joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409964
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40964a
add byte [ebx], dh
xor eax, 0x4e4e4a3a
inc eax
dec esi
add esp, 4
pop esi
cmp dword [ebp - 0xb78], 0
jne 0x409666
mov dword [ebp - 0x188], 0
jmp 0x40990d
mov edx, dword [ebp - 0xb78]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6cc], ecx
push esi
xor esi, 0x16259
xor esi, 0x108f4
pop esi
push ebx
push eax
add esp, 4
xor ebx, 0x962c
pop ebx
push esi
push esi
add esp, 4
or esi, 0xaab2
add esi, 0xc2d0
add esi, 0xc30
pop esi
cmp dword [ebp - 0x6cc], 0
jne 0x4096c2
mov dword [ebp - 0x188], 0
jmp 0x40990d
mov edx, dword [ebp - 0x6cc]
mov dword [ebp - 0x254], edx
push edi
push ecx
add esp, 4
xor edi, 0x14d6f
pop edi
push edx
jmp 0x4096e0
call 0x4096f0
add byte [eax], bh
cmp eax, dword [ebp + 0x4e]
dec ebx
inc ecx
cmp dh, byte [edi]
cmp eax, 0x8104c483
ret 0xc5af
push edi
push ebx
add esp, 4
and edi, 0xcbc
add edi, 0xd390
pop edi
push eax
call 0x40992f
add byte [edx], dh
push eax
dec ebp
inc edi
dec esi
dec ecx
dec edi
dec eax
push eax
add esp, 4
pop eax
push edx
push esi
add esp, 4
and edx, 0x12d2e
pop edx
mov ecx, dword [ebp - 0x188]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1b8], edx
push ecx
add ecx, 0xcc01
call 0x409964
add byte [eax], al
add byte [0x38384038], dh
inc edx
inc ebx
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
leave
movsb byte es:[edi], byte ss:[esi]
add byte [eax], al
sub ecx, 0x15fda
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x12170
pop edi
mov dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xb84], eax
cmp dword [ebp - 0xb84], 0
jne 0x4099b0
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], ecx
jmp 0x409ca1
mov edx, dword [ebp - 0xb84]
mov eax, dword [ebp - 0x1b8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xb88], eax
jne 0x4099d8
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], ecx
jmp 0x409ca1
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xb88]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xb8c], edx
cmp dword [ebp - 0xb8c], 0
jne 0x409a0a
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], eax
jmp 0x409ca1
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0x3e0], ecx
jne 0x409a2f
mov edx, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], edx
jmp 0x409ca1
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0xe58], ecx
mov edx, dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x1b8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0xe5c], eax
mov ecx, dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x1b8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0xe60], edx
mov dword [ebp - 0x3e4], 0
jmp 0x409a89

Function at 0x409c1d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x409c1d
add byte [edx], dh
inc edi
inc esp
cmp esi, dword [edi - 0x3b7cbdc6]
add al, 0xeb
push es
dec ebx
dec edi
inc ecx
dec edi
dec esp
inc ebp
call 0x409c38
add byte [edi + 0x32], al
Function at 0x409c38
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x3e4]
add eax, 1
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x3e4]
cmp edx, dword [ecx + 0x18]
jae 0x409c95
mov eax, dword [ebp - 0x3e4]
mov ecx, dword [ebp - 0xe58]
mov edx, dword [ebp - 0x1b8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x3e8], edx
mov eax, dword [ebp - 0x3e4]
mov ecx, dword [ebp - 0xe5c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0xe60]
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0xe64], ecx
mov dword [ebp - 0xc8], 0
jmp 0x409af9
mov edx, dword [ebp - 0xc8]
add edx, 1
mov dword [ebp - 0xc8], edx
mov eax, dword [ebp - 0x3e8]
add eax, dword [ebp - 0xc8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x409bab
mov edx, dword [ebp - 0xc8]
movsx eax, byte [ebp + edx - 0x494]
test eax, eax
je 0x409bab
push eax
xor eax, 0x8be2
or eax, 0xf185
and eax, 0xb8e6
sub eax, 0x25ac
pop eax
push ecx
push edi
add esp, 4
and ecx, 0xf8e6
sub ecx, 0x7321
xor ecx, 0x185cf
pop ecx
mov ecx, dword [ebp - 0x3e8]
add ecx, dword [ebp - 0xc8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0xc8]
movsx ecx, byte [ebp + eax - 0x494]
cmp edx, ecx
je 0x409b9d
mov edx, dword [ebp - 0x3e8]
add edx, dword [ebp - 0xc8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0xc8]
movsx edx, byte [ebp + ecx - 0x494]
cmp eax, edx
jne 0x409ba4
jmp 0x409aea
jmp 0x409bab
push esi
push edx
add esp, 4
and esi, 0x287
sub esi, 0x145c9
pop esi
push edi
or edi, 0xfcdb
add edi, 0xcfb9
or edi, 0x3505
pop edi
push edx
push esi
add esp, 4
xor edx, 0x15dc
pop edx
mov eax, dword [ebp - 0x3e8]
add eax, dword [ebp - 0xc8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0xc8]
movsx eax, byte [ebp + edx - 0x494]
cmp ecx, eax
jne 0x409c0a
invalid
invalid
inc ebx
cmp bh, byte [eax]
cmp byte [ecx + 0x33], al
inc edi
add esp, 4
pop esi
mov ecx, dword [ebp - 0x3e8]
add ecx, dword [ebp - 0xc8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0xc8]
movsx ecx, byte [ebp + eax - 0x494]
or ecx, 0x20
cmp edx, ecx
jge 0x409c6f
mov dword [ebp - 0x6d0], 0xffffffff
jmp 0x409c79
mov dword [ebp - 0x6d0], 1
cmp dword [ebp - 0x6d0], 0
jne 0x409c90
mov edx, dword [ebp - 0xe64]
mov dword [ebp - 0x250], edx
jmp 0x409ca1
jmp 0x409a7a
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x418], ecx
Function at 0x409cc2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edx, 0x22ea
xor edx, 0x1571c
and edx, 0x16884
add dword [eax], eax
pop edx
push edx
sub edx, 0x13375
pop edx
mov dword [ebp - 0x418], 0
jmp 0x409cad
push eax
sub eax, 0x6a2
call 0x409cc2
add byte [ebx + 0x43], cl
inc ecx
dec edx
cmp eax, 0x833a4242
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [eax + 0x4f], dl
inc esp
aaa
dec esp
xor al, 0x4c
inc edx
dec edx
dec esi
add esp, 4
xor eax, 0x6b75
pop eax
mov edx, dword [ebp - 0x228]
add edx, 0xe
mov dword [ebp - 0xeb0], edx
push edi
push ecx
add esp, 4
or edi, 0x7ba9
pop edi
push edx
sub edx, 0x133d1
add edx, 0xaac3
call 0x409d16
add byte [edx + 0x37], cl
inc ebp
dec eax
cmp eax, 0x39444235
add esp, 4
add edx, 0xc44f
pop edx
cmp dword [ebp - 0x228], 0
invalid
inc dword [eax]
je 0x409d32
cmp dword [ebp - 0x614], 0
jne 0x409d78
push ecx
add ecx, 0xfb9f
pop ecx
push edi
push edx
add esp, 4
xor edi, 0x72cd
add edi, 0x8a5f
and edi, 0x1236
pop edi
push edx
push esi
add esp, 4
add edx, 0xb7a9
xor edx, 0x2ddf
pop edx
mov eax, dword [ebp - 0x418]
invalid
dec dword [ecx - 0x10677b]
jmp [edx]
call dword [ebp - 0x1068]
mov dword [ebp - 0x1230], 0xa
push edx
add edx, 0x492a
xor edx, 0xf19a
xor edx, 0x6b9a
or edx, 0x40ca
pop edx
push esi
push edi
add esp, 4
xor esi, 0x181ff
invalid
add dword [eax], eax
jmp 0x409dad
and esi, 0x5940
pop esi

Function at 0x409cd5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edx, 0x22ea
xor edx, 0x1571c
and edx, 0x16884
add dword [eax], eax
pop edx
push edx
sub edx, 0x13375
pop edx
mov dword [ebp - 0x418], 0
jmp 0x409cad
push eax
sub eax, 0x6a2
call 0x409cc2
add byte [ebx + 0x43], cl
inc ecx
dec edx
cmp eax, 0x833a4242
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [eax + 0x4f], dl
inc esp
aaa
dec esp
xor al, 0x4c
inc edx
dec edx
dec esi
add esp, 4
xor eax, 0x6b75
pop eax
mov edx, dword [ebp - 0x228]
add edx, 0xe
mov dword [ebp - 0xeb0], edx
push edi
push ecx
add esp, 4
or edi, 0x7ba9
pop edi
push edx
sub edx, 0x133d1
add edx, 0xaac3
call 0x409d16
add byte [edx + 0x37], cl
inc ebp
dec eax
cmp eax, 0x39444235
add esp, 4
add edx, 0xc44f
pop edx
cmp dword [ebp - 0x228], 0
invalid
inc dword [eax]
je 0x409d32
cmp dword [ebp - 0x614], 0
jne 0x409d78
push ecx
add ecx, 0xfb9f
pop ecx
push edi
push edx
add esp, 4
xor edi, 0x72cd
add edi, 0x8a5f
and edi, 0x1236
pop edi
push edx
push esi
add esp, 4
add edx, 0xb7a9
xor edx, 0x2ddf
pop edx
mov eax, dword [ebp - 0x418]
invalid
dec dword [ecx - 0x10677b]
jmp [edx]
call dword [ebp - 0x1068]
mov dword [ebp - 0x1230], 0xa
push edx
add edx, 0x492a
xor edx, 0xf19a
xor edx, 0x6b9a
or edx, 0x40ca
pop edx
push esi
push edi
add esp, 4
xor esi, 0x181ff
invalid
add dword [eax], eax
jmp 0x409dad
and esi, 0x5940
pop esi
Function at 0x409d16
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edx, 0x22ea
xor edx, 0x1571c
and edx, 0x16884
add dword [eax], eax
pop edx
push edx
sub edx, 0x13375
pop edx
mov dword [ebp - 0x418], 0
jmp 0x409cad
push eax
sub eax, 0x6a2
call 0x409cc2
add byte [ebx + 0x43], cl
inc ecx
dec edx
cmp eax, 0x833a4242
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [eax + 0x4f], dl
inc esp
aaa
dec esp
xor al, 0x4c
inc edx
dec edx
dec esi
add esp, 4
xor eax, 0x6b75
pop eax
mov edx, dword [ebp - 0x228]
add edx, 0xe
mov dword [ebp - 0xeb0], edx
push edi
push ecx
add esp, 4
or edi, 0x7ba9
pop edi
push edx
sub edx, 0x133d1
add edx, 0xaac3
call 0x409d16
add byte [edx + 0x37], cl
inc ebp
dec eax
cmp eax, 0x39444235
add esp, 4
add edx, 0xc44f
pop edx
cmp dword [ebp - 0x228], 0
invalid
inc dword [eax]
je 0x409d32
cmp dword [ebp - 0x614], 0
jne 0x409d78
push ecx
add ecx, 0xfb9f
pop ecx
push edi
push edx
add esp, 4
xor edi, 0x72cd
add edi, 0x8a5f
and edi, 0x1236
pop edi
push edx
push esi
add esp, 4
add edx, 0xb7a9
xor edx, 0x2ddf
pop edx
mov eax, dword [ebp - 0x418]
invalid
dec dword [ecx - 0x10677b]
jmp [edx]
call dword [ebp - 0x1068]
mov dword [ebp - 0x1230], 0xa
push edx
add edx, 0x492a
xor edx, 0xf19a
xor edx, 0x6b9a
or edx, 0x40ca
pop edx
push esi
push edi
add esp, 4
xor esi, 0x181ff
invalid
add dword [eax], eax
jmp 0x409dad
and esi, 0x5940
pop esi
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000900e
pop dword [ebp - 0xc]
mov eax, 0xfb115f3a
sub eax, 0xeb10cf2c
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd9ebb71d
add dword [ebp - 0x1c], 0x74668e2e
mov dword [ebp - 0x18], 0x3a863dd3
add dword [ebp - 0x18], 0xf7ad0e72
mov dword [ebp - 0x14], 0xe7df94e1
sub dword [ebp - 0x14], 0x9b9350b3
mov dword [ebp - 0x10], 0xf18bff0f
add dword [ebp - 0x10], 0xe7400f1
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x892b69e0
sub eax, 0x792ac9dc
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x3dcc89d3
add dword [ebp - 0x1c], 0x36a5df83
mov dword [ebp - 0x18], 0x4dd08fd9
add dword [ebp - 0x18], 0xf39bd19c
mov dword [ebp - 0x14], 0x8f19028e
add dword [ebp - 0x14], 0xd45669de
mov dword [ebp - 0x10], 0x119cc9aa
sub dword [ebp - 0x10], 0x119cc9aa
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xb11b88d2
add eax, 0x5ee51736
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3878a
push 0
call eax
mov ecx, 0x4fbe
xor esi, esi
add esi, eax
mov edi, 0x84f1aee2
sub edi, 0x74f0b6e2
add edi, dword [ebp - 0xc]
mov ebx, 0x9cccaf94
sub ebx, 0x18e9d2ed
mov dword [ebp - 8], 0x81b804ec
mov edx, dword [edi]
add dword [ebp - 4], ecx
xor edx, ebx
sub dword [ebp - 8], 0x2bb47f15
mov dword [esi], edx
xor dword [ebp - 4], 0x9086b7c8
add esi, 0xe7ed5cf3
add esi, 0x1812a311
add edi, 0x7345a507
sub edi, 0x7345a503
loop 0x1000912c
add eax, 0x19ddf6d4
sub eax, 0x19dcc509
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x702744
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
mov dword [ebp - 0xc], eax
js 0x90cea3
jmp 0x6b2275
push ebx
push edi
cmc
mov dword [ebp - 0x10], eax
test ebp, 0x39cd6e98
cmc
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x665ee2
jne 0x90dcf9
mov edx, dword [eax + ecx + 0x78]
test cl, 0xf3
stc
mov dword [ebp - 4], edx
test edx, edx
je 0x90dcf9
mov eax, dword [eax + ecx + 0x7c]
jmp 0x5f0a39
ja 0x92f832
mov eax, esi
cmp esi, 0x650531bb
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0x9332fc
push ebp
mov ebp, esp
bsr ecx, ecx
btc ecx, esi
mov ecx, dword [ebp + 8]
cmp esp, 0x735251f7
lea esp, [esp - 0x114]
cmp sp, bp
cmp dh, 0x3d
push esi
test dl, al
test dx, 0x66c3
test ecx, ecx
jmp 0x8a5298
je 0x90dcf9
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x90dce0
ret
je 0x90cea3
mov eax, dword [edx + ecx + 0x20]
cmp si, 0x49c6
lea eax, [eax + ecx]
xor ebx, ebx
jmp 0x5d7c5c
je 0x90dcf9
mov eax, 0x5a4d
test cx, 0x863
cmp word [ecx], ax
je 0x937ab7
xor eax, eax
mov si, 0x4b62
mov si, cx
cmova esi, edi
pop esi
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x8b193b
mov edi, dword [edx + ecx + 0x18]
cmp edi, 0x16f063bd
test edi, edi
jmp 0x8e6ef4
jmp 0x90cea3
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x5f6bed
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4010b3
Capabilities:
Terminate process

Disassembly:
push 0x1010
push 0x401096
push 0x4010a2
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x1000c3a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000c3b2
pop dword [ebp - 0x24]
mov eax, 0xd8f3f7d4
sub eax, 0xc8f33422
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x73da50f0
sub dword [ebp - 0x34], 0x25880ba5
mov dword [ebp - 0x30], 0x714eb94c
add dword [ebp - 0x30], 0xc0e492f9
mov dword [ebp - 0x2c], 0x7dc822a3
sub dword [ebp - 0x2c], 0x317bde75
mov dword [ebp - 0x28], 0xca9b18db
sub dword [ebp - 0x28], 0xca9b18db
lea eax, [ebp - 0x34]
push eax
mov eax, 0x480aeddd
add eax, 0xc7f5227b
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x55a48a45
add dword [ebp - 0x34], 0x1ecddf11
mov dword [ebp - 0x30], 0x15101e89
sub dword [ebp - 0x30], 0xd3a3bd14
mov dword [ebp - 0x2c], 0x4d3cf5e0
add dword [ebp - 0x2c], 0x1632768c
mov dword [ebp - 0x28], 0x5e7ea4d0
add dword [ebp - 0x28], 0xa1815b30
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x2635a3ed
add eax, 0xe9ca6c1b
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x35e78
push 0
call eax
mov ecx, 0x3c22
xor esi, esi
add esi, eax
mov edi, 0x10022200
add edi, dword [ebp - 0x24]
mov ebx, 0xe81791c5
xor dword [ebp - 0x1c], 0x721231cb
mov edx, dword [edi]
add dword [ebp - 0x18], ebx
xor edx, ebx
sub dword [ebp - 0x14], 0x49f9de17
mov dword [esi], edx
add dword [ebp - 0x14], 0x616da293
add esi, 4
add edi, 0x863982b3
add edi, 0x79c67d51
loop 0x1000c4c4
add eax, 0x7e128836
sub eax, 0x7e11a4db
mov ebx, eax
add eax, 0x5a92bae8
sub eax, 0x5a92bae3
mov ecx, 0xa93c66b7
add ecx, 0x66c39949
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1000cdef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100024d0]
jne 0x1000d4b4
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10011e48], eax
mov dword [0x10011e44], ecx
mov dword [0x10011e40], edx
mov dword [0x10011e3c], ebx
mov dword [0x10011e38], esi
mov dword [0x10011e34], edi
mov word [0x10011e60], ss
mov word [0x10011e54], cs
mov word [0x10011e30], ds
mov word [0x10011e2c], es
mov word [0x10011e28], fs
mov word [0x10011e24], gs
pushfd
pop dword [0x10011e58]
mov eax, dword [ebp]
mov dword [0x10011e4c], eax
mov eax, dword [ebp + 4]
mov dword [0x10011e50], eax
lea eax, [ebp + 8]
mov dword [0x10011e5c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10011d98], 0x10001
mov eax, dword [0x10011e50]
mov dword [0x10011d4c], eax
mov dword [0x10011d40], 0xc0000409
mov dword [0x10011d44], 1
mov eax, dword [0x100024d0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10011c40]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10011d90], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100024e0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10011d90], 0
jne 0x1000d5a0
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x37c82a73
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7978572f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401e34
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov byte [ebp - 9], 0
push 0x40
push edi
call fcn.0040155c
test eax, eax
jne 0x401f39
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x401f39
cmp dword [eax + 0x3c], 0
je 0x401f39
mov ebx, dword [eax + 0x3c]
add ebx, eax
push 0xf8
push ebx
call fcn.0040155c
test eax, eax
jne 0x401e8c
cmp dword [ebx], 0x4550
je 0x401e8e
xor ebx, ebx
test ebx, ebx
je 0x401f39
mov eax, dword [ebx + 0x80]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x401f39
mov esi, edi
add esi, eax
mov eax, dword [ebp - 4]
call fcn.00401148
mov dword [ebp - 0x1c], eax
jmp 0x401f33
mov eax, edi
add eax, dword [esi + 0xc]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004017e0
test eax, eax
jne 0x401f30
mov ebx, edi
add ebx, dword [esi + 0x10]
jmp 0x401f2b
mov eax, dword [ebx]
cmp eax, dword [ebp - 8]
jne 0x401f28
lea eax, [ebp - 0x20]
push eax
push 0x80
push 4
push ebx
call fcn.0040159c
test eax, eax
je 0x401f28
mov eax, dword [ebp + 8]
mov dword [ebx], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
push eax
push 4
push ebx
call fcn.0040159c
test eax, eax
push 0
push 0
call fcn.00401478
push eax
call fcn.00401458
mov byte [ebp - 9], 1
add ebx, 4
cmp dword [ebx], 0
jne 0x401ee2
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x401ec4
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40886c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], cl
mov ebx, eax
mov eax, edx
mov edx, ebx
mov ecx, 0x10
call 0x400774
cmp byte [ebp - 1], 0
je 0x4088b3
mov eax, 0x10
mov edx, dword [ebx + eax*4 - 0xc]
xor edx, dword [ebx + eax*4 - 0x20]
xor edx, dword [ebx + eax*4 - 0x38]
xor edx, dword [ebx + eax*4 - 0x40]
mov ecx, edx
add ecx, ecx
shr edx, 0x1f
or ecx, edx
mov dword [ebx + eax*4], ecx
inc eax
cmp eax, 0x50
jne 0x40888f
jmp 0x4088d1
mov eax, 0x10
mov edx, dword [ebx + eax*4 - 0xc]
xor edx, dword [ebx + eax*4 - 0x20]
xor edx, dword [ebx + eax*4 - 0x38]
xor edx, dword [ebx + eax*4 - 0x40]
mov dword [ebx + eax*4], edx
inc eax
cmp eax, 0x50
jne 0x4088b8
pop ebx
pop ecx
pop ebp
ret