joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d3110
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011460b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x1014e404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
call fcn.100e7790
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100d3251
cmp eax, 0x104
ja 0x100d3251
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100e7790
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0x1012b9d0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x100d3202
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d31e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.100480f0
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x438]
mov dword [esi + 0x14], 0
xor eax, eax
movups xmmword [esi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
call fcn.10037220
jmp 0x100d3276
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0038
mov esp, ebp
pop ebp
ret
Function at 0x100d40d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10114728
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1014e404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp byte [esi + 0x20], 0
jne 0x100d4117
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 1
jbe 0x100d4153
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x100d4820
push 0
push 0
call fcn.100ea2b4
xor ecx, ecx
mov dword [esi + 0x10], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x44]
call sub.gdiplus.dll_GdipCreateFromHDC
mov edi, dword [ebp - 0x10]
mov esi, eax
mov dword [ebp - 0x1c], edi
push 0xffffffffffffffff
push edi
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipGraphicsClear
test eax, eax
cmovne esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x2c]
push dword [eax + 0x28]
push 0
push 0
push dword [eax + 4]
push edi
call sub.gdiplus.dll_GdipDrawImageRectI
test eax, eax
push ebx
cmovne esi, eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
call fcn.1007ba10
mov ecx, esi
call fcn.100d44e0
push edi
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d8510
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10114928
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1014e404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
test esi, esi
je 0x100d85b9
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100d85b9
cmp dword [ebp + 0x1c], 0
je 0x100d85b9
cmp dword [ebp + 0x34], 0
je 0x100d85b9
cmp dword [ebp + 0x4c], 0
je 0x100d85b9
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100d85b0
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmovae ecx, dword [ebp + 0xc]
push ecx
push esi
call ebx
test eax, eax
je 0x100d858c
call eax
mov dword [edi], eax
cmp dword [ebp + 0x38], 0x10
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push eax
push esi
call ebx
cmp dword [ebp + 0x50], 0x10
mov dword [edi + 4], eax
lea eax, [ebp + 0x3c]
cmovae eax, dword [ebp + 0x3c]
push eax
push esi
call ebx
mov dword [edi + 8], eax
xor ebx, ebx
cmp dword [edi], ebx
setne bl
jmp 0x100d85bb
xor ebx, ebx
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x100d85ef
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100d85e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d8689
push edx
push ecx
call fcn.100dfb49
add esp, 8
mov edx, dword [ebp + 0x38]
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov byte [ebp + 0xc], 0
cmp edx, 0x10
jb 0x100d8631
mov ecx, dword [ebp + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100d8627
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d868e
push edx
push ecx
call fcn.100dfb49
add esp, 8
mov edx, dword [ebp + 0x50]
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0xf
mov byte [ebp + 0x24], 0
cmp edx, 0x10
jb 0x100d8673
mov ecx, dword [ebp + 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100d8669
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d8693
push edx
push ecx
call fcn.100dfb49
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x4c
call fcn.100e9be9
call fcn.100e9be9
call fcn.100e9be9
int3
Function at 0x100db220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x100db2e7
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x100db235
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100dcb40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10114c13
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1014e404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x1014e3f0]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100dca30
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x100dcd21
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.100e7790
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x1012e3fc
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100dcd21
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x100dcc15
cmp eax, 2
jne 0x100dcd21
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x100dcc36
test cl, 1
jne 0x100dcd21
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x100dcc3c
jmp 0x100dcd21
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x100dcd21
call fcn.10043750
mov ecx, eax
test ecx, ecx
je 0x100dcd4c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.100dac90
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x1012e404
push eax
call fcn.100dd210
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.100db220
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x100dcd05
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100dcca6
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.100dcda0
push dword [0x1014e3f8]
lea eax, [ebp - 0x74]
push dword [0x1014e3f4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x100dcce2
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100dccfe
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x100dcd23
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100dcd21
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x100dcd2e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0038
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10040980
int3
Function at 0x100dcf10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10114c48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1014e404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x1014e3f0]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100dca30
test eax, eax
je 0x100dd038
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x100dcfe3
cmp dword [esi], 0
je 0x100dcfd6
push 0x1012e2b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100dcfa3
mov eax, 1
jmp 0x100dd004
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100dcfdc
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x100dd004
cmp dword [esi + 4], 0
jne 0x100dcfe3
mov eax, 1
jmp 0x100dd004
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100dd02e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x100dd016
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x100dd03b
xor ebx, ebx
jmp 0x100dd0df
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x100dd0df
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x100dd098
mov ecx, dword [ebx]
test ecx, ecx
je 0x100dd0fe
push ecx
push eax
call fcn.100f3873
add esp, 8
test eax, eax
je 0x100dd098
mov edx, dword [edi]
test edx, edx
je 0x100dd098
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100dd070
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x100dd0a3
lea eax, [edx + 0xd]
jmp 0x100dd0d8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100dd0b0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1012e3fc
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x100dd0ea
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10040980
int3
Function at 0x100de890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100de901
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x100de8cf
cmp eax, 2
jne 0x100de8eb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x100de8fb
test ecx, ecx
je 0x100de8f6
test cl, 1
jne 0x100de8eb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x100de8fb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x100e2cb0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10114f0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1014e404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.100dfb19
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x100e2d07
push 0x58
push 0
push esi
call fcn.100e7790
add esp, 0xc
mov ecx, esi
call fcn.100e20e0
mov esi, eax
jmp 0x100e2d09
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x100e2d1b
mov edi, dword [edi]
test edi, edi
je 0x100e2db8
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100e2db8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100e2db8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x100e2db8
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x100e2db8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x100e2db8
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.100e2540
test eax, eax
je 0x100e2db8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100e2dce
mov ecx, esi
call fcn.100e2200
push 0x58
push esi
call fcn.100dfb49
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e3600
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x100e36ff
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100e36ff
or eax, 0xffffffff
cmp esi, 8
jb 0x100e36d7
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
sub edi, 1
jne 0x100e3630
pop edi
test esi, esi
je 0x100e36fa
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101306e0]
sub esi, 1
jne 0x100e36e0
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x402b30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x34], 0xfffff000
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], 0x1000
mov edx, dword [ebp - 0x3c]
mov byte [ebp - 0x29], 1
mov bl, byte [ebp - 0x29]
mov dword [ebp - 0x28], 0x4550
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x20], 0x5a4d
mov word [ebp - 0x1a], 0x3e5f
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0x4d], bl
mov dword [ebp - 0x54], esi
jne 0x402bcc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], 0
mov cx, word [ebp - 0x1a]
and cx, 0x567
mov word [ebp - 0x1a], cx
mov edx, dword [ebp - 0x10]
or edx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], 0
jmp 0x402ccb
mov ax, 0x44d4
mov ecx, dword [ebp - 0x14]
sub ax, word [ebp - 0x1a]
mov dword [ebp - 0x14], 0
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx]
mov edx, dword [ebp - 0x10]
xor edx, eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
jne 0x402c5f
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + ecx]
mov edx, dword [ebp - 0x40]
mov si, word [ebp - 0x1a]
mov di, ax
and si, di
mov word [ebp - 0x1a], si
xor edx, 0
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x54]
cmp ecx, eax
jne 0x402c43
mov eax, 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
jmp 0x402ccb
lea eax, [ebp - 0x1a]
mov cx, word [ebp - 0x1a]
mov dx, ax
or cx, dx
mov eax, dword [ebp - 0x14]
add eax, 0
mov word [ebp - 0x1a], cx
mov dword [ebp - 0x14], eax
mov ax, 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x4c]
sub ecx, edx
sub ax, word [ebp - 0x1a]
mov esi, dword [ebp - 0x14]
and esi, 0
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x48]
and ecx, esi
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
or ecx, eax
mov dword [ebp - 0x14], ecx
mov dl, byte [ebp - 0x4d]
test dl, 1
jne 0x402be5
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], 0
mov cx, word [ebp - 0x1a]
or cx, 0x7e75
mov word [ebp - 0x1a], cx
mov edx, dword [ebp - 0x14]
sub eax, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0
mov eax, 0
lea ecx, [ebp - 0x10]
mov edx, eax
sub edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x14]
or esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x40], edx
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10012bf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10012c07
pop dword [ebp - 0x34]
mov eax, 0xf317c749
sub eax, 0xe3169b42
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x5a1a653e
add dword [ebp - 0x44], 0xf437e00d
mov dword [ebp - 0x40], 0xa59b099b
add dword [ebp - 0x40], 0x8c9842aa
mov dword [ebp - 0x3c], 0xdf01da08
add dword [ebp - 0x3c], 0x6d4a6a26
mov dword [ebp - 0x38], 0xce0830bf
add dword [ebp - 0x38], 0x31f7cf41
lea eax, [ebp - 0x44]
push eax
mov eax, 0x4cd0e974
add eax, 0xc3311690
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x8d26b178
add dword [ebp - 0x44], 0xe74bb7de
mov dword [ebp - 0x40], 0x488acb34
add dword [ebp - 0x40], 0xf8e19641
mov dword [ebp - 0x3c], 0x837d0d17
add dword [ebp - 0x3c], 0xdff25f55
mov dword [ebp - 0x38], 0xe6b9c333
sub dword [ebp - 0x38], 0xe6b9c333
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe9e1a4b3
sub eax, 0xd9dfa4b3
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3be0e
push 0
call eax
mov ecx, 0x34725ab
add ecx, 0xfcb91e9c
mov ebx, eax
mov esi, 0xd625c733
sub esi, 0xc6230b33
add esi, dword [ebp - 0x34]
mov edx, 0xf64092fc
add edx, 0x33a7bcd0
sub dword [ebp - 0x24], 0x776c8746
mov edi, dword [esi]
xor dword [ebp - 0x1c], eax
add edi, edx
xor dword [ebp - 0x2c], 0x61be760b
mov dword [ebx], edi
xor dword [ebp - 0x24], 0xb5a26a1d
add ebx, 0x53311cca
sub ebx, 0x53311cc6
add esi, 0x4a9d9c25
add esi, 0xb56263df
loop 0x10012d29
add eax, 0x55470d5e
add eax, 0xaab9f691
mov ebx, eax
add eax, 0xbbff0c27
add eax, 0x4400f3de
mov ecx, 0x17a0157
sub ecx, 0xf17a0157
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1000b496
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000b4c2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
call fcn.1001c431
add esp, 0xc
jmp 0x1000b539
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000b52c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000b50c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x1000b52a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x1000b528
jmp 0x1000b52a
jmp 0x1000b501
jmp 0x1000b539
push 0x20bf
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret