joyce8/EMBER2024-capa huggingface dataset:
Function at 0x582e89
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax], al
xor al, byte [esi + 0x3b]
cmp esi, dword [ebx]
cmp byte [ebx], dh
inc esp
xor eax, 0x8104c483
leave
mov eax, 0x590000ba
push eax
xor eax, 0x6c76
xor eax, 0x746b
pop eax
mov byte [ebp - 0x598], 0x56
mov byte [ebp - 0x597], 0x69
mov byte [ebp - 0x596], 0x72
mov byte [ebp - 0x595], 0x74
mov byte [ebp - 0x594], 0x75
mov byte [ebp - 0x593], 0x61
mov byte [ebp - 0x592], 0x6c
mov byte [ebp - 0x591], 0x50
mov byte [ebp - 0x590], 0x72
mov byte [ebp - 0x58f], 0x6f
mov byte [ebp - 0x58e], 0x74
mov byte [ebp - 0x58d], 0x65
mov byte [ebp - 0x58c], 0x63
mov byte [ebp - 0x58b], 0x74
mov byte [ebp - 0x58a], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xe68], ecx
mov edx, dword [ebp - 0xe68]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe6c], eax
mov ecx, dword [ebp - 0xe6c]
mov dword [ebp - 0xb90], ecx
push ecx
call 0x582f3f
add byte [ecx + 0x3b], cl
cmp al, byte [ebx + 0x37]
inc ecx
add esp, 4
pop ecx
push ebx
call 0x582f54
add byte [ecx], bh
dec edi
dec eax
cmp dword [esi + eax*2 + 0x44], ecx
inc ebx
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
retf

Function at 0x582f54
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
add byte [eax], al
xor al, byte [esi + 0x3b]
cmp esi, dword [ebx]
cmp byte [ebx], dh
inc esp
xor eax, 0x8104c483
leave
mov eax, 0x590000ba
push eax
xor eax, 0x6c76
xor eax, 0x746b
pop eax
mov byte [ebp - 0x598], 0x56
mov byte [ebp - 0x597], 0x69
mov byte [ebp - 0x596], 0x72
mov byte [ebp - 0x595], 0x74
mov byte [ebp - 0x594], 0x75
mov byte [ebp - 0x593], 0x61
mov byte [ebp - 0x592], 0x6c
mov byte [ebp - 0x591], 0x50
mov byte [ebp - 0x590], 0x72
mov byte [ebp - 0x58f], 0x6f
mov byte [ebp - 0x58e], 0x74
mov byte [ebp - 0x58d], 0x65
mov byte [ebp - 0x58c], 0x63
mov byte [ebp - 0x58b], 0x74
mov byte [ebp - 0x58a], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xe68], ecx
mov edx, dword [ebp - 0xe68]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe6c], eax
mov ecx, dword [ebp - 0xe6c]
mov dword [ebp - 0xb90], ecx
push ecx
call 0x582f3f
add byte [ecx + 0x3b], cl
cmp al, byte [ebx + 0x37]
inc ecx
add esp, 4
pop ecx
push ebx
call 0x582f54
add byte [ecx], bh
dec edi
dec eax
cmp dword [esi + eax*2 + 0x44], ecx
inc ebx
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
retf
Function at 0x583ed4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
add ebx, 0x6451
add ebx, 0x830e
jmp 0x583e8a
pop ebx
push edi
sub edi, 0x7364
jmp 0x583e98
add edi, 0x169fe
sub edi, 0x31e8
pop edi
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x1c0], eax
push ecx
push ecx
add esp, 4
or ecx, 0x1e59
or ecx, 0x16706
pop ecx
push ebx
call 0x583ed4
add byte [ebp + 0x3a], cl
cmp al, 0x37
dec ebp
inc ebp
dec ebx
add esp, 4
jmp 0x583edf
jmp 0x583ee5
pop ebx
mov dword [ebp - 0x410], 0
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp - 0xc00], ecx
cmp dword [ebp - 0xc00], 0
jne 0x583f16
mov edx, dword [ebp - 0x410]
mov dword [ebp - 0x2ec], edx
jmp 0x584207
mov eax, dword [ebp - 0xc00]
mov ecx, dword [ebp - 0x1c0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc04], ecx
jne 0x583f3e
mov edx, dword [ebp - 0x410]
mov dword [ebp - 0x2ec], edx
jmp 0x584207
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0xc04]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc08], eax
cmp dword [ebp - 0xc08], 0
jne 0x583f70
mov ecx, dword [ebp - 0x410]
mov dword [ebp - 0x2ec], ecx
jmp 0x584207
mov edx, dword [ebp - 0x1c0]
add edx, dword [ebp - 0xc08]
mov dword [ebp - 0x404], edx
jne 0x583f95
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x2ec], eax
jmp 0x584207
mov ecx, dword [ebp - 0x404]
mov edx, dword [ebp - 0x1c0]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0xe98], edx
mov eax, dword [ebp - 0x404]
mov ecx, dword [ebp - 0x1c0]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0xe9c], ecx
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x1c0]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0xea0], eax
mov dword [ebp - 0x408], 0
jmp 0x583fef
Function at 0x29a09125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x29a09134
pop dword [ebp - 8]
mov eax, 0x81eadb0b
sub eax, 0x584a49d7
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x10c5639b
sub dword [ebp - 0x18], 0xc2731e50
mov dword [ebp - 0x14], 0x2271778b
add dword [ebp - 0x14], 0xfc1d4ba
mov dword [ebp - 0x10], 0x979cb14a
sub dword [ebp - 0x10], 0x4b506d1c
mov dword [ebp - 0xc], 0x8b989e14
sub dword [ebp - 0xc], 0x8b989e14
lea eax, [ebp - 0x18]
push eax
mov eax, 0x25618c99
add eax, 0x43fb3f3
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xcbe40dfd
sub dword [ebp - 0x18], 0x5771a4a7
mov dword [ebp - 0x14], 0xd5b3199d
sub dword [ebp - 0x14], 0x9446b828
mov dword [ebp - 0x10], 0x415a5f19
sub dword [ebp - 0x10], 0xddeaf2ad
mov dword [ebp - 0xc], 0x79c5aa49
add dword [ebp - 0xc], 0x863a55b7
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xcd5fb02a
sub eax, 0xa3be6fe6
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x38e7f
push 0
call eax
mov ecx, 0x62198b6
sub ecx, 0x6215623
mov edi, eax
mov esi, 0x9c6783f1
sub esi, 0x72c563f1
add esi, dword [ebp - 8]
mov ebx, 0x1b73e385
sub ebx, 0x22198ede
sub dword [ebp - 4], 0x5c6caa4c
mov edx, dword [esi]
sub dword [ebp - 4], 0x98dae156
xor edx, ebx
xor dword [ebp - 4], 0xb4f02c02
mov dword [edi], edx
mov dword [ebp - 4], 0x35e5e7c
add edi, 0xe453cc19
add edi, 0x1bac33eb
add esi, 4
loop 0x29a09256
add eax, 0xfd1f
mov ebx, eax
add eax, 0x747b2321
add eax, 0x8b84dce4
mov ecx, 0x32e73fd7
add ecx, 0xf6b8c029
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10001088
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x100010a9
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x100010a5
xor eax, eax
ret

Function at 0x100010b7
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x100010d8
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x100010d4
xor eax, eax
ret
Function at 0x10001af5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x420
mov eax, 0x1000b3e6
call fcn.1000a745
push 0x1000198b
call dword [sym.imp.MSVCR100.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS_____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS___]
xor ebx, ebx
pop ecx
mov dword [ebp - 0x42c], eax
mov dword [ebp - 4], ebx
cmp byte [0x10014fe2], bl
jne 0x10001c92
push 0x402
lea eax, [ebp - 0x418]
push ebx
push eax
mov byte [0x10014fe2], 1
call sub.MSVCR100.dll_memset
add esp, 0xc
push str.CLSID_
mov esi, 0x200
lea eax, [ebp - 0x418]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
push dword [0x100141a0]
lea eax, [ebp - 0x418]
push esi
push eax
call edi
add esp, 0xc
push str.Settings
lea eax, [ebp - 0x418]
push esi
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
xor esi, esi
inc esi
push esi
push ebx
lea eax, [ebp - 0x418]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10001c92
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push ebx
push str.bTracingEnabled
push dword [ebp - 0x420]
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x424], 4
mov dword [ebp - 0x428], ebx
call edi
cmp dword [ebp - 0x41c], ebx
push 0x28
setne al
mov byte [0x10014fe3], al
pop eax
push eax
mov dword [ebp - 0x428], esi
push ebx
mov esi, 0x10014b9c
push esi
mov dword [ebp - 0x424], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push esi
lea eax, [ebp - 0x428]
push eax
push ebx
push str.CoreDll
push dword [ebp - 0x420]
call edi
push str.PDFLShim.dll
push esi
call dword [sym.imp.MSVCR100.dll_wcscmp]
pop ecx
cmp eax, ebx
pop ecx
sete al
mov byte [0x10014fef], al
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push ebx
push str.dwKillBit
push dword [ebp - 0x420]
mov dword [0x1001412c], 3
mov dword [ebp - 0x41c], ebx
call edi
cmp dword [ebp - 0x41c], 1
push dword [ebp - 0x420]
sete al
mov byte [0x10014fee], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x42c]
call dword [sym.imp.MSVCR100.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS_____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS___]
pop ecx
call fcn.1000a7a1
ret

Function at 0x100025f7
Capabilities:
Create thread

Disassembly:
push 0x10014fe8
push 4
push 0
push 0x1000242a
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [0x10014fe4], eax
setne al
ret
Function at 0x1000261d
Capabilities:
Resume thread

Disassembly:
push 8
mov eax, 0x1000b431
call fcn.1000a6a6
mov esi, 0x10015024
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [0x10014fed], bl
jne 0x1000269a
push str.starting_PDFL_thread..._n
call fcn.10004bf1
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x10014ff0], eax
mov byte [0x10014fec], bl
cmp dword [0x10014fe4], ebx
jne 0x10002676
call fcn.100025f7
push dword [0x10014fe4]
call dword [sym.imp.kernel32.dll_ResumeThread]
push 0xea60
push dword [0x10014ff0]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov byte [0x10014fed], 1
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.1000a77e
ret

Function at 0x10004bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10004c00
pop dword [ebp - 0x38]
mov eax, 0xa9cbfeab
sub eax, 0x99cbb2ab
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x10695ee9
sub dword [ebp - 0x48], 0xc217199e
mov dword [ebp - 0x44], 0x77024e09
add dword [ebp - 0x44], 0xbb30fe3c
mov dword [ebp - 0x40], 0xea014ee7
sub dword [ebp - 0x40], 0x9db50ab9
mov dword [ebp - 0x3c], 0x830fcef
add dword [ebp - 0x3c], 0xf7cf0311
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x58d65958
sub dword [ebp - 0x48], 0xe463f002
mov dword [ebp - 0x44], 0x4839bbbf
sub dword [ebp - 0x44], 0x6cd5a4a
mov dword [ebp - 0x40], 0x37875b54
add dword [ebp - 0x40], 0x2be81118
mov dword [ebp - 0x3c], 0x1251cc7d
add dword [ebp - 0x3c], 0xedae3383
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x13019940
sub eax, 0x300c850
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3525a
push 0
call eax
mov ecx, 0x15ced3fe
sub ecx, 0x15ce9830
xor edi, edi
add edi, eax
mov ebx, 0x10019c00
add ebx, dword [ebp - 0x38]
mov esi, 0x35229319
add esi, 0x5083c7db
mov edx, dword [ebx]
add dword [ebp - 0x2c], eax
xor edx, esi
add dword [ebp - 0x24], edi
mov dword [edi], edx
sub dword [ebp - 0x14], 0x6d3599df
add edi, 0xe0a5beb4
sub edi, 0xe0a5beb0
add ebx, 0x18cf6ed9
sub ebx, 0x18cf6ed5
loop 0x10004d19
add eax, 0xe564b1e
sub eax, 0xe556913
mov ebx, eax
add eax, 0xbb0d122b
sub eax, 0xbb0d1226
mov ecx, 0xbc8430d
add ecx, 0x437bcf3
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10009a58
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1000b983
call fcn.1000a745
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call fcn.10006ab2
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x10009ab0
call fcn.10004252
mov esi, eax
jmp 0x10009b86
push ebx
push edi
push eax
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10009ac9
call fcn.10004252
jmp 0x10009b78
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x10009abf
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x10009b03
mov esi, 0x8007000e
jmp 0x10009b7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10004bf1
mov dword [ebp - 4], 1
jmp 0x10009b31
cmp dword [ebp - 0x418], esi
je 0x10009afc
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x10009abf
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.10004bf1
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10009b9f
lea ecx, [ebp - 0x418]
call fcn.100061ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10004520
mov eax, esi
call fcn.1000a7a1
ret 0x10
Function at 0x1000a61a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014704]
jne 0x1000a624
repz ret
jmp fcn.1000ae86
Function at 0x100226f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10022702
pop dword [ebp - 0x38]
mov eax, 0x704722f6
add eax, 0x9fbb040c
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd31c691b
sub dword [ebp - 0x48], 0x84ca23d0
mov dword [ebp - 0x44], 0x7a582a38
add dword [ebp - 0x44], 0xb7db220d
mov dword [ebp - 0x40], 0xe7d37571
sub dword [ebp - 0x40], 0x9b873143
mov dword [ebp - 0x3c], 0x28007f31
sub dword [ebp - 0x3c], 0x28007f31
lea eax, [ebp - 0x48]
push eax
mov eax, 0xdafcedd
sub eax, 0xfdafbdc1
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x124830f3
add dword [ebp - 0x48], 0x622a3863
mov dword [ebp - 0x44], 0xe2c42261
sub dword [ebp - 0x44], 0xa157c0ec
mov dword [ebp - 0x40], 0x23702178
add dword [ebp - 0x40], 0x3fff4af4
mov dword [ebp - 0x3c], 0x1bb1b8fd
sub dword [ebp - 0x3c], 0x1bb1b8fd
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x16a4a94d
sub eax, 0x6a4984d
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c479
push 0
call eax
mov ecx, 0xb33ccb16
add ecx, 0x4cc36e08
mov esi, eax
mov edi, 0x9c51f878
sub edi, 0x8c4e8e78
add edi, dword [ebp - 0x38]
mov edx, 0xf785ecbe
sub edx, 0x6cbbd298
add dword [ebp - 0x24], edi
mov ebx, dword [edi]
add dword [ebp - 0xc], 0xfd0e66e2
add ebx, edx
xor dword [ebp - 0x20], eax
mov dword [esi], ebx
xor dword [ebp - 8], edi
add esi, 4
add edi, 0x3355e23e
add edi, 0xccaa1dc6
loop 0x10022824
add eax, 0x2efd71b5
add eax, 0xd1036596
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1002e08f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100075dc]
jne 0x1002e6f5
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10032ca0], eax
mov dword [0x10032c9c], ecx
mov dword [0x10032c98], edx
mov dword [0x10032c94], ebx
mov dword [0x10032c90], esi
mov dword [0x10032c8c], edi
mov word [0x10032cb8], ss
mov word [0x10032cac], cs
mov word [0x10032c88], ds
mov word [0x10032c84], es
mov word [0x10032c80], fs
mov word [0x10032c7c], gs
pushfd
pop dword [0x10032cb0]
mov eax, dword [ebp]
mov dword [0x10032ca4], eax
mov eax, dword [ebp + 4]
mov dword [0x10032ca8], eax
lea eax, [ebp + 8]
mov dword [0x10032cb4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10032bf0], 0x10001
mov eax, dword [0x10032ca8]
mov dword [0x10032ba4], eax
mov dword [0x10032b98], 0xc0000409
mov dword [0x10032b9c], 1
mov eax, dword [0x100075dc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10032ad8]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10032be8], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100075ec
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10032be8], 0
jne 0x1002e7e1
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.2580ff2d
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.2580ff2d
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.2580ff2d
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.2580ff2d
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.2580ff2d
pop ecx
jmp 0x258071e5
Function at 0x2580ff2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2580ff3c
pop dword [ebp - 0x50]
mov eax, 0xaa150894
add eax, 0x7b6bf6a8
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x5ed234c2
add dword [ebp - 0x60], 0xef801089
mov dword [ebp - 0x5c], 0xaa554ad7
sub dword [ebp - 0x5c], 0x7821fe92
mov dword [ebp - 0x58], 0x332e1632
sub dword [ebp - 0x58], 0xe6e1d204
mov dword [ebp - 0x54], 0x749bfb5e
add dword [ebp - 0x54], 0x8b6404a2
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x9dd67bbc
sub dword [ebp - 0x60], 0x29641266
mov dword [ebp - 0x5c], 0x67fe2214
sub dword [ebp - 0x5c], 0x2691c09f
mov dword [ebp - 0x58], 0x9827ffe6
sub dword [ebp - 0x58], 0x34b8937a
mov dword [ebp - 0x54], 0x80ad985a
add dword [ebp - 0x54], 0x7f5267a6
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x798c86e5
add eax, 0xabf5499b
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x41430
push 0
call eax
mov ecx, 0x5ad2
xor ebx, ebx
add ebx, eax
mov edx, 0x25829600
add edx, dword [ebp - 0x50]
mov edi, 0xcc747f07
sub edi, 0x593149f3
xor dword [ebp - 0x34], 0xacf8bbe9
mov esi, dword [edx]
mov dword [ebp - 0xc], 0x7964b47b
add esi, edi
sub dword [ebp - 0x28], edi
mov dword [ebx], esi
mov dword [ebp - 0x44], 0xa98a699
add ebx, 0x8f2e33fa
sub ebx, 0x8f2e33f6
add edx, 4
loop 0x2581004f
add eax, 0x15e1b
mov ebx, eax
add eax, 5
mov ecx, 0xc6be11d9
sub ecx, 0xa13e11d9
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x100100e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10040d67
call fcn.1004053e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10010145
call fcn.1000d37a
mov esi, eax
jmp 0x10010228
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10010163
call fcn.1000d37a
jmp 0x1001021f
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10010159
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x10010196
mov esi, 0x8007000e
jmp 0x10010221
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.100374e1
mov dword [ebp - 4], 1
jmp 0x100101d5
cmp dword [ebp - 0x418], 0
je 0x1001018c
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10010159
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.100374e1
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10010241
lea ecx, [ebp - 0x418]
call fcn.10010357
lea ecx, [ebp - 0x420]
call fcn.1000d2ec
mov eax, esi
call fcn.10040597
ret 0x10