joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001277a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10012789
pop dword [ebp - 8]
mov eax, 0x5cd6b500
sub eax, 0x4cd58d77
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2d3e02a3
add dword [ebp - 0x18], 0x211442a8
mov dword [ebp - 0x14], 0x597f8795
add dword [ebp - 0x14], 0xd8b3c4b0
mov dword [ebp - 0x10], 0x5b9840f5
sub dword [ebp - 0x10], 0xf4bfcc7
mov dword [ebp - 0xc], 0x1e35efe9
sub dword [ebp - 0xc], 0x1e35efe9
lea eax, [ebp - 0x18]
push eax
mov eax, 0x7ae136f5
sub eax, 0x6adee671
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd2cb0782
sub dword [ebp - 0x18], 0x5e589e2c
mov dword [ebp - 0x14], 0xa46a4878
sub dword [ebp - 0x14], 0x62fde703
mov dword [ebp - 0x10], 0x77ced8f4
sub dword [ebp - 0x10], 0x145f6c88
mov dword [ebp - 0xc], 0xeaf45e2
sub dword [ebp - 0xc], 0xeaf45e2
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x5bf8e765
add eax, 0xb4096917
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x36fde
push 0
call eax
mov ecx, 0x5fef50b5
sub ecx, 0x5fef1a64
xor ebx, ebx
add ebx, eax
mov esi, 0x93092cd7
sub esi, 0x830620d7
add esi, dword [ebp - 8]
mov edi, 0x6019456e
sub edi, 0xd806230d
xor dword [ebp - 4], ecx
mov edx, dword [esi]
add dword [ebp - 4], 0x4e0fd816
add edx, edi
xor dword [ebp - 4], 0xd79c13d7
mov dword [ebx], edx
sub dword [ebp - 4], 0xdcb45349
add ebx, 0xa901b7a5
add ebx, 0x56fe485f
add esi, 0xb56a512e
add esi, 0x4a95aed6
loop 0x100128ad
add eax, 0x72d3b4c5
add eax, 0x8d2d1752
xor ebx, ebx
add ebx, eax
add eax, 0x7889f0b9
sub eax, 0x7889f0b4
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001277a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001277a
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001277a
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1001277a
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10

Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001277a
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000144f
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001ef41
call fcn.10005d18
sub esp, 0x438
push ebx
push edi
sub esp, 0x18
mov dword [ebp - 4], 2
mov ecx, esp
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.10001c57
call fcn.10001419
add esp, 0x18
test al, al
je 0x10001567
push 0xf
pop edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], bl
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10001831
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.10001cf5
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
lea ecx, [ebp + 0x38]
cmovae edx, dword [ebp - 0x2c]
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x4c], 0x10
push edx
cmovae ecx, dword [ebp + 0x38]
lea edx, [ebp - 0x444]
cmp dword [ebp + 0x34], 0x10
push 0x400
cmovae eax, dword [ebp + 0x20]
push edx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10001525
lea eax, [ebp - 0x444]
push eax
push str.true
call fcn.1000a6c3
pop ecx
pop ecx
test eax, eax
je 0x10001523
lea eax, [ebp - 0x444]
push eax
push str.TRUE
call fcn.1000a6c3
pop ecx
pop ecx
test eax, eax
jne 0x10001525
mov bl, 1
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x1000155c
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x10001553
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10001c04
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.10005d09
pop ecx
pop ecx
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x2c], 0
lea ecx, [ebp + 8]
call fcn.10001cf5
lea ecx, [ebp + 0x20]
call fcn.10001cf5
lea ecx, [ebp + 0x38]
call fcn.10001cf5
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1000158f
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001ef7a
call fcn.10005d18
sub esp, 0xa0
push ebx
push esi
push edi
sub esp, 0x18
mov dword [ebp - 4], 2
mov ecx, esp
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.10001c57
call fcn.10001419
add esp, 0x18
test al, al
jne 0x100015d3
and dword [ebp - 0x10], ebx
jmp 0x100016fe
push 0xf
pop edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x30], bl
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10001831
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10001cf5
push 0x10
pop esi
cmp dword [ebp - 0x1c], esi
lea edx, [ebp - 0x30]
lea ecx, [ebp + 0x38]
cmovae edx, dword [ebp - 0x30]
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x4c], esi
push edx
cmovae ecx, dword [ebp + 0x38]
lea edx, [ebp - 0xac]
cmp dword [ebp + 0x34], esi
push 0x64
cmovae eax, dword [ebp + 0x20]
push edx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x100016bb
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x48], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000164d
sub ecx, edx
lea eax, [ebp - 0xac]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10001d71
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push ebx
push eax
call fcn.10001dba
mov eax, dword [ebp - 0x34]
pop ecx
fstp dword [ebp - 0x18]
pop ecx
cmp eax, esi
jb 0x100016af
mov ecx, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x100016a6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001c04
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.10005d09
pop ecx
pop ecx
movss xmm0, dword [ebp - 0x18]
movss dword [ebp - 0x10], xmm0
jmp 0x100016bf
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jb 0x100016f5
mov ecx, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x100016ec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10001c04
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.10005d09
pop ecx
pop ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x30], bl
lea ecx, [ebp + 8]
call fcn.10001cf5
lea ecx, [ebp + 0x20]
call fcn.10001cf5
lea ecx, [ebp + 0x38]
call fcn.10001cf5
fld dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10001728
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001ef41
call fcn.10005d18
sub esp, 0x38
push ebx
push esi
sub esp, 0x18
mov dword [ebp - 4], 2
mov ecx, esp
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.10001c57
call fcn.10001419
add esp, 0x18
test al, al
jne 0x1000176a
mov esi, 0x80000000
jmp 0x10001809
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10001831
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.10001cf5
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
lea ecx, [ebp + 0x38]
cmovae edx, dword [ebp - 0x2c]
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x4c], 0x10
push edx
cmovae ecx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0x10
push ebx
cmovae eax, dword [ebp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x18]
mov esi, eax
cmp ecx, 0x10
jb 0x100017fc
mov edx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
cmp ecx, 0x1000
jb 0x100017f3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001c04
mov edx, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push ecx
push edx
call fcn.10005d09
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
lea ecx, [ebp + 8]
call fcn.10001cf5
lea ecx, [ebp + 0x20]
call fcn.10001cf5
lea ecx, [ebp + 0x38]
call fcn.10001cf5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x10001831
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
lea eax, [ebp - 0x11c]
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [ebp - 0x11c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10001855
mov ax, word [0x100202a8]
push dword [ebp + 0x10]
mov word [edi], ax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000105f
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push eax
call fcn.10001360
lea ecx, [ebp - 0x18]
call fcn.10001cf5
mov esi, dword [ebp + 8]
mov ecx, esi
push dword [ebp + 0xc]
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
call fcn.10001c57
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x10005ace
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret
Function at 0x959920
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [ecx]
mov cl, bh
jae 0x95991f
add byte [edi - 0x2b], al
or byte [edi + 0x2d], ah
mov dword [0x17fdd9ab], eax
pop esi
pushal
into
mov esp, esp
pop ebx
invalid
mov eax, 0xa948934c
jne 0x9598a7
and edi, dword [edi + 0x4da34ac5]
mov fs, word [edi + 6]
imul byte [esi]
pop ss
int1
test byte [ebp + 0x2fe82010], bl
in eax, 0xac
out 0x4e, al
lodsb al, byte [esi]
xchg esi, eax
pop edx
cmp byte [eax - 0x2f], dl
inc byte [ebx]
add eax, 0x6c8b1777
invalid
lahf
and dword [ebp + 0x36], edi
jge 0x959958
jno 0x9598d8
test byte [edi + 0x52b9bc3], dh
enter 0x684a, 0xffffffffffffffde
xor byte [ecx - 0x7b], 0x65
das
ret
dec ebx
sub ebx, dword [ecx]
lahf
aam 0x36
jecxz 0x9599b6
push eax
inc ebp
adc al, 0xb3
and byte [ecx - 0x76], bh
sbb byte [ecx], dh
invalid
adc edi, 0x2a24758c
outsd dx, dword [esi]
jne 0x9599cd
insd dword es:[edi], dx
clc
mov al, byte [0xc550ea31]
mov dh, 0x5c
pop esp
leave
loope 0x95994a
dec esi
jb 0x9599d0
aaa
xchg ebp, eax
mov bh, 0xba
jo 0x95991e
jecxz 0x959943
xor eax, 0x31d2e2d0
sbb al, 0xa4
mov byte [0xf290ddde], al
add byte [ebx], cl
inc ebx
mov esi, 0xe2f5322b
pop edi
outsd dx, dword [esi]
scasd eax, dword es:[edi]
in al, dx
aad 0x36
inc edi
fcomp dword [eax + 0x36]
mov byte [edx], 0xc3
mov byte ss:[edx], 0xc3
xlatb
test al, 0xa6
sbb al, byte [ebp*2 - 0x4635ba5b]
wait
test al, 0x32
mov byte [0x58e787fa], al
sub byte [ebx*8 - 0x3f8ad8b6], 0xbf
jbe 0x959979
fisttp qword [edx + 0x27]
jne 0x959973
mov edi, 0xcff5c376
imul esi, dword [edx - 0x5f], 0x73fcc5f4
pop esp
lodsd eax, dword [esi]
int 0x3f
xchg edi, eax
sahf
add eax, dword [ebx]
adc al, 0x30
cmp dh, byte [0x1cdcd320]
scasd eax, dword es:[edi]
cmc
iretd
fcomp qword [esi + ebp]
scasd eax, dword es:[edi]
js 0x9599ae
sub al, 0x41
clc
wait
cwde
jno 0x959996
out 0x31, eax
inc edi
into
aaa
or edi, edx
in al, 0x6c
aas
nop
arpl word [ebp - 0x82d6662], cx
cli
fst dword [ebx - 0x74ae9ddf]
jmp 0x959a53
and al, 0x32
inc ebp
shl byte [edx + 0x64a95ad0], 0x47
adc ah, byte [ebp + 0x7f]
int1
inc esp
loop 0x959ae3
xchg ecx, eax
adc edi, dword [ecx]
add eax, dword [edi - 0x25]
jmp 0x959a75
xchg dword [ebp - 0x5ede2ef], edi
dec esi
popfd
test al, 0xb7
adc esp, ebp
add eax, 0x7ce92c51
sbb al, cl
mov edi, 0xef652951
and ch, dl
sub dword [esi + 0x5a], eax
cdq
dec edi
bound ebp, qword [ebp + 0x383c0a3]
cmp byte [edx + ecx*2 + 0x3e38f6e8], bh
mov byte es:[0x7904c06b], al
lodsd eax, dword [esi]
xchg byte [edx - 0x388a2cde], ch
mov cl, byte [ebx - 0x3a]
shr byte [eax - 0x2e], cl
push cs
sti
pop ss
imul eax, dword [0xf41fefca], 0xffffff8e
and esp, dword [edi + 0x29]
push esp
invalid
sub dword [si - 0x73], edx
hlt
push esp
adc eax, 0xff6c761f
int 0x4f
imul ebp, dword [ecx + eax*4 + 0x5601524c], 0xffffffb1
fcomp qword [edx - 0x348160d]
lcall 0x2703, 0x5d2e5b32
push esi
inc eax
adc al, 0xee
sbb dword [ebx], 0x53ac15b1
mov esi, 0xcdd8e711
aas
test al, 0x41
dec edx
mov bh, 0xfe
jp 0x959ac0
invalid
Function at 0x430953
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4368a0
call fcn.004315d8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x438d38
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x430998
cmp eax, esi
jne 0x43098b
xor esi, esi
inc esi
mov edi, esi
jmp 0x43099b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43096f
xor esi, esi
inc esi
cmp dword [0x438d3c], esi
jne 0x4309ad
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4309e7
cmp dword [0x438d3c], ebx
jne 0x4309e1
mov dword [0x438d3c], esi
push 0x40102c
push 0x401020
call fcn.00430acc
pop ecx
pop ecx
test eax, eax
je 0x4309e7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x430abc
mov dword [0x438224], esi
cmp dword [0x438d3c], esi
jne 0x430a0a
push 0x40101c
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x438d3c], 2
test edi, edi
jne 0x430a17
xor eax, eax
mov ecx, 0x438d38
xchg dword [ecx], eax
cmp dword [0x438d48], 0
je 0x430a43
push 0x438d48
call fcn.00431430
pop ecx
test eax, eax
je 0x430a43
push ebx
push 2
push ebx
mov esi, dword [0x438d48]
mov ecx, esi
call dword [0x4392d8]
call esi
push dword [0x438230]
push dword [0x43822c]
push dword [0x438228]
call fcn.004173e3
add esp, 0xc
mov dword [0x438220], eax
cmp dword [0x438238], 0
jne 0x430aa1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x438224], 0
jne 0x430ab5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x438220]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.004cc000
jmp 0x430953

Function at 0x431314
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x436998
call fcn.004315d8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x431374
cmp eax, 0xffffffff
je 0x431374
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x43136d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x43136d
cmp edx, 0x10000000
jae 0x43136d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x43136a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4313e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x43141e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x431416
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x431420
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x431406
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001650c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001651b
pop dword [ebp - 0xc]
mov eax, 0x52d1f34
add eax, 0xad445e7
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x1dad4750
sub dword [ebp - 0x1c], 0xcf5b0205
mov dword [ebp - 0x18], 0xc98e1b50
sub dword [ebp - 0x18], 0x975acf0b
mov dword [ebp - 0x14], 0xd4cbbf44
sub dword [ebp - 0x14], 0x887f7b16
mov dword [ebp - 0x10], 0x767123bd
add dword [ebp - 0x10], 0x898edc43
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x8f0e868d
add dword [ebp - 0x1c], 0xe563e2c9
mov dword [ebp - 0x18], 0x1bb20c56
add dword [ebp - 0x18], 0x25ba551f
mov dword [ebp - 0x14], 0xcba44a4f
add dword [ebp - 0x14], 0x97cb221d
mov dword [ebp - 0x10], 0x1958121f
sub dword [ebp - 0x10], 0x1958121f
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x32156f88
add eax, 0xddec80bc
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d46d
push 0
call eax
mov ecx, 0xcd23b919
sub ecx, 0xcd236023
xor ebx, ebx
add ebx, eax
mov edx, 0x15f5fbba
sub edx, 0x5f309ba
add edx, dword [ebp - 0xc]
mov edi, 0x37d99604
add edi, 0x34e154b
mov esi, dword [edx]
xor esi, edi
add dword [ebp - 8], ebx
mov dword [ebx], esi
xor dword [ebp - 4], 0xd9f23c4f
add ebx, 0x6932105c
add ebx, 0x96cdefa8
add edx, 0xcf77d191
add edx, 0x30882e73
loop 0x1001663a
add eax, 0x156ab
xor ebx, ebx
add ebx, eax
add eax, 0xfbcdac1d
add eax, 0x43253e8
mov ecx, 0x71276f36
add ecx, 0x9ed890ca
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.1001650c
pop ecx
pop edi
pop esi
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x430660
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4ae0cb
mov eax, dword fs:[0]
push eax
mov eax, 0x1cac
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x1ca8], eax
push ebx
push esi
push edi
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0x1cbc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1cd0]
mov edi, dword [esp + 0x1ccc]
push esi
push edi
call fcn.0044d8f0
test al, al
je 0x430730
lea ecx, [esp + 0x10]
call fcn.00432d00
mov dword [esp + 0x1cc4], 0
push edi
lea ecx, [esp + 0x14]
call fcn.00432d40
push esi
lea ecx, [esp + 0x14]
call fcn.00432d90
lea ecx, [esp + 0x182c]
call fcn.004680a0
lea ecx, [esp + 0x1850]
call fcn.004680a0
lea ecx, [esp + 0x1874]
call fcn.004680a0
push 0
lea eax, [esp + 0xc1c]
push eax
lea ecx, [esp + 0x18]
call fcn.004331a0
mov bl, al
mov dword [esp + 0x1cc4], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00432d20
mov al, 1
jmp 0x430759
call fcn.0043ca60
test eax, eax
je 0x43074c
test esi, esi
je 0x43074c
cmp word [esi], 0
je 0x43074c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x430753
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
mov ecx, dword [esp + 0x1cbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1ca8]
xor ecx, esp
call fcn.0049dea6
add esp, 0x1cb8
ret 8

Function at 0x430790
Capabilities:
Set file attributes

Disassembly:
call fcn.0043ca60
test eax, eax
je 0x4307b9
mov eax, dword [esp + 8]
test eax, eax
je 0x4307b9
cmp word [eax], 0
je 0x4307b9
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [esp + 8], 0
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]