 0xffffe7e0
mov dword [0x101ef988], edi
mov edi, dword [eax + 0x3c]
mov dword [0x101ef98c], 0x1178
add esi, 0xffffdddf
mov dword [0x101ef988], esi
mov dword [0x101ef98c], 0x83d
mov esi, dword [eax + edi + 0x78]
mov dword [0x101ef988], 0x2076
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x101c607c
jmp 0x101c5f9f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
jmp 0x101c5fbe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [eax + ecx + 0x24]
mov dword [ebp - 0x40], edx
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
add ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jmp 0x101c5f83
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x101c600f
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x101c5fbe
mov al, byte [ebp - 0x46]
test al, 1
jne 0x101c6047
jmp 0x101c6018
mov eax, dword [ebp - 0x34]
add eax, 2
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], eax
jb 0x101c5f83
jmp 0x101c607c
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov dword [0x101ef988], 0x2157
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [ebp - 0x50], ecx
mov dword [0x101ef98c], 0xd6c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x50]
add eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101c6087
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x30
mov dword [ebp - 8], 0
mov dword [0x101ef988], 0x1b77
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [0x101ef98c], 0x68b
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x101ef988], 0x1049
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x101c60fd
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jl 0x101c60d0
mov eax, dword [ebp - 0x1c]
mov dword [0x101ef988], 0x162a
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x101c61e6
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2], 0x6f
jne 0x101c61e6
mov dword [0x101ef98c], 0xcc3
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff5
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x61
jne 0x101c61e6
mov dword [0x101ef988], 0x15d5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
sete dl
mov byte [ebp - 0x29], dl
mov al, byte [ebp - 0x29]
test al, 1
jne 0x101c618b
jmp 0x101c61e6
mov dword [0x101ef988], 0x3b73
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x101c61e6
mov dword [0x101ef988], 0x1718
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x101c61e6
mov eax, 0x2d23
mov ecx, 1
mov dword [0x101ef98c], 0xfd3
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
je 0x101c61f5
mov eax, 0x24e8
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
jmp 0x101c61f5
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [0x101ef988], ecx
add esp, 0x30
pop esi
pop ebp
ret
Function at 0x101c67b3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x101ef994], 0
mov byte [0x101ef998], 0
mov dword [0x101ef988], 0x1769
mov dword [0x101ef990], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov ecx, 0x1769
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x101c6802
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0xffffe280
mov dword [0x101ef988], eax
mov eax, ecx
mov dl, al
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [0x101ef988]
mov esi, ecx
add esi, 0xfffff237
mov dword [0x101ef98c], esi
mov esi, dword [0x101ef990]
add esi, 1
mov dword [0x101ef990], esi
cmp esi, 0x100
mov edi, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jl 0x101c6802
mov eax, dword [ebp - 0x24]
add eax, 0xffffe7c2
mov dword [ebp - 0x28], eax
xor eax, eax
mov ecx, dword [ebp - 0x28]
mov dword [0x101ef988], ecx
mov dword [0x101ef990], 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, 0x100
mov dword [ebp - 0x30], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101ef99c], 0
mov dword [0x101ef98c], 0x2161
mov edi, dword [0x101ef994]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101ef99c], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x101ef994], edx
mov dword [0x101ef988], 0x2438
mov ecx, dword [ebp - 0x30]
mov cl, byte [ebx + ecx]
mov byte [0x101ef998], cl
mov dword [0x101ef988], 0x1cf5
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov cl, byte [0x101ef998]
mov esi, dword [0x101ef994]
mov byte [ebx + esi], cl
mov dword [0x101ef988], 0x1799
mov esi, dword [0x101ef990]
add esi, 1
mov dword [0x101ef990], esi
cmp esi, 0x100
mov dword [ebp - 0x2c], esi
jl 0x101c6878
mov dword [0x101ef988], 0x27cb
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101c70c3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101ef988], 0x13
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x101c968a]
mov dl, byte [eax + 0x101c965b]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x101c70e4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov dword [0x101ef98c], 0x1499
mov dword [0x101ef988], 0x11f8
call fcn.101c66e9
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.101c6207
xor ecx, ecx
mov dword [0x101ef988], 0x23c5
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x101c7213
mov eax, dword [ebp - 0x34]
mov dword [0x101ef98c], 0x185a
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101ef988]
add ecx, 0xfffff955
mov dword [0x101ef988], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.101c6f7d
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x54], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 8], ecx
mov dword [0x101ef988], 0xfffff3db
mov dword [0x101ef98c], 0x9c
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x101c7213
mov eax, dword [ebp - 0x3c]
add eax, 0x1d96
mov dword [0x101ef98c], 0x1744
mov dword [0x101ef988], 0x1b4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
Function at 0x101c7567
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x101ef98c]
mov dword [0x101ef990], 0
mov dword [0x101ef994], 0
mov dword [0x101ef9a0], 0
mov dword [0x101ef988], 0xa9f
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
je 0x101c7702
jmp 0x101c75fa
mov eax, dword [0x101ef990]
mov ecx, dword [0x101ef994]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], edx
jmp 0x101c75fa
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
mov dword [0x101ef988], 0x1b0a
add ecx, 1
mov dword [ebp - 0x3c], eax
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
idiv esi
mov dword [0x101ef990], edx
mov ecx, dword [ebp - 0x24]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x40]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x44], edx
cdq
idiv esi
mov dword [0x101ef994], edx
mov esi, dword [ebp - 0x44]
mov cl, byte [ecx + esi]
mov byte [0x101ef998], cl
mov dword [0x101ef988], 0x1ba7
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x101ef998]
mov edx, dword [0x101ef994]
mov byte [edi + edx], cl
mov dword [0x101ef988], 0x25da
mov edx, dword [0x101ef990]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101ef994]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101ef9a0], ebx
mov dword [0x101ef988], 0x4df
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x3c]
mov ch, byte [edx + ebx]
mov byte [0x101ef9a5], ch
mov byte [0x101ef9a6], cl
xor ch, cl
mov byte [0x101ef9a4], ch
mov dword [0x101ef98c], 0xd0
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], ch
mov edx, dword [0x101ef98c]
mov esi, edx
add esi, 0xffffe557
mov dword [0x101ef988], esi
add ebx, 1
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], edx
jne 0x101c75d5
mov eax, dword [ebp - 0x2c]
add eax, 0xffffe56e
mov dword [0x101ef988], eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101c7717
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, dword [0x101ef98c]
add eax, 0x1601
mov dword [0x101ef98c], eax
call fcn.10001092
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x34], ecx
je 0x101c7797
jmp 0x101c78cf
mov eax, dword [esp + 0x30]
mov dword [esp + 0x84], eax
mov dword [0x101ef98c], 0x83d
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0xa0], edx
mov dword [0x101ef988], 0x5f1
call fcn.101c6087
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x28], ecx
je 0x101c7881
jmp 0x101c78c7
lea eax, [esp + 0x38]
lea ecx, [esp + 0x48]
mov edx, ecx
add edx, 0x48
mov dword [0x101ef988], 0x3bb
mov dword [esp], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
call fcn.101c6cb3
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
lea eax, [0x101c65f9]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov dword [esp + 0x7c], 0x12f800
mov esi, dword [0x101ef974]
mov dword [esp + 0xa4], esi
mov esi, dword [0x101ef978]
mov dword [esp + 0x58], esi
mov esi, dword [0x101ef97c]
mov dword [esp + 0x80], esi
mov esi, dword [0x101ef980]
mov dword [esp + 0x70], esi
mov esi, dword [0x101ef984]
mov dword [esp + 0x60], esi
mov dword [0x101ef98c], 0xc9d
mov dword [0x101ef988], 0xc7
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x30], eax
jne 0x101c7865
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp dword [eax], 0x4550
je 0x101c774a
mov eax, dword [esp + 0x30]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
jmp 0x101c7835
lea eax, [esp + 0x48]
mov dword [0x101ef98c], 0x17ac
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101c70c3
mov ecx, esp
lea edx, [esp + 0x48]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x101ef988]
add ecx, 0x122d
mov dword [0x101ef988], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x404c98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sar eax, 2
push edi
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x404d18
push esi
xor esi, esi
cmp dword [ebp + 0x18], esi
jbe 0x404d17
push ebx
mov ebx, 0x45b5a8
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebx
mov byte [edi + esi], al
call fcn.004013cb
push eax
call fcn.00401eb7
mov al, byte [edi + esi]
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebx
mov byte [edi + esi], al
call fcn.004013cb
push eax
call fcn.00401eb7
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x425548
mov byte [edi + esi], al
call fcn.0040dc9e
xor byte [edi + esi], al
add esp, 0x1c
inc esi
cmp esi, dword [ebp + 0x18]
jb 0x404cba
pop ebx
pop esi
lea ecx, [ebp + 8]
call fcn.00404815
pop edi
pop ebp
ret 0x14

Function at 0x407cba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x407cdb
jl 0x407cd2
test edi, edi
jne 0x407cdb
xor eax, eax
xor edx, edx
jmp 0x407d9c
cmp dword [ebx + 0x38], 0
je 0x407cf0
push eax
push edi
push dword [ebp + 8]
call fcn.00407da2
jmp 0x407d9c
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x407d37
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x407d37
cmp eax, edi
jb 0x407d11
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409520
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x407d3d
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x407d91
mov ecx, ebx
call fcn.00407554
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x407d7c
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00410ee3
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x407d91
jmp 0x407d4f
test edx, edx
je 0x407d91
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00410ee3
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40907c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4090bb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4090bb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4090bb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4090bb
cmp dword [ecx + 0x74], 0xe
jbe 0x4090bb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret