joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cc80
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x1003cd20
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x100408e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x100413e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xcc
call fcn.1001d6a0
mov ecx, dword [esp + 0xd0]
push ebx
push ebp
push esi
lea esi, [ecx + 0x14]
lea eax, [ecx + 0x54]
push edi
lea edi, [esp + 0x5c]
mov ecx, dword [esi + 0x3c]
xor ebp, ebp
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x9c]
sub ecx, eax
sub edi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
sub esi, eax
mov ebx, dword [esp + 0xe4]
mov edx, dword [eax]
xor ecx, ecx
mov dword [edi + eax - 0x40], edx
mov cl, byte [ebx + ebp]
mov ebx, dword [esp + 0x14]
xor edx, ecx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x10]
xor ecx, edx
add eax, 4
mov edx, dword [ecx*4 + str._.C]
mov ecx, dword [esi + eax - 4]
xor ecx, edx
inc ebp
mov dword [esi + eax - 4], ecx
cmp ebp, 0x10
mov dword [esp + 0x10], ecx
jl 0x1004141d
xor ecx, ecx
xor esi, esi
lea eax, [esp + 0x20]
mov edx, 6
mov ecx, dword [ecx*4 + str._.C]
mov edi, dword [eax - 4]
xor edi, ecx
mov ecx, edi
mov dword [eax - 4], edi
mov ebp, dword [eax]
add eax, 0x20
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x20], ebp
mov ebx, dword [eax - 0x1c]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x1c], ebx
mov edi, dword [eax - 0x18]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0x18], edi
mov ebp, dword [eax - 0x14]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x14], ebp
mov ebx, dword [eax - 0x10]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x10], ebx
mov edi, dword [eax - 0xc]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0xc], edi
mov ebp, dword [eax - 8]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
dec edx
mov dword [eax - 8], ebp
mov ecx, ebp
jne 0x1004146c
add ecx, esi
and ecx, 0xff
inc esi
cmp esi, 0x12
jl 0x10041463
mov edi, dword [esp + 0x18]
mov ecx, 0x10
lea esi, [esp + 0x1c]
lea edx, [esp + 0x1c]
push 0xc0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.10026e40
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
Function at 0x10041970
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.1001d6a0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x10041ac4
cmp ebx, 0x80
jg 0x10041ac4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.100422a0
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x10041a07
test ebp, ebp
jle 0x10041a55
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x100419f4
jmp 0x10041a51
xor esi, esi
test ebp, ebp
jle 0x10041a55
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x10041a37
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x10041a33
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x10041a64
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x10041a95
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x10041aac
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x10041aa8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10043ac0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
cmp esi, 0x80
mov byte [eax], 0
jle 0x10043adc
mov esi, 0x80
mov ecx, dword [esp + 0x20]
test ecx, ecx
jle 0x10043aec
cmp ecx, 0x400
jle 0x10043af1
mov ecx, 0x400
test esi, esi
jle 0x10043b08
mov edi, dword [esp + 0x1c]
mov edx, eax
sub edi, eax
mov ebp, esi
mov bl, byte [edi + edx]
mov byte [edx], bl
inc edx
dec ebp
jne 0x10043aff
xor edx, edx
cmp esi, 0x80
mov dl, byte [eax + esi - 1]
jge 0x10043b3a
mov edi, eax
sub edi, esi
mov bl, byte [edi + esi]
add ebx, edx
xor edx, edx
and ebx, 0xff
inc esi
cmp esi, 0x80
mov dl, byte [ebx + 0x10095c58]
mov byte [esi + eax - 1], dl
jl 0x10043b1a
lea esi, [ecx + 7]
mov edx, 0x80
neg ecx
sar esi, 3
and ecx, 7
mov edi, 0xff
sub edx, esi
sar edi, cl
xor ecx, ecx
mov cl, byte [edx + eax]
and edi, ecx
xor ecx, ecx
mov cl, byte [edi + 0x10095c58]
mov edi, edx
mov byte [edx + eax], cl
dec edx
test edi, edi
je 0x10043b8a
lea edi, [edx + eax]
lea ebp, [edx + 1]
xor edx, edx
mov dl, byte [edi + esi]
xor edx, ecx
xor ecx, ecx
dec ebp
dec edi
mov cl, byte [edx + 0x10095c58]
mov byte [edi + 1], cl
test ebp, ebp
ja 0x10043b72
lea esi, [eax + 0xfc]
mov ecx, 0x7f
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx + eax - 1]
mov bh, byte [ecx + eax]
and edx, 0xffff
sub esi, 4
or edx, ebx
sub ecx, 2
mov dword [esi + 4], edx
jns 0x10043b95
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100597b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.1001d6a0
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
lea esi, [eax - 1]
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esi - 0x29]
cmp edi, ecx
jle 0x100597ef
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.1001e430
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp esi, 0x29
jge 0x10059813
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.1001e430
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea eax, [esi - 0x14]
push 0x37
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x1c], eax
call fcn.1001da90
add esp, 0xc
mov dword [esp + 0x30], eax
test eax, eax
jne 0x10059851
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.1001e430
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ebx, dword [esp + 0x2c]
push 0
mov byte [ebx], 0
lea ebp, [ebx + 1]
add ebx, 0x15
call fcn.10025aa0
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push edx
push eax
call fcn.1002b370
mov ecx, esi
xor eax, eax
sub ecx, edi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x58]
mov eax, ebx
sub eax, ecx
mov edx, ecx
add eax, esi
mov esi, dword [esp + 0x54]
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10021ed0
add esp, 0x20
test eax, eax
jg 0x100598ce
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
call fcn.10025aa0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
push eax
push 0x14
push ebp
push edi
push esi
call fcn.10059b80
add esp, 0x14
test edi, edi
jle 0x10059900
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x100598f3
mov esi, dword [esp + 0x30]
call fcn.10025aa0
push eax
push edi
push ebx
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.10059b80
lea eax, [esp + 0x28]
add esp, 0x14
sub eax, ebp
mov ecx, 0x14
mov dl, byte [eax + ebp]
mov bl, byte [ebp]
xor bl, dl
mov byte [ebp], bl
inc ebp
dec ecx
jne 0x10059922
push esi
call main
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1005a030
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, edx
push esi
jne 0x1005a105
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x1005a053
cmp al, 0x6b
jne 0x1005a105
cmp al, 0x6b
lea esi, [ecx + 1]
jne 0x1005a0c1
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x1005a075
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x1005a075
cmp cl, 0xbb
jne 0x1005a09e
inc edx
cmp edx, eax
jl 0x1005a063
sub eax, edx
test edx, edx
jne 0x1005a0c4
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1001e430
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1001e430
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x1005a0ed
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.1001e430
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov ecx, eax
push edi
mov edi, dword [esp + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.1001e430
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x1005a200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.1001d6a0
mov eax, dword [esp + 0x58]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0xc]
push edi
mov edi, dword [eax + 8]
xor esi, esi
cmp edi, 0x20
mov dword [esp + 0x10], esi
jle 0x1005a237
push str.nkey___EVP_MAX_KEY_LENGTH
push 0x79
push str..cryptoevpevp_key.c
call fcn.1001fea0
add esp, 0xc
cmp ebp, 0x10
jle 0x1005a250
push str.niv___EVP_MAX_IV_LENGTH
push 0x7a
push str..cryptoevpevp_key.c
call fcn.1001fea0
add esp, 0xc
cmp dword [esp + 0x74], esi
jne 0x1005a260
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
lea eax, [esp + 0x14]
push eax
call fcn.1002b010
mov ecx, dword [esp + 0x70]
push esi
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.1002b030
add esp, 0x10
test eax, eax
je 0x1005a3c3
mov ebx, dword [esp + 0x84]
jmp 0x1005a295
mov esi, dword [esp + 0x84]
mov eax, esi
inc esi
test eax, eax
mov dword [esp + 0x84], esi
je 0x1005a2ba
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1002b160
add esp, 0xc
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1002b160
mov eax, dword [esp + 0x7c]
add esp, 0xc
test eax, eax
je 0x1005a2e9
push 8
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.1002b160
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.1002b180
mov esi, dword [esp + 0x88]
add esp, 0xc
cmp esi, 1
jbe 0x1005a34c
dec esi
mov edx, dword [esp + 0x6c]
push 0
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1002b030
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call fcn.1002b160
lea ecx, [esp + 0x28]
lea edx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.1002b180
add esp, 0x24
dec esi
jne 0x1005a30d
mov ecx, dword [esp + 0x10]
xor eax, eax
test edi, edi
je 0x1005a382
cmp eax, ecx
je 0x1005a382
mov edx, dword [esp + 0x80]
test edx, edx
je 0x1005a37c
mov esi, dword [esp + 0x80]
mov dl, byte [esp + eax + 0x24]
mov byte [esi], dl
mov edx, esi
inc edx
mov dword [esp + 0x80], edx
dec edi
inc eax
test edi, edi
jne 0x1005a356
test ebp, ebp
je 0x1005a39f
cmp eax, ecx
je 0x1005a39f
cmp eax, ecx
je 0x1005a39f
test ebx, ebx
je 0x1005a399
mov dl, byte [esp + eax + 0x24]
mov byte [ebx], dl
inc ebx
dec ebp
inc eax
test ebp, ebp
jne 0x1005a38a
test edi, edi
jne 0x1005a3a7
test ebp, ebp
je 0x1005a3cd
mov eax, dword [esp + 0x6c]
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.1002b030
add esp, 0xc
test eax, eax
jne 0x1005a28e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54
ret
lea edx, [esp + 0x14]
push edx
call fcn.1002b5e0
lea eax, [esp + 0x28]
push 0x40
push eax
call fcn.10026e40
mov ecx, dword [esp + 0x74]
add esp, 0xc
mov eax, dword [ecx + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x100664d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x100664e9
mov edi, ebx
mov ebx, eax
jmp 0x100664eb
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jle 0x10066501
push eax
push esi
call fcn.1002a0d0
add esp, 8
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x10066525
push ebp
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x1006650b
pop ebp
cmp eax, dword [edi + 4]
jge 0x1006653c
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x1006652a
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x10066562
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x10066562
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
mov dword [esi + 4], edx
test ecx, ecx
jg 0x1006654c
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x1006a680
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.1001d6a0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push edi
test ebp, ebp
jne 0x1006a69e
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x1006a74b
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1006a71c
mov ecx, dword [ebx + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edi
call fcn.10020550
add esp, 8
test eax, eax
je 0x1006a6d9
mov eax, dword [eax + 8]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
mov esi, 0x100880e0
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1006a705
test cl, cl
je 0x1006a701
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1006a705
add eax, 2
add esi, 2
test cl, cl
jne 0x1006a6e1
xor eax, eax
jmp 0x1006a70a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop esi
jne 0x1006a71c
push ebp
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
jne 0x1006a754
mov ecx, dword [ebx + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebp
call fcn.10020550
add esp, 8
test eax, eax
je 0x1006a695
mov eax, dword [eax + 8]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push ebp
call sub.MSVCRT.dll_getenv
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4012a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403df4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403df0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011a6
mov dword [ebp - 0x24], str.cognomen
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403df0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.invocatory
push str.cognomen
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403df8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40136d
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401354
mov eax, dword [0x403df4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x44
mov eax, 0x401023
mov ecx, 0
mov bl, byte [eax]
add bl, 0x38
mov byte [eax], bl
add eax, 1
add ecx, 1
cmp ecx, 0xd137
jne 0x40100e
or al, 0xc8
or eax, ecx
or eax, 0x52c8c8c8
loopne 0x401078
mov esi, edx
push eax
loopne 0x401080
mov ecx, ecx
dec ebx
mov cl, cl
dec ecx
rol edi, 0xef
enter 0x3dc8, 0xffffffffffffffb3
or al, 0xd8
or al, cl
or dword [ebx + 0x518b8b8b], 0xffffffe0
sbb byte [ebp + 0x4bc808a2], 0x88
enter 0xffffffffffff8c4b, 0xc
invalid
not dword [ecx - 0x74de3738]
and dword [eax - 0x4e37f611], 0xc8c86da6
mov al, 0xcd
out dx, eax
or eax, ecx
mov cl, 0xa6
insd dword es:[edi], dx
enter 0xffffffffffffb0c8, 0xffffffffffffffcd
enter 0xffffffffffffc8c8, 0xffffffffffffffb1
ror al, cl
enter 0xffffffffffff81c8, 0xffffffffffffffd0
invalid

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0x651f1fc8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x30412913
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4505391f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2c97430
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x607e13
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, ecx
pop edi
pop edi
nop
jns 0x607e2b
ja 0x607e2b
push eax
push edx
rdtsc
pop edx
pop eax
push eax
push eax
push edx
push eax
push edx
jmp 0x607e3f
rdtsc
push eax
push edx
rdtsc
pop edx
pop eax
pop edx
pop eax
rdtsc
push eax
push edx
jle 0x607e53
rdtsc
pushal
popal
pop edx
pop eax
pop edx
pop eax
nop
push 0
push edi
call 0x607e67
and byte [edi - 0x3d], bl
pop edi
mov dword [esp + 4], edi
add dword [esp + 4], 0x1b
inc edi
push edi
ret
Function at 0x4037a0
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040eb90
mov eax, dword [0x2c4cc44]
mov ecx, dword [0x2c4cbb8]
shr eax, 3
test eax, eax
jbe 0x4038db
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x4037f0
cmp dword [0x2c4cc44], 0x959
jne 0x4038bd
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0x402dbc
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1020]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0x402de8
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x824]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402e50
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0x402e5c
push 0x402e6c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004035d0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4037f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret