joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d328
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a35c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00405145
mov dword [ebp - 0x14], eax
cmp dword [0x4bb918], esi
jne 0x40d41b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d4fb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d4fb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d4fb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4bb918], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4bb91c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4bb920], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4bb928], eax
test eax, eax
je 0x40d418
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4bb924], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d440
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d433
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d455
push 4
pop eax
jmp 0x40d4fd
cmp dword [ebp - 0x14], esi
je 0x40d455
push dword [0x4bb918]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d43a
mov eax, dword [0x4bb924]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4b3
cmp dword [0x4bb928], edi
je 0x40d4b3
push eax
call ebx
push dword [0x4bb928]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4b3
test eax, eax
je 0x40d4b3
call ecx
test eax, eax
je 0x40d4a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4a8
test byte [ebp - 8], 1
jne 0x40d4b3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4e3
mov eax, dword [0x4bb91c]
cmp eax, edi
je 0x40d4e0
push eax
call ebx
test eax, eax
je 0x40d4e0
call eax
mov esi, eax
test esi, esi
je 0x40d4e0
mov eax, dword [0x4bb920]
cmp eax, edi
je 0x40d4e0
push eax
call ebx
test eax, eax
je 0x40d4e0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4bb918]
call ebx
test eax, eax
je 0x40d4fb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d4fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404457
mov esp, ebp
pop ebp
ret
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4047bb
Capabilities:
Create thread
Inject thread

Disassembly:
push dword [0x42a87c]
pop dword [0x42a8f4]
mov edx, dword [0x42a860]
push dword [0x42aff4]
call fcn.00413130
lea ecx, [0x42a858]
pop edx
call fcn.0040602c
push dword [0x42a858]
call fcn.00406110
mov ebx, eax
inc ebx
mov dword [0x42a91c], ebx
push dword [0x42a8f4]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x42a8f0], eax
cmp dword [0x42a8f0], 0
je 0x404957
push 4
push 0x1000
push dword [0x42a91c]
push 0
push dword [0x42a8f0]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [0x42a908], eax
cmp dword [0x42a908], 0
je 0x40494c
push 0x42a824
push dword [0x42a91c]
push dword [0x42a858]
push dword [0x42a908]
push dword [0x42a8f0]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, dword [0x42a824]
cmp ebx, dword [0x42a91c]
jl 0x404930
push str.Kernel32.dll
push 0
call fcn.00407830
and eax, eax
je 0x404930
push 0x414275
push 0
call fcn.00407880
mov dword [0x42a8d0], eax
push 0
call fcn.004077b0
cmp dword [0x42a8d0], 0
je 0x404930
push 0
push 0
push dword [0x42a908]
push dword [0x42a8d0]
push 0
push 0
push dword [0x42a8f0]
call sub.KERNEL32.dll_CreateRemoteThread
mov dword [0x42a878], eax
cmp dword [0x42a878], 0
je 0x404930
push 0xffffffff
push dword [0x42a878]
call sub.KERNEL32.dll_WaitForSingleObject
push 0x42a914
push dword [0x42a878]
call sub.KERNEL32.dll_GetExitCodeThread
push str.Successful_Injection.
push 0
push 0
call fcn.00406683
push 0x4000
push dword [0x42a91c]
push dword [0x42a908]
push dword [0x42a8f0]
call sub.KERNEL32.dll_VirtualFreeEx
push dword [0x42a8f0]
call sub.KERNEL32.dll_CloseHandle
push dword [0x42a860]
call fcn.004127e0
mov dword [0x42a914], eax
ret

Function at 0x40708e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp dword [ebp + 8], 0
je 0x4070a8
push dword [ebp + 8]
push 0x407020
call sub.USER32.dll_EnumWindows
jmp 0x4070df
mov edi, dword [0x427ea0]
jmp 0x4070db
mov esi, dword [edi]
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi + 8], eax
jne 0x4070d9
push 1
push dword [edi + 0xc]
call sub.USER32.dll_EnableWindow
mov eax, edi
add eax, 8
push eax
push 0x427ea0
call fcn.00413090
add esp, 8
mov edi, esi
or edi, edi
jne 0x4070b0
pop edi
pop esi
pop ebp
ret 4
Function at 0x4089e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xca
jne 0x408a16
push edi
call fcn.00408414
pop ecx
cmp byte [edi + 0x40], 0
je 0x408a0f
mov dword [edi + 0x14], 0xcf
xor eax, eax
inc eax
jmp 0x408acb
mov dword [edi + 0x14], 0xcb
cmp dword [edi + 0x14], 0xcb
jne 0x408a9a
mov eax, dword [edi + 0x190]
cmp byte [eax + 0x10], 0
je 0x408a8f
cmp dword [edi + 8], 0
je 0x408a3d
push edi
mov ebx, dword [edi + 8]
call dword [ebx]
pop ecx
push edi
mov esi, dword [edi + 0x190]
call dword [esi]
pop ecx
mov dword [ebp - 4], eax
or eax, eax
je 0x408acb
cmp dword [ebp - 4], 2
je 0x408a8f
cmp dword [edi + 8], 0
je 0x408a2b
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x408a6c
cmp eax, 1
jne 0x408a2b
mov eax, dword [edi + 8]
add eax, 4
mov edx, dword [eax]
inc edx
mov dword [eax], edx
mov eax, dword [edi + 8]
cmp edx, dword [eax + 8]
jl 0x408a2b
mov eax, dword [edi + 8]
add eax, 8
mov edx, dword [edi + 0x11c]
add dword [eax], edx
jmp 0x408a2b
mov eax, dword [edi + 0x7c]
mov dword [edi + 0x84], eax
jmp 0x408abf
cmp dword [edi + 0x14], 0xcc
je 0x408abf
mov eax, dword [edi]
mov dword [eax + 0x14], 0x14
mov eax, dword [edi]
mov edx, dword [edi + 0x14]
mov dword [eax + 0x18], edx
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
push edi
call fcn.00408ad0
pop ecx
and eax, 0xff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408ad0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xcc
je 0x408b12
push edi
mov ebx, dword [edi + 0x180]
call dword [ebx]
pop ecx
and dword [edi + 0x78], 0
mov dword [edi + 0x14], 0xcc
jmp 0x408b12
mov eax, dword [edi]
mov dword [eax + 0x14], 0x30
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
mov eax, dword [edi + 0x180]
cmp byte [eax + 8], 0
jne 0x408afe
xor eax, eax
cmp byte [edi + 0x41], 0
sete al
dec eax
and eax, 1
add eax, 0xcd
mov dword [edi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40d5fa
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
and dword [ebx + 4], 0
mov edi, 0x3b9aca00
cmp edi, 0x3b9aca00
je 0x40d62b
mov eax, dword [ebx]
mov dword [eax + 0x14], 3
push ebx
mov eax, dword [ebx]
call dword [eax]
pop ecx
push ebx
call fcn.0041007d
mov dword [ebp - 4], eax
push 0x54
push ebx
call fcn.00410020
add esp, 0xc
mov esi, eax
or esi, esi
jne 0x40d667
push ebx
call fcn.00410080
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x36
mov eax, dword [ebx]
and dword [eax + 0x18], 0
push ebx
mov eax, dword [ebx]
call dword [eax]
add esp, 8
lea eax, [fcn.0040c9d8]
mov dword [esi], eax
lea eax, [fcn.0040cb17]
mov dword [esi + 4], eax
lea eax, [fcn.0040cbc6]
mov dword [esi + 8], eax
lea eax, [fcn.0040cc9a]
mov dword [esi + 0xc], eax
lea eax, [0x40cd7b]
mov dword [esi + 0x10], eax
lea eax, [0x40cde8]
mov dword [esi + 0x14], eax
lea eax, [0x40ce55]
mov dword [esi + 0x18], eax
lea eax, [0x40d1f3]
mov dword [esi + 0x1c], eax
lea eax, [0x40d343]
mov dword [esi + 0x20], eax
lea eax, [fcn.0040d49a]
mov dword [esi + 0x24], eax
lea eax, [0x40d5c6]
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [ebp - 4]
mov dword [esi + 0x2c], eax
xor edi, edi
inc edi
and dword [esi + edi*4 + 0x34], 0
and dword [esi + edi*4 + 0x3c], 0
dec edi
jge 0x40d6d9
and dword [esi + 0x44], 0
and dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
mov dword [ebx + 4], esi
push str.JPEGMEM
call sub.MSVCRT.dll_getenv
pop ecx
mov dword [ebp - 8], eax
or eax, eax
je 0x40d749
mov byte [ebp - 9], 0x78
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 4]
push eax
push str._ld_c
push dword [ebp - 8]
call sub.MSVCRT.dll_sscanf
add esp, 0x10
or eax, eax
jle 0x40d749
mov al, byte [ebp - 9]
cmp al, 0x6d
je 0x40d735
cmp al, 0x4d
jne 0x40d73f
imul eax, dword [ebp - 4], 0x3e8
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41268a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 9
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
je 0x412723
push 0x11
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x412723
push 0x10
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x412723
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x412723
call sub.USER32.dll_GetFocus
push 5
lea edi, [ebp - 0xd]
push edi
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x412723
call sub.USER32.dll_GetFocus
push 0
push 0
push 0x44e
push eax
call sub.USER32.dll_SendMessageA
test ax, 0x800
jne 0x412723
xor eax, eax
jmp 0x41274e
push str.PB_WindowID
push dword [ebp + 8]
call sub.USER32.dll_GetPropA
mov dword [ebp - 4], eax
or eax, eax
je 0x41274c
dec eax
push eax
push dword [0x42b1f0]
call fcn.00412e62
mov dword [ebp - 8], eax
mov eax, dword [eax + 0xc]
jmp 0x41274e
xor eax, eax
pop edi
leave
ret 4

Function at 0x4127f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0
jne 0x41281f
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
push eax
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x412ae0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, 0x1000
push dword [ebp + 0xc]
push 0x1000
call fcn.00413310
mov esi, eax
mov edi, esi
push dword [ebp + 8]
push dword [0x42b200]
call fcn.00412e62
mov dword [ebp - 8], eax
or eax, eax
je 0x412bff
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x412b38
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
call fcn.00412cf0
mov dword [ebp - 0xc], eax
jmp 0x412b4e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_ReadFile
cmp byte [ebp - 1], 0
je 0x412b5a
mov al, byte [ebp - 1]
mov byte [edi], al
inc edi
mov eax, edi
sub eax, esi
cmp eax, ebx
jl 0x412b81
add ebx, 0x1000
mov eax, edi
sub eax, esi
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
push ebx
call fcn.00413310
mov esi, eax
mov eax, dword [ebp - 0x10]
mov edi, eax
add edi, esi
movsx eax, byte [ebp - 1]
or eax, eax
je 0x412b9d
cmp dword [ebp - 0xc], 0
je 0x412b9d
cmp eax, 0xd
je 0x412b9d
cmp eax, 0xa
jne 0x412b18
cmp byte [ebp - 1], 0
je 0x412bff
dec edi
cmp byte [ebp - 1], 0xd
jne 0x412bff
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x412bc3
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
call fcn.00412cf0
jmp 0x412bd9
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_ReadFile
cmp byte [ebp - 1], 0xa
je 0x412bff
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x412bef
add eax, 0xc
inc dword [eax]
jmp 0x412bff
push 1
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_SetFilePointer
mov byte [edi], 0
mov eax, edi
sub eax, esi
mov edx, ebx
sub edx, eax
push edx
call fcn.004133f0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x412c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 1
jne 0x412c43
and dword [edi + 0x14], 0
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
cmp dword [edi + 0xc], esi
jle 0x412ca4
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, esi
cmp eax, 1
je 0x412c67
cmp eax, 2
je 0x412c73
cmp eax, 4
je 0x412c81
jmp 0x412c8d
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dl, byte [edx]
mov byte [eax], dl
jmp 0x412c9c
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dx, word [edx]
mov word [eax], dx
jmp 0x412c9c
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov dword [eax], edx
jmp 0x412c9c
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
jmp 0x412cde
push edi
call fcn.004127f0
cmp esi, dword [edi + 8]
jl 0x412cc2
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
jmp 0x412cde
push esi
push dword [ebp + 0xc]
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x412cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp dword [edi + 0x14], 0
jne 0x412d15
push edi
call fcn.004127f0
mov dword [edi + 0x14], 1
and dword [edi + 0xc], 0
cmp dword [edi + 0xc], esi
jl 0x412d6a
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ebx, eax
add ebx, dword [edi + 4]
mov eax, esi
cmp eax, 1
je 0x412d38
cmp eax, 2
je 0x412d41
cmp eax, 4
je 0x412d4c
jmp 0x412d55
mov eax, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [eax], dl
jmp 0x412d62
mov eax, dword [ebp + 0xc]
mov dx, word [ebx]
mov word [eax], dx
jmp 0x412d62
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx]
mov dword [eax], edx
jmp 0x412d62
push esi
push ebx
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
jmp 0x412de9
mov ebx, dword [edi + 0xc]
push ebx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, ebx
add eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
sub esi, ebx
cmp esi, dword [edi + 8]
jl 0x412da9
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.dll_ReadFile
and dword [edi + 0xc], 0
jmp 0x412de9
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], eax
cmp esi, dword [edi + 0xc]
jle 0x412dd0
mov esi, dword [edi + 0xc]
push esi
push dword [edi + 4]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov eax, ebx
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x100b97a2
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
jb 0x100ba55b
pushal
push dword [esp]
mov byte [esp], dh
pushal
push dword [esp + 0x44]
ret 0x48
Function at 0x41019d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
add edx, 1
mov dword [ebp - 0x778], edx
mov eax, dword [ebp - 0x774]
mov ecx, dword [ebp - 0x778]
cmp ecx, dword [eax + 0x18]
jae 0x410276
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19b8]
mov ecx, dword [ebp - 0x398]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x77c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19bc]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x19c0]
mov eax, dword [ebp - 0x398]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19c4], eax
mov dword [ebp - 0x120], 0
jmp 0x4100da
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
test eax, eax
je 0x41018c
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
test edx, edx
je 0x41018c
push ecx
push ebx
add esp, 4
or ecx, 0x5bf0
xor ecx, 0x9551
or ecx, 0x7b8f
pop ecx
push eax
add eax, 0xd230
or eax, 0x40fb
pop eax
push edi
push edx
add esp, 4
or edi, 0x15b8e
pop edi
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
cmp ecx, eax
je 0x41017e
mov ecx, dword [ebp - 0x77c]
add ecx, dword [ebp - 0x120]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x120]
movsx ecx, byte [ebp + eax - 0x890]
cmp edx, ecx
jne 0x410185
jmp 0x4100cb
jmp 0x41018c
push ecx
push eax
add esp, 4
call fcn.0041019d
add byte [ecx], bh
cmp edi, dword [esi + edi]
inc ebx
cmp eax, dword [ebx + 0x7e804c4]
add esp, 4
call 0x4101ac
add byte [esi], bh
dec esp
add esp, 4
call 0x4101ac
add byte [esi], bh
dec esp
dec esi
dec esi
inc ebp
add esp, 4
pop ecx
push eax
or eax, 0x3714
xor eax, 0xa675
pop eax
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
cmp eax, edx
jne 0x4101eb
mov dword [ebp - 0xcd4], 0
jmp 0x41025a
push edx
push eax
add esp, 4
xor edx, 0x6fdf
jmp 0x4101fb
pop edx
push eax
xor eax, 0xd245
and eax, 0xcfd2
call 0x410219
add byte [eax + 0x3c], dl
dec edi
inc edx
xor eax, 0x4c333e47
dec edx
add esp, 4
pop eax
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
or eax, 0x20
cmp ecx, eax
jge 0x410250
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x41025a
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x410271
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x44c], ecx
jmp 0x410282
jmp 0x41005b
mov edx, dword [ebp - 0x780]
mov dword [ebp - 0x44c], edx
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x7ac], eax
Function at 0x4101ac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
add edx, 1
mov dword [ebp - 0x778], edx
mov eax, dword [ebp - 0x774]
mov ecx, dword [ebp - 0x778]
cmp ecx, dword [eax + 0x18]
jae 0x410276
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19b8]
mov ecx, dword [ebp - 0x398]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x77c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19bc]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x19c0]
mov eax, dword [ebp - 0x398]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19c4], eax
mov dword [ebp - 0x120], 0
jmp 0x4100da
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
test eax, eax
je 0x41018c
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
test edx, edx
je 0x41018c
push ecx
push ebx
add esp, 4
or ecx, 0x5bf0
xor ecx, 0x9551
or ecx, 0x7b8f
pop ecx
push eax
add eax, 0xd230
or eax, 0x40fb
pop eax
push edi
push edx
add esp, 4
or edi, 0x15b8e
pop edi
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
cmp ecx, eax
je 0x41017e
mov ecx, dword [ebp - 0x77c]
add ecx, dword [ebp - 0x120]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x120]
movsx ecx, byte [ebp + eax - 0x890]
cmp edx, ecx
jne 0x410185
jmp 0x4100cb
jmp 0x41018c
push ecx
push eax
add esp, 4
call fcn.0041019d
add byte [ecx], bh
cmp edi, dword [esi + edi]
inc ebx
cmp eax, dword [ebx + 0x7e804c4]
add esp, 4
call 0x4101ac
add byte [esi], bh
dec esp
add esp, 4
call 0x4101ac
add byte [esi], bh
dec esp
dec esi
dec esi
inc ebp
add esp, 4
pop ecx
push eax
or eax, 0x3714
xor eax, 0xa675
pop eax
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
cmp eax, edx
jne 0x4101eb
mov dword [ebp - 0xcd4], 0
jmp 0x41025a
push edx
push eax
add esp, 4
xor edx, 0x6fdf
jmp 0x4101fb
pop edx
push eax
xor eax, 0xd245
and eax, 0xcfd2
call 0x410219
add byte [eax + 0x3c], dl
dec edi
inc edx
xor eax, 0x4c333e47
dec edx
add esp, 4
pop eax
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
or eax, 0x20
cmp ecx, eax
jge 0x410250
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x41025a
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x410271
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x44c], ecx
jmp 0x410282
jmp 0x41005b
mov edx, dword [ebp - 0x780]
mov dword [ebp - 0x44c], edx
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x7ac], eax