joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5efe03
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5efe1e
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b5043]
pop edx
test eax, eax
je 0x5efef0
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5efedf
test dword [ebp - 0x2a8], 1
jne 0x5efedf
and dword [ebp - 0x2a8], 0x100
jne 0x5efedf
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3b20]
pop edx
pop esi
test eax, eax
je 0x5efe82
jmp 0x5efedf
cmp word [esi], 0x5a4d
jne 0x5efedf
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5efedf
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3b08]
pop edx
test eax, eax
je 0x5efedf
lea eax, [ebp - 0x28c]
push eax
call fcn.005efd5f
test eax, eax
jne 0x5efed8
jmp 0x5efedf
mov eax, esi
jmp 0x5efef0
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5efe1e
pop esi
leave
ret 4
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x1bd0ebc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1bd0ec6
pushal
call 0x1bd0ecc
pop ebp
sub ebp, 0x10
sub ebp, 0x17d0ebc
jmp 0x1bd0ee2
mov eax, 0x17d0ebc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5db
mov edx, 0xbe74d5a7
xor byte [eax], dl
inc eax
dec ecx
jne 0x1bd0ef9
jmp 0x1bd0f0c
sub al, 0x6a
sub al, 0x2e
wait
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
pop di
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
push 0x1f
mov al, byte [0x1da7a7a7]
invalid
Function at 0x74901b
Capabilities:
Encode data using xor

Disassembly:
call dword [edx + 0x24840f00]
rol byte [ebx + 0x170c60bf], cl
mov edi, 0xa0c1eefb
sysret
mov ecx, dword [edi - 0x7b786ea8]
mov ebx, dword [esi]
jae 0x748fcb
arpl si, bp
mov word [esi + esi*4 + 0xc], 0x48d
inc ebp
xor al, 0xf7
aas
fnstenv [ecx]
not byte [eax + 0x56]
push dword [edi - 0x1db117d5]
sbb cl, byte [ecx]
dec byte [esi]
invalid

Function at 0x9b7510
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x66400d
lea edi, [esi - 0x26300d]
push edi
or ebp, 0xffffffff
jmp 0x9b7532
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b7539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b7528
mov eax, 1
add ebx, ebx
jne 0x9b754b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b7540
jne 0x9b755c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b7540
xor ecx, ecx
sub eax, 3
jb 0x9b7570
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b75e2
mov ebp, eax
add ebx, ebx
jne 0x9b757b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9b7588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9b75ac
inc ecx
add ebx, ebx
jne 0x9b7598
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b758d
jne 0x9b75a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b758d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b75cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b75bd
jmp 0x9b752e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b75cc
add edi, ecx
jmp 0x9b752e
pop esi
mov edi, esi
mov ecx, 0x18a9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b75ea
cmp byte [edi], 0x11
jne 0x9b75ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b75ef
lea edi, [esi + 0x5b3000]
mov eax, dword [edi]
or eax, eax
je 0x9b765e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ba02c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ba084]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b761c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ba08c]
or eax, eax
je 0x9b7658
mov dword [ebx], eax
add ebx, 4
jmp 0x9b7639
call dword [esi + 0x5ba088]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9b768f
cmp al, 0xef
ja 0x9b7682
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9b7664
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9b7671
mov ebp, dword [esi + 0x5ba090]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b76c3
sub esp, 0xffffff80
jmp 0x40efbc
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret
Function at 0x4025fe
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov eax, dword [ebx]
mov ebp, edx
mov edi, dword [ebx + 4]
xor edi, eax
mov dword [esp + 0x14], eax
mov eax, edi
mov ecx, edi
and eax, 0xfffffffc
mov esi, edi
add eax, 4
and cl, 3
cmovne esi, eax
mov ecx, esi
call fcn.00402f9c
mov dword [esp + 0x18], eax
test eax, eax
je 0x402679
shr esi, 2
lea edx, [ebx + 8]
xor ebx, ebx
and dword [esp + 0x10], ebx
lea ecx, [edx + esi*4]
mov esi, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp edx, ecx
cmova esi, dword [esp + 0x10]
test esi, esi
je 0x402672
mov ecx, eax
sub ecx, edx
mov eax, dword [edx]
xor eax, dword [esp + 0x14]
inc ebx
mov dword [ecx + edx], eax
lea edx, [edx + 4]
cmp ebx, esi
jb 0x40265d
mov eax, dword [esp + 0x18]
test ebp, ebp
je 0x402679
mov dword [ebp], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x402686
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
xor ebx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebx
lea esi, [ebx + 1]
mov eax, esi
mov edx, esi
and eax, 0xfffffffc
add eax, 4
and dl, 3
cmovne esi, eax
lea ecx, [esi + esi]
call fcn.00402f9c
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x402734
shr esi, 2
add ebp, 8
xor eax, eax
lea ecx, [esi*4]
mov esi, edi
add ecx, ebp
mov edx, ecx
sub edx, ebp
add edx, 3
shr edx, 2
cmp ebp, ecx
cmova edx, eax
test edx, edx
je 0x40272e
mov edi, dword [esp + 0x10]
xor ebx, ebx
mov ecx, dword [ebp]
lea ebp, [ebp + 4]
xor ecx, edi
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebx
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp ebx, edx
jb 0x4026f0
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x40273e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov eax, dword [ebx]
mov ebp, dword [ebx + 4]
xor ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
lea edi, [ebp + 1]
mov eax, edi
mov edx, edi
and eax, 0xfffffffc
add eax, 4
and dl, 3
cmovne edi, eax
mov ecx, edi
call fcn.00402f9c
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x4027d8
and dword [esp + 0x10], 0
add ebx, 8
shr edi, 2
xor eax, eax
mov edx, esi
lea ecx, [ebx + edi*4]
mov edi, ecx
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, ecx
cmova edi, eax
test edi, edi
je 0x4027d4
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
lea ebx, [ebx + 4]
xor ecx, esi
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, edi
jb 0x4027a7
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov byte [esi + ebp], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x402b04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x66a0
xor edx, edx
mov eax, dword [ebp - 8]
push ebx
push 0x72
mov ebx, ecx
pop ecx
div ecx
push 0x2d
mov dword [ebp - 8], eax
xor edx, edx
or dword [ebp - 8], 0xfedb4a0b
xor dword [ebp - 8], 0xfedb4aef
mov dword [ebp - 4], 0xe81c
or dword [ebp - 4], 0x67fc002f
mov eax, dword [ebp - 4]
pop ecx
div ecx
mov dword [ebp - 4], eax
add dword [ebp - 4], 0xffff684d
xor dword [ebp - 4], 0x24efba9
mov dword [ebp - 4], 0xfcb1
add dword [ebp - 4], 0x611f
add dword [ebp - 4], 0xffff914a
add dword [ebp - 4], 0xffff3527
shl dword [ebp - 4], 4
add dword [ebp - 4], 0xfffffcae
xor dword [ebp - 4], 0x240ae
cmp byte [ebx], 0
je 0x402c11
push esi
push edi
mov edi, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 4], 0xe81c
or dword [ebp - 4], 0x67fc002f
mov eax, dword [ebp - 4]
div ecx
push 0x2d
mov dword [ebp - 4], eax
add dword [ebp - 4], 0xffff684d
xor dword [ebp - 4], 0x24efba9
mov cl, byte [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], 0xfcb1
add dword [ebp - 4], 0x611f
add dword [ebp - 4], 0xffff914a
add dword [ebp - 4], 0xffff3527
shl dword [ebp - 4], 4
add dword [ebp - 4], 0xfffffcae
xor dword [ebp - 4], 0x240ae
shl esi, cl
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
movsx eax, byte [ebx]
mov dword [ebp - 8], eax
add dword [ebp - 8], esi
shl edx, cl
add dword [ebp - 8], edx
sub dword [ebp - 8], edi
inc ebx
pop ecx
cmp byte [ebx], 0
jne 0x402b90
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402d97
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
mov dword [esp + 0x20], eax
mov ebp, esi
mov edi, dword [eax + ebx + 0x78]
add edi, ebx
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [esp + 0x1c], eax
add ecx, ebx
mov eax, dword [edi + 0x24]
add eax, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [edi + 0x18], esi
jbe 0x402e22
mov ecx, dword [ecx + ebp*4]
add ecx, ebx
call fcn.00402b04
xor eax, 0x1e6899c7
cmp eax, dword [esp + 0x10]
je 0x402df6
mov ecx, dword [esp + 0x14]
inc ebp
cmp ebp, dword [edi + 0x18]
jb 0x402dd5
jmp 0x402e22
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx eax, word [eax + ebp*2]
mov esi, dword [esi + eax*4]
add esi, ebx
cmp esi, edi
jb 0x402e22
mov eax, dword [esp + 0x20]
mov eax, dword [eax + ebx + 0x7c]
add eax, edi
cmp esi, eax
jae 0x402e22
mov ecx, esi
call fcn.00402e63
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x402e2c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov edi, dword [eax + 0xc]
mov ebx, ecx
add edi, 0xc
mov esi, dword [edi]
jmp 0x402e54
mov ecx, dword [esi + 0x30]
call fcn.00402c19
xor eax, 0x264b5928
cmp eax, ebx
je 0x402e5e
mov esi, dword [esi]
cmp esi, edi
jne 0x402e41
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x18]
jmp 0x402e5a
Function at 0x402ff7
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebp
mov ebp, ecx
push edi
cmp edx, 0x40
jb 0x4030eb
call fcn.004030f3
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x4030eb
push esi
push 0x40
push 0x3000
push dword [edi + 0x50]
mov edx, 0x27b93f8d
mov ecx, 0xa935bf5a
push 0
push 0xe8
call fcn.00402eec
pop ecx
call eax
mov esi, eax
test esi, esi
je 0x4030e6
movzx ecx, word [edi + 0x14]
lea eax, [edi + 0x18]
add eax, ecx
mov edx, ebp
movzx ecx, word [edi + 6]
push ebx
push dword [edi + 0x54]
imul ebx, ecx, 0x28
mov ecx, esi
mov dword [esp + 0x14], eax
add ebx, eax
call fcn.00402f7b
pop ecx
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
jae 0x4030b2
sub ebx, ecx
lea eax, [ecx + 0x10]
mov dword [esp + 0x10], eax
xor edx, edx
push 0x28
pop ecx
lea eax, [ebx - 1]
mov ebx, dword [esp + 0x10]
div ecx
inc eax
mov edi, eax
mov ecx, dword [ebx]
cmp dword [ebx - 8], ecx
mov edx, dword [ebx + 4]
cmovb ecx, dword [ebx - 8]
add edx, ebp
push ecx
mov ecx, dword [ebx - 4]
add ecx, esi
call fcn.00402f7b
lea ebx, [ebx + 0x28]
pop ecx
dec edi
jne 0x40308e
mov edi, dword [esp + 0x18]
mov edx, edi
mov ecx, esi
call fcn.004031be
mov edx, edi
mov ecx, esi
call fcn.0040311c
pop ebx
test eax, eax
jne 0x4030e6
push 0x8000
push eax
push esi
push 0x42
mov edx, 0xe49a4690
mov ecx, 0xa935bf5a
call fcn.00402eec
pop ecx
call eax
xor esi, esi
mov eax, esi
pop esi
jmp 0x4030ed
xor eax, eax
pop edi
pop ebp
add esp, 0xc
ret

Function at 0x4030f3
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x403100
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4030fd
mov edx, 0x10b
xor ecx, ecx
cmp word [eax + 0x18], dx
cmovne eax, ecx
ret
Function at 0x10001e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1002a0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.CreateScheduledTask
lea eax, [ebp - 0x68]
mov ebx, ecx
push 0x64
push eax
mov dword [ebp - 0x70], ebx
call fcn.1000d6ca
lea ecx, [ebp - 0x68]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001ec1
xor eax, eax
sub ecx, edx
je 0x10001f3c
cmp ecx, 0x40
jb 0x10001f32
movaps xmm2, xmmword [0x100271e0]
lea esi, [ebp - 0x68]
mov edx, ecx
lea edi, [ebp - 0x48]
and edx, 0xffffffc0
lea ebx, [ebp - 0x38]
nop dword [eax + eax]
movups xmm0, xmmword [esi + eax]
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [esi + eax], xmm0
movups xmm0, xmmword [ebp + eax - 0x58]
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x58], xmm1
movups xmm0, xmmword [edi + eax]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [edi + eax], xmm1
movups xmm0, xmmword [ebx + eax]
xorps xmm0, xmm2
movups xmmword [ebx + eax], xmm0
add eax, 0x40
cmp eax, edx
jb 0x10001ef0
mov ebx, dword [ebp - 0x70]
cmp eax, ecx
jae 0x10001f3c
xor byte [ebp + eax - 0x68], 0xaa
inc eax
cmp eax, ecx
jb 0x10001f32
mov esi, dword [ebx]
lea edi, [ebp - 0x68]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x74], edx
cmp dword [esi + 0x7c], 0
je 0x1000204d
mov esi, dword [esi + 0x78]
add esi, edx
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x1000204d
cmp dword [esi + 0x14], 0
je 0x1000204d
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x10001f8c
mov eax, dword [esi + 0x10]
movzx ecx, di
cmp ecx, eax
jb 0x1000204d
sub ecx, eax
jmp 0x1000202c
cmp dword [ebx + 0x30], 0
jne 0x10002008
mov edi, dword [esi + 0x20]
mov eax, ecx
mov ebx, dword [esi + 0x24]
mov ecx, 8
add edi, edx
add ebx, edx
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.1000f630
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x70]
mov dword [eax + 0x30], ecx
test ecx, ecx
jne 0x10001fc9
push 0xe
jmp 0x1000204f
mov eax, dword [esi + 0x18]
xor edx, edx
test eax, eax
je 0x10001ff2
mov eax, dword [edi]
lea edi, [edi + 4]
add eax, dword [ebp - 0x74]
lea ebx, [ebx + 2]
mov dword [ecx], eax
lea ecx, [ecx + 8]
mov ax, word [ebx - 2]
inc edx
mov word [ecx - 4], ax
mov eax, dword [esi + 0x18]
cmp edx, eax
jb 0x10001fd2
mov ebx, dword [ebp - 0x70]
push 0x10006c40
push 8
push eax
push dword [ebx + 0x30]
call fcn.1000ee50
add esp, 0x10
push 0x10006c40
push 8
push dword [esi + 0x18]
lea eax, [ebp - 0x6c]
push dword [ebx + 0x30]
push eax
call fcn.1000f33e
add esp, 0x14
test eax, eax
je 0x1000204d
movzx ecx, word [eax + 4]
mov edx, dword [ebp - 0x74]
cmp ecx, dword [esi + 0x14]
ja 0x1000204d
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007f5a
mov esp, ebp
pop ebp
ret
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007f5a
mov esp, ebp
pop ebp
ret
Function at 0x10002900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f825
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1002a0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
jne 0x10002993
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.100025d0
test al, al
jne 0x10002993
push 4
call fcn.10007f6d
mov dword [ebp - 0x14], eax
mov dword [eax], 0x100024c0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10006330
push 0
push 0
call fcn.1000d316
add esp, 0x1c
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100029ba
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100029b3
push ecx
push eax
call fcn.100079ef
add esp, 8
test eax, eax
jne 0x100029b3
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007f5a
mov esp, ebp
pop ebp
ret 0xc
push 1
call fcn.10006e2e
push 6
mov dword [ebp - 0x18], 0
call fcn.10006e2e
int3

Function at 0x10002b70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2c
push esi
mov esi, dword [ebp + 0x10]
push str.GlobalClipboardMonitorTask
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x1002bf64], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10002cbe
test esi, esi
je 0x10002cbe
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002bb0
sub ecx, edx
je 0x10002cbe
mov ecx, esi
call fcn.100029d0
push 0x11
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.encrypted_dll.dat
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.100057a0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.10002070
mov ecx, dword [esp + 0x24]
mov byte [esp + 0xb], al
cmp ecx, 0xf
jbe 0x10002c39
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002c2b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002cc5
push ecx
push edx
call fcn.10007f9d
mov al, byte [esp + 0x13]
add esp, 8
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
test al, al
je 0x10002c98
mov eax, str.createTask
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x10002c77
test cl, cl
je 0x10002c73
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x10002c77
add esi, 2
add eax, 2
test cl, cl
jne 0x10002c57
xor eax, eax
jmp 0x10002c7c
sbb eax, eax
or eax, 1
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x10002c91
mov ecx, esi
call fcn.10001e90
test eax, eax
je 0x10002c91
call eax
mov ecx, esi
call fcn.10006c80
mov eax, dword [0x1002bf64]
test eax, eax
je 0x10002cbe
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x1002bf64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1002bf64], 0
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.1000e6df
int3