joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034ec
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x1005250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x100352c
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1003541
sub eax, ecx
sar eax, 1
push 0x1001b10
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x100359c
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1003727
mov ecx, 0x1001b0c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10035cd
test dx, dx
je 0x10035c9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10035cd
add eax, 4
add ecx, 4
test dx, dx
jne 0x10035a7
xor eax, eax
jmp 0x10035d2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10036ed
mov ecx, 0x1001b04
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100360b
test dx, dx
je 0x1003607
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100360b
add eax, 4
add ecx, 4
test dx, dx
jne 0x10035e5
xor eax, eax
jmp 0x1003610
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10036ed
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x1003651
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.010039ab
test eax, eax
je 0x10036ed
cmp dword [edi + 0xc], 0
je 0x10036ca
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.01003371
test eax, eax
je 0x10036ca
test byte [ebp - 0x75c], 0x10
je 0x10036ed
lea esi, [ebp - 0x30c]
call fcn.01003444
test eax, eax
je 0x10036ed
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.010031b6
jmp 0x10036ed
lea esi, [ebp - 0x20c]
call fcn.01003444
test eax, eax
je 0x10036ed
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.0100328f
mov esi, eax
test esi, esi
jne 0x100370a
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x100359c
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x1003725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1003725
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01003e97
leave
ret 8
Function at 0x1003e7d
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1004348
call fcn.01004074
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10068cc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003c92
cmp eax, esi
jne 0x1003c85
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003c95
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003c6c
xor esi, esi
inc esi
mov eax, dword [0x10068c8]
cmp eax, esi
jne 0x1003ca8
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003ce3
mov eax, dword [0x10068c8]
test eax, eax
jne 0x1003cdd
mov dword [0x10068c8], esi
push 0x1001164
push 0x1001158
call fcn.01003be9
pop ecx
pop ecx
test eax, eax
je 0x1003ce3
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1003dad
mov dword [0x10052d0], esi
mov eax, dword [0x10068c8]
cmp eax, esi
jne 0x1003d07
push 0x1001154
push 0x100114c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10068c8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003d14
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10068d0], ebx
je 0x1003d35
push 0x10068d0
call fcn.01003fe9
pop ecx
test eax, eax
je 0x1003d35
push ebx
push 2
push ebx
call dword [0x10068d0]
push dword [0x10052b8]
push dword [0x10052bc]
push dword [0x10052b4]
call fcn.01001d4f
add esp, 0xc
mov dword [0x10052cc], eax
cmp dword [0x10052c0], ebx
jne 0x1003d93
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10052d0], ebx
jne 0x1003da1
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10052cc]
call fcn.010040b9
ret
call fcn.010041c1
jmp 0x1003c4a
Function at 0x29a01815
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x29a169b8]
jne 0x29a0181f
repz ret
jmp fcn.29a0e56f

Function at 0x29a0b79d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x29a0b7ac
pop dword [ebp - 0x40]
mov eax, 0xcb5c2c62
add eax, 0x5e448b4a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x436bf376
sub dword [ebp - 0x50], 0xf519ae2b
mov dword [ebp - 0x4c], 0x11f952ec
add dword [ebp - 0x4c], 0x2039f959
mov dword [ebp - 0x48], 0x2184982e
sub dword [ebp - 0x48], 0xd5385400
mov dword [ebp - 0x44], 0x45f78803
sub dword [ebp - 0x44], 0x45f78803
lea eax, [ebp - 0x50]
push eax
mov eax, 0xe30ac728
sub eax, 0xb969c684
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x91ecd8a0
add dword [ebp - 0x50], 0xe28590b6
mov dword [ebp - 0x4c], 0x319761c5
sub dword [ebp - 0x4c], 0xf02b0050
mov dword [ebp - 0x48], 0xe09562cf
sub dword [ebp - 0x48], 0x7d25f663
mov dword [ebp - 0x44], 0x66e0a494
add dword [ebp - 0x44], 0x991f5b6c
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3cb05
push 0
call eax
mov ecx, 0x5521
xor esi, esi
add esi, eax
mov edx, 0xef3fbae
add edx, 0x1aadf252
add edx, dword [ebp - 0x40]
mov ebx, 0xb83a1daf
mov edi, dword [edx]
xor edi, ebx
mov dword [ebp - 0x3c], 0xbfbd5e15
mov dword [esi], edi
sub dword [ebp - 0x30], 0x92981547
add esi, 4
add edx, 0xe4b26189
sub edx, 0xe4b26185
loop 0x29a0b8bf
add eax, 0xfaa3173
sub eax, 0xfa8ea1c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1bace34c
add ecx, 0xdf31cb4
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0xa776d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00a7f100
add esp, 0xc
rol ebx, 0x15
ror ebx, 0x15
xchg esi, esi
cmp ebx, dword [esp + 8]
je 0xa77701
je 0xa776f9
nop
xchg esp, esp
lea ecx, [ecx]
jne 0xa77701
lcall 0x45c6, 0x66b06db1
in al, dx
inc esp
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
or esp, 0
jle 0xa77750
mov edi, edi
cmp ecx, esi
jge 0xa77768
jle 0xa77758
nop
lea edx, [edx + 0x78c9]
lea edx, [edx - 0x78c9]
jl 0xa77768
sub eax, 0x8aec5d8a
push ebp
int1
mov bl, byte [ebp - 0x14]
mov dl, byte [ebp - 0xf]
mov cl, byte [ebp - 0xa]
mov al, byte [ebp - 5]
dec bl
dec dl
mov byte [ebp - 0x14], bl
mov bl, byte [ebp - 0x13]
dec cl
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 0xe]
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 5], al
mov al, byte [ebp - 4]
dec bl
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0x12]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
mov byte [ebp - 4], al
mov al, byte [ebp - 3]
dec bl
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0x11]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xc]
dec al
mov byte [ebp - 8], cl
mov cl, byte [ebp - 7]
mov byte [ebp - 3], al
mov al, byte [ebp - 0x10]
dec bl
dec dl
dec cl
dec al
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0xb]
mov byte [ebp - 0xc], dl
mov byte [ebp - 7], cl
mov byte [ebp - 0x10], al
mov dl, byte [ebp - 6]
dec bl
dec dl
mov byte [ebp - 0xb], bl
mov byte [ebp - 6], dl
lea edx, [edx]
xchg edx, ecx
xchg edx, ecx
lea esi, [esi]
neg ebx
neg ebx
jb 0xa77821
pushf
test dword [esp + 0xc], eax
jg 0xa7780e
lea edi, [edi + 0x5033]
lea edi, [edi - 0x5033]
popf
jle 0xa7781e
jae 0xa77821
mov ebp, 0x803ae8
add byte [ebp + 0x5f0975c0], al
call 0xa7f860
test eax, eax
jne 0xa77833
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, ecx
jl 0xa77837
je 0xa77843
nop
js 0xa7783c
jbe 0xa7783e
js 0xa77840
jne 0xa77843
sub eax, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00a97030
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.00a7f100
add esp, 0xc
test esi, esi
jne 0xa7786e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
jle 0xa77870
shl esp, 0
jno 0xa7787c
jp 0xa77877
jo 0xa7787c
add eax, dword [0xe856b3f6]
add eax, 0xe856b3f6
push esi
call fcn.00a97100
jle 0xa77878
add dword [eax], eax
add esp, 4
cmc
inc ebx
dec ebx
jg 0xa77897
pushf
jne 0xa7788e
xchg esp, esp
popf
jge 0xa77894
jle 0xa77897
mov eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xa7cb80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xa750cc]
push esi
push edi
push eax
push 0xa73d2d
mov byte [0xa73d2c], 0x45
call fcn.00a809d0
mov edx, dword [0xa750cc]
mov al, 0x2d
mov byte [0xa73d32], al
mov byte [0xa73d33], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0xa73d31], cl
mov byte [0xa73d34], cl
mov esi, 0xa73d35
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0xa63a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0xa7cbcf
mov byte [esi], 0
pop edi
mov eax, 0xa73d2c
pop esi
ret

Function at 0xa7cde0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0xa71e50
call fcn.00a8b430
add esp, 0xc
mov byte [0xa71e50], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0xa7e030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00a7f100
add esp, 0xc
lea edi, [edi + 0x11]
lea edi, [edi - 0x11]
je 0xa7e058
mov ecx, ecx
jne 0xa7e055
jne 0xa7e058
sub eax, 0x65b073b1
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
inc edx
dec edx
add edx, 0
jbe 0xa7e097
je 0xa7e0a2
jmp 0xa7e09b
jmp 0xa7e09d
xchg esp, esp
jne 0xa7e0a2
add eax, 0xc639e8
add byte [ebp + 0x5f0975c0], al
call fcn.00a8a6e0
test eax, eax
jne 0xa7e0b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
or esp, 0
neg esi
neg esi
xchg edi, edx
xchg edi, edx
je 0xa7e0c1
jg 0xa7e0e7
pushf
call fcn.00a7e0ca
Function at 0xa7ed40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00a7f100
add esp, 0xc
add ecx, dword [esp]
sub ecx, dword [esp]
test esp, 0x3f55
test ebx, 0x47b9
je 0xa7ed81
pushf
ja 0xa7ed71
js 0xa7ed73
test edx, ecx
lea esp, [esp]
popf
jp 0xa7ed7c
lea edi, [edi]
jne 0xa7ed81
mov edx, 0x45c666b0
in al, dx
dec eax
mov al, 0x66
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x6d
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
mov esi, esi
sub edx, 0
je 0xa7edbc
cmp edx, dword [esp + 0xc]
jp 0xa7edc7
js 0xa7edc4
jnp 0xa7edc7
mov ecx, 0x8aec4d8a
inc ebp
int1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov bl, byte [ebp - 0xa]
mov dl, byte [ebp - 0x13]
dec cl
dec al
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 0xe]
dec bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 9]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 0x12]
mov byte [ebp - 0x13], dl
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x11]
dec bl
mov byte [ebp - 9], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0x10]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xb]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xb], dl
call fcn.00a8a6e0
test eax, eax
je 0xa7eeb8
nop
jbe 0xa7ee37
je 0xa7ee39
je 0xa7ee44
jo 0xa7ee3d
jg 0xa7ee3f
jne 0xa7ee44
xor eax, 0x4d8ddc22
in al, dx
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00a97030
push 0xd
lea edx, [ebp - 0x14]
mov edi, eax
push 0
push edx
mov dword [ebp - 4], edi
call fcn.00a7f100
add esp, 0xc
test edi, edi
je 0xa7eeb8
lea ebx, [ebx + 0x35f4]
sub ebx, 0x35f4
jo 0xa7ee8e
pushf
add esp, 0
shl ebx, 0
popf
lea esi, [esi + 0x268e]
lea esi, [esi - 0x268e]
jno 0xa7ee8e
mov esi, 0x826ce857
add dword [eax], eax
push edi
call fcn.00a97100
add esp, 4
add edi, dword [esp]
sub edi, dword [esp]
jns 0xa7eeb1
pushf
jg 0xa7eea3
cmp ecx, ebx
nop
popf
mov esp, esp
jo 0xa7eeac
jns 0xa7eeae
js 0xa7eeb1
mov ebp, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xa8a0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00a7f100
add esp, 0xc
jle 0xa8a0cb
shl esp, 0
jl 0xa8a0d8
lea esp, [esp]
jmp 0xa8a0d5
jge 0xa8a0d8
mov edi, 0x75b066b1
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
jae 0xa8a112
xchg edx, edx
mov esp, esp
jne 0xa8a118
jb 0xa8a122
jle 0xa8a11c
lea esp, [esp]
jae 0xa8a122
mov esp, 0x8afc4d8a
inc ebp
cmc
mov cl, byte [ebp - 4]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 6]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 7]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x10], al
mov byte [ebp - 7], bl
mov byte [ebp - 5], dl
mov byte [ebp - 0xe], cl
jl 0xa8a18c
jle 0xa8a18e
and esi, esi
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
jle 0xa8a1a3
js 0xa8a19c
xchg edi, edi
jg 0xa8a1a3
lcall 5, 0x38e8af8b
add byte [ebx + 0xfc985c8], cl
test ah, al
add byte [eax], al
add byte [ebp + 0x6407bf], cl
add byte [ebp - 0x640641], cl
invalid
call fcn.00a8a6e0
mov ecx, eax
test ecx, ecx
je 0xa8a276
lea edi, [edi + 0x6407]
lea edi, [edi - 0x6407]
call 0xa8a1c3
lea esp, [esp + 4]
jl 0xa8a1e9
pushf
std
cld
neg ebx
neg ebx
test dword [esp], edi
xor esi, 0x6ffd
xor esi, 0x6ffd
popf
lea eax, [eax]
lea esi, [esi]
jge 0xa8a1e9
mov ebx, 0x52f0558d
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00a97030
mov ebx, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00a7f100
add esp, 0xc
or esp, 0
jg 0xa8a20a
add edx, 0
jns 0xa8a225
pushf
test ecx, 0x70ff
mov esp, esp
mov esi, esi
popf
js 0xa8a21f
lea esp, [esp]
js 0xa8a225
mov ebx, 0x4d74db85
test ebx, ebx
je 0xa8a276
and esp, 0xffffffff
xchg edx, edi
xchg edx, edi
jle 0xa8a237
jnp 0xa8a234
jg 0xa8a237
mov ebp, 0xcec3e853
add byte [eax], al
push ebx
call fcn.00a97100
add esp, 4
jle 0xa8a242
jo 0xa8a244
not eax
not eax
xor edi, 0x5433
xor edi, 0x5433
jo 0xa8a270
pushf
lea eax, [eax]
ror esp, 0
add ecx, 0x2d8
sub ecx, 0x2d8
popf
jle 0xa8a26d
jno 0xa8a270
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xa96ea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov dword [ebp - 0xb], eax
push 0xa738a8
mov byte [ebp - 0xc], 0
mov byte [ebp - 7], al
call esi
sidt [ebp - 0xc]
mov eax, dword [ebp - 0xa]
add eax, 8
mov ebx, dword [eax]
add eax, 0x10
mov eax, dword [eax]
and eax, 0xffff
and ebx, 0xffff
sub eax, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1e
jne 0xa96f00
or ebx, ebx
and edx, 0xffffffff
jge 0xa96ef9
jae 0xa96ef2
mov eax, eax
js 0xa96ef6
jl 0xa96ef9
mov ebx, 0x2bf
add bl, ch
and dword [ebx], edi
dec esp
and al, 0x10
mov edi, 2
jmp 0xa96f21
cmp ecx, dword [esp + 0x10]
jno 0xa96f1c
js 0xa96f08
xchg ebx, edi
xchg ebx, edi
lea ecx, [ecx + 0x4092]
lea ecx, [ecx - 0x4092]
jo 0xa96f1c
sub eax, 0x4bf13
add byte [eax], al
mov edi, 4
push 0xa73898
call esi
xor ecx, dword [esp]
xor ecx, dword [esp]
dec eax
inc eax
jge 0xa96f32
je 0xa96f48
pushf
jb 0xa96f38
shl esp, 0
lea eax, [eax]
popf
xchg esi, ebx
xchg esi, ebx
ja 0xa96f45
jne 0xa96f48
mov ebx, 0x5e5fc78b
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa97030
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
test ecx, ecx
je 0xa970e9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0xa970e9
shl ebx, 0
xchg esi, edx
xchg esi, edx
jo 0xa97068
pushf
js 0xa97059
shl esp, 0
jmp 0xa9705e
ror esi, 0
popf
je 0xa97065
jno 0xa97068
mov esp, 0x100003d
add byte [ebx + 0x36], dh
cmp eax, 0x10000
jae 0xa970a5
xchg ecx, edi
xchg ecx, edi
jne 0xa97096
pushf
or eax, 0
or esp, 0
mov esp, esp
popf
lea edi, [edi + 0xdac]
lea edi, [edi - 0xdac]
mov edx, edx
xchg ecx, esi
xchg ecx, esi
je 0xa97096
mov esi, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call int.00a7c760
jmp 0xa970b5
jne 0xa970a7
jns 0xa970ae
jmp 0xa970ab
js 0xa970ae
mov ebx, 0x9be85150
popal
invalid
push eax
push ecx
call fcn.00a7d250
mov esi, eax
add esp, 8
test esi, esi
je 0xa970f4
lea ebx, [ebx]
jmp 0xa970c2
push ebx
pop ebx
jge 0xa970e0
pushf
xchg edi, eax
xchg edi, eax
call 0xa970cf
add esp, 4
shr esp, 0
popf
jo 0xa970d9
xchg ecx, ecx
xchg edx, eax
xchg edx, eax
jl 0xa970e0
add eax, 0x5e5fc68b
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0xa738b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0xa97100
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
add edi, 0
jle 0xa9710b
xor edx, dword [esp]
xor edx, dword [esp]
jp 0xa97133
pushf
jae 0xa97117
nop
rol ebx, 0x15
ror ebx, 0x15
popf
jle 0xa97122
lea ebx, [ebx + 0x362c]
lea ebx, [ebx - 0x362c]
js 0xa97130
jnp 0xa97133
mov edi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call fcn.00a848d0
add esp, 4
cmp eax, 2
jne 0xa9719e
jo 0xa97146
std
cld
jno 0xa9714a
jp 0xa9716a
pushf
xor ecx, ebx
xor ecx, ebx
shr edx, 0
push eax
add eax, 0x38a5
ror eax, 0xd
pop eax
popf
jge 0xa97163
xchg ebx, ebx
jns 0xa97167
jnp 0xa9716a
mov ecx, 0xa738c468
add bh, al
add eax, 0xa71d5c
add al, byte [eax]
add byte [eax], al
push 0xa738c4
mov dword [0xa71d5c], 2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 0
lea ecx, [ecx]
lea edx, [edx]
add edi, dword [esp]
sub edi, dword [esp]
jp 0xa97194
ja 0xa97190
jnp 0xa97194
mov edx, 0x1b86d
add byte [eax], al
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
clc
and esi, 0xffffffff
jo 0xa971a4
jb 0xa971b2
pushf
stc
popf
js 0xa971ad
jbe 0xa971af
jae 0xa971b2
sbb dword [edi + 0x5e], 0x5d5bc033
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x401109
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsZoomed
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowVisible
sub esp, 4
push edx
mov edx, 0x341d0
pop edx
mov eax, dword [0x403008]
shl eax, 3
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
mov dword [0x409024], eax
mov eax, dword [0x409010]
mov dword [esp], eax
call fcn.0040104c
mov edx, dword [0x409024]
add al, byte [0x403004]
mov byte [ebp - 0x19], al
mov ebx, edx
mov eax, dword [0x403008]
lea edi, [edx + eax*8]
cmp edx, edi
jae 0x401274
mov esi, 0x403080
lea eax, [ebx + 7]
movzx ecx, byte [esi]
movzx edx, byte [ebp - 0x19]
xor edx, ecx
mov byte [eax], dl
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowUnicode
sub esp, 4
lea eax, [ebx + 5]
lea edx, [esi + 2]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x19]
xor edx, ecx
mov byte [eax], dl
push eax
mov eax, 0x1e0f3
pop eax
lea eax, [ebx + 3]
lea edx, [esi + 3]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x19]
xor edx, ecx
mov byte [eax], dl
call sub.KERNEL32.dll_GetCurrentThreadId
lea eax, [ebx + 1]
lea edx, [esi + 4]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x19]
xor edx, ecx
mov byte [eax], dl
push ebp
mov ebp, 0x1240
pop ebp
lea eax, [ebx + 2]
lea edx, [esi + 5]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x19]
xor edx, ecx
mov byte [eax], dl
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowUnicode
sub esp, 4
lea eax, [esi + 6]
movzx edx, byte [eax]
movzx eax, byte [ebp - 0x19]
xor eax, edx
mov byte [ebx], al
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsIconic
sub esp, 4
lea eax, [ebx + 6]
lea edx, [esi + 8]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x19]
xor edx, ecx
mov byte [eax], dl
call sub.KERNEL32.dll_GetLastError
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowUnicode
sub esp, 4
lea eax, [ebx + 4]
lea edx, [esi + 9]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x19]
xor edx, ecx
mov byte [eax], dl
add ebx, 8
add esi, 0xa
cmp ebx, edi
jb 0x40118c
mov eax, dword [0x409024]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret