joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b526f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.004b4d3f
mov esi, eax
test esi, esi
je 0x4b532b
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.004b4dff
mov ebp, eax
test ebp, ebp
je 0x4b532a
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.004b4dff
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4b532a
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x4b532a
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4b5329
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x4b530f
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4b63a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4b63cb
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4b63cb
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4b63d5
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4b6417
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4b6479
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4b6474
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4b645f
test dl, dl
je 0x4b645b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4b645f
add ecx, 2
add eax, 2
test dl, dl
jne 0x4b643f
xor eax, eax
jmp 0x4b6464
sbb eax, eax
or eax, 1
test eax, eax
je 0x4b6485
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4b642c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x4b8cf2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0xb38d
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x4b9045
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x4b9067
mov eax, 0xfffffffd
jmp 0x4b9139
cmp dword [0x84], 0
je 0x4b9112
cmp dword [0x88], 5
jl 0x4b9095
cmp dword [0x88], 7
jg 0x4b9095
mov eax, 1
jmp 0x4b909a
mov eax, 0
test eax, eax
jne 0x4b90b3
cmp dword [0x88], 0xfffffffb
je 0x4b90b3
xor eax, eax
jmp 0x4b90b8
mov eax, 1
test eax, eax
je 0x4b90e4
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x4b90cd
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x84], 0
jne 0x4b912f
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x4b9139
mov esp, ebp
pop ebp
ret 4
Function at 0x519062
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret

Function at 0x51a804
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x51a8b8
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0051a794
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x51a891
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51a8c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x51a8df
test ebp, ebp
je 0x51a8df
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x51a8e7
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x51a927
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x51a983
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x51a97e
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x51a969
test dl, dl
je 0x51a965
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x51a969
add ecx, 2
add eax, 2
test dl, dl
jne 0x51a949
xor eax, eax
jmp 0x51a96e
sbb eax, eax
or eax, 1
test eax, eax
je 0x51a98d
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x51a936
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x51a9a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0051a804
mov esi, eax
test esi, esi
je 0x51aa60
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0051a8c4
mov ebp, eax
test ebp, ebp
je 0x51aa5f
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0051a8c4
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x51aa5f
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x51aa5f
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x51aa5e
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x51aa44
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x406fad
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42207c]
jne 0x406fb7
repz ret
jmp fcn.00407e45

Function at 0x40c282
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42207c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040864b
and dword [ebp - 0x14], 0
cmp dword [0x424910], 0
mov dword [ebp - 0x18], eax
jne 0x40c335
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c3dd
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41a3ac
push ebx
call edi
test eax, eax
je 0x40c3dd
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x424910], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x424914], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x424918], eax
call edi
push eax
call esi
mov dword [0x424920], eax
test eax, eax
je 0x40c335
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42491c], eax
mov eax, dword [0x42491c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40c38e
cmp dword [0x424920], ecx
je 0x40c38e
push eax
call esi
push dword [0x424920]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40c38e
test ebx, ebx
je 0x40c38e
call edi
test eax, eax
je 0x40c385
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40c385
test byte [ebp - 8], 1
jne 0x40c38e
or dword [ebp + 0x10], 0x200000
jmp 0x40c3c1
mov eax, dword [0x424914]
cmp eax, dword [ebp - 0x18]
je 0x40c3c1
push eax
call esi
test eax, eax
je 0x40c3c1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c3c1
mov eax, dword [0x424918]
cmp eax, dword [ebp - 0x18]
je 0x40c3c1
push eax
call esi
test eax, eax
je 0x40c3c1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x424910]
call esi
test eax, eax
je 0x40c3dd
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40c3df
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406fad
leave
ret
Function at 0x100080e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100080f4
pop dword [ebp - 0x50]
mov eax, 0x9c12c66f
add eax, 0x73edba85
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x1635d3fa
add dword [ebp - 0x60], 0x381c7151
mov dword [ebp - 0x5c], 0x11ddf6a4
sub dword [ebp - 0x5c], 0xdfaaaa5f
mov dword [ebp - 0x58], 0xba7d09a4
sub dword [ebp - 0x58], 0x6e30c576
mov dword [ebp - 0x54], 0x511d1f56
add dword [ebp - 0x54], 0xaee2e0aa
lea eax, [ebp - 0x60]
push eax
mov eax, 0xd81086bc
sub eax, 0xc80fd698
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xd37d846
add dword [ebp - 0x60], 0x673a9110
mov dword [ebp - 0x5c], 0x2bfd8f11
sub dword [ebp - 0x5c], 0xea912d9c
mov dword [ebp - 0x58], 0xac9a1fab
sub dword [ebp - 0x58], 0x492ab33f
mov dword [ebp - 0x54], 0x863652e
sub dword [ebp - 0x54], 0x863652e
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3363e
push 0
call eax
mov ecx, 0x102071ef
add ecx, 0xefdfc5f6
xor esi, esi
add esi, eax
mov edi, 0xff059d04
add edi, 0x10fec4fc
add edi, dword [ebp - 0x50]
mov ebx, 0x9541c5df
add ebx, 0x769b0d87
mov dword [ebp - 0x14], 0xbe38fd98
mov edx, dword [edi]
xor dword [ebp - 0xc], 0xd565805c
add edx, ebx
mov dword [ebp - 0x34], 0xf8821b75
mov dword [esi], edx
add dword [ebp - 0x20], ebx
add esi, 0x8460b7f4
add esi, 0x7b9f4810
add edi, 4
loop 0x10008213
add eax, 0xe86fb32f
add eax, 0x17911f38
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x30131ac3
sub ecx, 0x20131ac3
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x406bb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
or ebp, 0xffffffff
jmp 0x406bd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x406bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x406bc8
mov eax, 1
add ebx, ebx
jne 0x406beb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x406be0
jne 0x406bfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x406be0
xor ecx, ecx
sub eax, 3
jb 0x406c10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x406c82
mov ebp, eax
add ebx, ebx
jne 0x406c1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x406c28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x406c4c
inc ecx
add ebx, ebx
jne 0x406c38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x406c2d
jne 0x406c49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x406c2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x406c6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x406c5d
jmp 0x406bce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x406c6c
add edi, ecx
jmp 0x406bce
pop esi
mov edi, esi
mov ecx, 7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x406c8a
cmp byte [edi], 1
jne 0x406c8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x406c8f
lea edi, [esi + 0x4000]
mov eax, dword [edi]
or eax, eax
je 0x406d07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x68a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x68dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x406cbc
mov ecx, edi
jns 0x406ceb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x68e0]
or eax, eax
je 0x406d01
mov dword [ebx], eax
add ebx, 4
jmp 0x406cd9
call dword [esi + 0x68f0]
mov ebp, dword [esi + 0x68e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x406d3b
sub esp, 0xffffff80
jmp 0x4012b0
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403e59
pop dword [ebp - 0xc]
mov eax, 0xfa32466a
add eax, 0x60df7ef
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd3b84729
add dword [ebp - 0x1c], 0x7a99fe22
mov dword [ebp - 0x18], 0x966297c5
add dword [ebp - 0x18], 0x9bd0b480
mov dword [ebp - 0x14], 0x3f66b8d1
sub dword [ebp - 0x14], 0xf31a74a3
mov dword [ebp - 0x10], 0x21b322c5
sub dword [ebp - 0x10], 0x21b322c5
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x8ec27bf4
sub eax, 0x8e81fb68
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x31a81960
sub dword [ebp - 0x1c], 0xbd35b00a
mov dword [ebp - 0x18], 0x8f030cc4
sub dword [ebp - 0x18], 0x4d96ab4f
mov dword [ebp - 0x14], 0x5eea7d3b
sub dword [ebp - 0x14], 0xfb7b10cf
mov dword [ebp - 0x10], 0x9eba5ddf
sub dword [ebp - 0x10], 0x9eba5ddf
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3ccfd
push 0
call eax
mov ecx, 0xa55970ae
sub ecx, 0xa559106c
mov edi, eax
mov ebx, 0x4afbf0e4
sub ebx, 0x4abae0e4
add ebx, dword [ebp - 0xc]
mov edx, 0x4929595b
add edx, 0xfc575b64
xor dword [ebp - 4], esi
mov esi, dword [ebx]
sub dword [ebp - 4], 0xb771aa55
sub esi, edx
mov dword [ebp - 4], 0x3f5f86a6
mov dword [edi], esi
add dword [ebp - 8], eax
add edi, 0x68a093d0
add edi, 0x975f6c34
add ebx, 4
loop 0x403f76
add eax, 0x4b6f087e
sub eax, 0x4b6d94a3
mov ebx, eax
add eax, 0x17b1cbcf
sub eax, 0x17b1cbca
mov ecx, 0x1fc9015e
sub ecx, 0x1f89015e
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a

Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.10045683
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.10045683
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100092c3
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push 0x120
call sub.glib_lite.dll_Ordinal_394
mov edi, eax
pop ecx
test edi, edi
je 0x1000934d
push edi
xor ebp, ebp
push ebp
push 0x1001d834
push 0x10023880
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x10009352
push ebx
push ebp
mov ebx, 0x4000100
push ebx
push 2
push ebp
push 5
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
push ebp
push ebx
push 3
push ebp
push 7
push Ordinal_1
push edi
mov dword [edi + 0x108], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp dword [edi + 0x108], 0xffffffff
mov dword [edi + 0x104], eax
pop ebx
je 0x10009352
cmp eax, 0xffffffff
je 0x10009352
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x110], ebp
mov dword [edi + 0x114], ebp
mov eax, edi
pop edi
pop ebp
ret
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
jmp 0x1000934f

Function at 0x10010530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [eax*4 + 0x1001e2c8]
push esi
push edi
push 0xffffffffffffff80
mov dword [esp + 0x18], ecx
lea edi, [ecx + ecx]
pop esi
mov ebx, esi
xor edx, edx
sar ebx, 0x1f
mov eax, ebx
xor eax, esi
sub eax, ebx
cmp eax, edi
cmovl edx, eax
mov al, bl
sub edx, ecx
mov ecx, edx
sar ecx, 0x1f
xor dl, cl
sub al, dl
add al, cl
mov ecx, dword [esp + 0x14]
add al, cl
xor al, bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0x80
jle 0x1001054d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10013a33
pop dword [ebp - 0x2c]
mov eax, 0x10013a33
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x52afddf4
add dword [ebp - 0x3c], 0xfba26757
mov dword [ebp - 0x38], 0xba00549a
sub dword [ebp - 0x38], 0x87cd0855
mov dword [ebp - 0x34], 0x6d1f5c5c
sub dword [ebp - 0x34], 0x20d3182e
mov dword [ebp - 0x30], 0xcde80801
add dword [ebp - 0x30], 0x3217f7ff
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x9714c2cf
add eax, 0x78ecfdb1
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x643b2b78
sub dword [ebp - 0x3c], 0xefc8c222
mov dword [ebp - 0x38], 0xa0fb211d
sub dword [ebp - 0x38], 0x5f8ebfa8
mov dword [ebp - 0x34], 0x54dea00e
add dword [ebp - 0x34], 0xe90cc5e
mov dword [ebp - 0x30], 0xb07bee97
add dword [ebp - 0x30], 0x4f841169
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38e79
push 0
call eax
mov ecx, 0x4df9
xor edx, edx
add edx, eax
mov esi, 0x25617997
add esi, 0xeaa0ee69
add esi, dword [ebp - 0x2c]
mov ebx, 0xfc3d43bf
xor dword [ebp - 0x14], edi
mov edi, dword [esi]
sub dword [ebp - 0x28], eax
xor edi, ebx
mov dword [ebp - 8], 0xe7d8484
mov dword [edx], edi
mov dword [ebp - 0x1c], 0x1dde4bdd
add edx, 4
add esi, 0xed585bb0
sub esi, 0xed585bac
loop 0x10013b41
add eax, 0xb6c85d1
add eax, 0xf494a4e6
xor ebx, ebx
add ebx, eax
add eax, 0xa6613bda
sub eax, 0xa6613bd5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret