joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10098bd
Capabilities:
Encode data using xor

Disassembly:
setg byte [esp + edx - 0x3303b788]
mov dword [ebp + edx*2 - 0x66076f14], ecx
mov edx, dword [edx + ebp - 0x3303b78c]
mov eax, dword [ebp]
inc dword [esp]
mov ecx, 0x98a0feb2
inc cl
mov ecx, dword [ebp + 4]
div ecx
inc byte [esp + 3]
shr byte [esp], 0x67
mov dword [ebp], edx
je 0xfdf680
jno 0xf7225a
mov bl, 0xc1
sub edx, esp
inc esi
je 0xf722cc
inc esp
adc ebx, edi
sub ebx, esp
adc dword [esi - 0x75], esp
mov cx, word [ebp]
mov ax, word [ebp + 2]
pop edx
mov edx, 0xb199e883
shr dl, 0xc5
adc cx, ax
invalid
invalid
xor ebx, edx
add edi, edx
movsx edx, ax
ror cl, 3
and ax, cx
mov dx, word [ebp + ecx*2 - 0x104]
mov cl, byte [ecx + ebp - 0x7f]
sal dx, cl
shl al, 0x43
mov word [ebp + eax - 0x716c0004], dx
lea ebp, [eax + ebp - 0x716c0004]
jmp edi
mov dword [esp + edx - 0x23a9d722], 0x65b1a806
xadd ecx, edx
mov ecx, dword [eax + edx - 0x3303b788]
jg 0xf72214

Function at 0x1009b8a
Capabilities:
Encode data using xor

Disassembly:
ror al, 0xa1
mov ecx, dword [eax + esi - 0x3116bf15]
mov edx, eax
xor ecx, ebx
inc ecx
rol eax, 0xb3
neg ecx
ror edx, 0x35
not ecx
inc ecx
ror ecx, 3
bswap ecx
sub ecx, 0x1d3f6d81
dec dx
xor ebx, ecx
add edi, ecx
lea edx, [eax*2 - 0x37426be0]
shr al, 0x23
push edx
mov eax, dword [ebp]
movzx ecx, byte [esp]
mov ecx, dword [ecx + ebp - 0x86]
dec edx
xor edx, 0xe40cfe9e
lea ebp, [ebp + edx - 0x5e1c5b0f]
mov dword es:[eax + edx - 0x5e1c5b17], ecx
inc dword [esp + edx - 0x5e1c5b17]
mov ecx, 0x108a8c39
mov eax, dword [esp + edx - 0x5e1c5b17]
mov dword [esp + ecx*2 - 0x21151872], edi
ret
inc edi
mov eax, dword [ebx + eax*4]
shr ecx, 8
call fcn.00ef91ca
mov ecx, 0x8412c838
mov eax, 0x3116bf2a
lea esi, [eax + esi - 0x3116bf2e]
shl cx, 0x48
jns 0xeda709
xor dl, dl
inc eax
jmp 0xe2c20278
push ecx
loop 0x1009ba2
sub byte [edx + 0x7068f8b1], bl
sub al, 0x9a
mov eax, dword [0x2c704860]
lcall 0x9a2c, 0x7058c081
lcall 0x9a2c, 0x704860a1
add eax, 0x9a2c7058
xchg ecx, eax
push edx
xor ecx, dword [ebx - 9]
loop 0x1009bbb
mov byte [0x537b7d17], al
pop ss
xor al, 0
xor byte [edi + 0x71], ah
or al, 0x1d
mov edx, 0xc0c1967b
in eax, 0x73
mov dword [ecx - 0x22], eax
enter 0xffffffffffffb44f, 0x58
and eax, 0x4314770f
mov eax, 0x4d387084
stosb byte es:[edi], al
inc edi
into
sub byte [0x80e3274b], 0x1f
adc dh, ah
sub edi, dword [edi - 0x1b]
lcall 0xb22d, 0xee914c27
mov esp, eax
retf 0x5fe2

Function at 0x192d423
Capabilities:
Encode data using xor

Disassembly:
xor ebx, edx
add cx, cx
shr cx, 0xce
add edi, edx
lea eax, [eax*4 + 0x629965a9]
mov bp, word [ecx + ebp - 0x3ce70001]
mov dword [esp + ecx - 0x3ce70001], 0x743fe526
call fcn.00ed463a
jae fcn.0192d45b
cmpsb byte [esi], byte es:[edi]
loopne 0x192d47b
out 0x78, al
bound edx, qword [edx + 0x50]
aaa
into
or eax, 0xba35668e
xor ax, 0x13ba
inc ecx
sal edx, cl
inc ax
mov ebp, 0xe8334466
Function at 0x192d5b8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x393a83bc
mov dword [esp + ecx - 0x393a83bc], ecx
movzx edx, cl
mov word [ebp + ecx*2 - 0x72750778], ax
call fcn.019a9f26
inc ecx
xor ebx, ebp
neg ebx
bswap ebx
dec ecx
ror ecx, 0xed
inc ecx
div ebx
lea ebx, [ebx + eax*2 - 0x323e3929]
inc cx
bt eax, ebp
jb 0xffe0ed
dec word [esp + eax*8 - 7]
not ebx
dec esp
mov dword [esp + eax*2 - 2], ebp
xor dl, al
or cx, ax
cdq
xor dword [esp + eax*2 - 2], ebx
dec ebp
xadd edi, eax
inc esp
movsx edx, dx
idiv eax
inc ecx
pop ebp
dec eax
cdq
dec eax
arpl bx, bx
dec eax
add edi, ebx
mul ax
dec eax
and edx, ebp
dec eax
mov ebx, dword [esi + eax*8 - 0x10]
sbb edx, ebp
inc esp
xadd ebp, ebx
dec ebp
bt ecx, edi
dec esp
adc ebx, dword [esi + eax*4 - 4]
dec ecx
add ebx, ebx
inc ecx
rol ecx, cl
inc eax
sar ch, cl
dec ebp
adc ecx, edi
dec eax
mov dword [eax + esi - 1], ebx
dec esp
or ecx, edi
inc ecx
jmp ecx
inc byte [esp + ecx*2 - 0x1862384e]
movzx eax, cx
mov dword [esp + ecx - 0xc311c27], edi
ret 0xc
btc ecx, ecx
mov eax, dword [ebp + 4]
mov dword [esp], ecx
setae cl
jb 0xf71b48
mov ecx, dword [ebp + 8]
push 0xa2aa99ab
adc ebp, 4
ror dword [esp + 1], 0x85
jae 0xef28da
call fcn.00fd265a

Function at 0x1933bc1
Capabilities:
Encode data using xor

Disassembly:
push ss
add eax, dword [eax]
mov ecx, 0x1a150804
movzx ax, byte [ebp + ecx*4 - 0x68542010]
call fcn.0193db29
push 0x6600009f
mov dword [esp + 0x12], 0xc141aa05
and al, 0x10
xchg esp, eax
mov word [esp + 0x12], 0xaa05
inc ecx
shl dword [esp + 0x10], 0x94
call fcn.00fc4ba9
punpckhwd mm7, mm7
dec ebp
mov al, 0xc3
push 0x7d
pop esp
fcomp dword [ebp + 0x5c67d02d]
in al, dx
lds eax, [0xcc5c67d0]
xor dword [ecx - 0x30], eax
pop esp
add ah, 0xac
out dx, eax
jnp 0x1933bbd
les ebx, [ebx]
add byte [esi + 0x5b090dd1], bh
mov eax, dword [0x7c6cd70a]
lodsb al, byte [esi]
push eax
push edi
mov ebx, 0x1530adb1
and eax, 0xfb104047
jo 0x1933bab
inc edx
jecxz 0x1933bd0
outsd dx, dword [esi]
add ch, ah
out 0xe0, al
mov al, byte [0xa1900c78]
cmpsb byte [esi], byte es:[edi]
cmp ecx, dword [ebp + 0x5a]
dec ebx
cmp al, 0x4c
salc
sahf
int3

Function at 0x1959af8
Capabilities:
Encode data using xor

Disassembly:
rol cl, 1
mov dword [esp + edx*2 - 0x200028], 0xe9b84921
neg word [esp + edx - 0x100014]
not cl
setle dl
xor edx, dword [esp + edx*4 - 0x400004]
rol byte [esp + eax - 0x500012], 0x65
neg cl
sub cl, 0x27
sal eax, 0x23
rol edx, 0x6c
not cl
sar byte [esp + eax - 0x28000a0], 0x46
rol eax, 1
mov esp, 0x7fff6004
std
inc esi
rol edx, 7
inc cl
mul dword [esp + eax*8 - 0x14000500]
not cl
ror al, 0xe1
push eax
sbb cl, 0x83
push edx
mul dl
neg eax
xor bl, cl
call fcn.0197cf7c
adc ch, byte [edi]
fsubr st(4), st(0)
inc ebx
jo 0x1959b2d
invalid
Function at 0x10027ae
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push dword [0x100cb04]
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
cmp dword [0x100c7d8], eax
mov edi, dword [esp + 0x30]
je 0x10027dd
push dword [0x100cbd8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10027f6
push 0x100c7d0
push eax
push edi
push 0x1002df8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100c7d8], eax
push 0x100a020
push dword [0x100cbc8]
push 0x100cc60
push dword [0x100a028]
call fcn.01004365
push dword [0x100cc54]
mov dword [0x100cbc8], eax
push eax
call fcn.01003a26
push dword [0x100cc0c]
mov dword [0x100ccec], eax
push dword [0x100cbc8]
call fcn.01003a26
push edi
mov dword [0x100cb6c], eax
call fcn.01002914
push edi
call fcn.010029ae
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebp, 0x20a
push 1
mov ebx, 0x200
push ebp
push ebx
lea eax, [esp + 0x1c]
push edi
push eax
call esi
test eax, eax
push 1
je 0x1002875
push ebp
push ebx
lea eax, [esp + 0x1c]
push edi
push eax
jmp 0x1002863
mov ebp, 0x108
mov ebx, 0x100
push ebp
push ebx
lea eax, [esp + 0x1c]
push edi
push eax
call esi
test eax, eax
je 0x1002892
push 1
push ebp
jmp 0x1002880
push dword [0x100cb00]
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x1002c03
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x6b
push dword [ebp + 8]
call fcn.01003015
push eax
push dword [0x100ccec]
call fcn.01004933
push dword [0x100cbb8]
mov esi, eax
push dword [0x100ccec]
call fcn.010049b2
test eax, eax
je 0x1002cce
push eax
push esi
call fcn.010049e5
mov ebx, dword [eax]
push ebx
push esi
call fcn.0100498a
push eax
lea eax, [ebp - 0x64]
push 0x10013fc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 0x10013d8
lea eax, [ebp - 0x64]
push 0x11
push edi
push eax
push dword [ebp + 8]
call esi
cmp eax, 1
jne 0x1002ce3
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x1002c9f
push 0x30
push edi
push 0x1001370
push dword [ebp + 8]
call esi
jmp 0x1002ce3
push 0x63
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1002cc2
push 0x30
push edi
push 0x100132c
push dword [ebp + 8]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002ce3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x1002ce5
push 0x30
push 0x10013d8
push 0x1001254
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1003729
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a028]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
mov edi, 0x80000004
cmp eax, edi
mov dword [ebp - 4], 0x12
je 0x1003750
push eax
call ebx
mov eax, dword [0x100a02c]
mov esi, 0x80000002
cmp eax, esi
je 0x1003761
push eax
call ebx
lea eax, [ebp - 4]
mov dword [0x100a028], edi
push eax
lea eax, [ebp - 0x28]
push eax
mov dword [0x100a02c], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp word [ebp - 0x28], 0x5c
jne 0x10037a5
cmp word [ebp - 0x26], 0x5c
jne 0x10037a5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x28]
mov esi, 0x100cb80
push eax
push esi
call edi
push esi
push 0x100cc20
call edi
jmp 0x10037c9
lea eax, [ebp - 0x28]
mov esi, 0x100cb80
push eax
push 0x1001d8c
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
push 0x100cc20
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004a03
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp dword [esi], 0
jne 0x1004a21
push dword [edi]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
mov ebx, 0xea
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push dword [esi]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x1004a64
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add dword [edi], 0x400
push dword [edi]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
cmp dword [esi], 0
je 0x1004a72
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jne 0x1004a7d
jmp 0x1004a26
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 8
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1004ab4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0x1002008
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call edi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1004bbf
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
mov dword [ebp - 8], 4
push eax
push ebx
push 0x1001fec
push dword [ebp - 0xc]
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1004bbf
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x1001fdc
push dword [ebp - 0xc]
call esi
cmp eax, ebx
je 0x1004b61
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0x1001fc8
push eax
push 0x20019
push ebx
push 0x1001f54
push dword [ebp + 8]
call edi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1004bbf
jmp 0x1004b6e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x1001f3c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1004bbf
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [ebp + 0x10]
cmp eax, ebx
mov dword [edi], eax
je 0x1004bb8
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
lea eax, [eax*4 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x14]
cmp eax, ebx
mov dword [ecx], eax
jne 0x1004c0b
mov dword [ebp - 4], 8
cmp dword [ebp - 4], ebx
je 0x1004be2
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [eax]
cmp eax, ebx
je 0x1004bd6
push eax
call esi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x1004be2
push eax
call esi
cmp dword [ebp - 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1004bf2
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x1004c01
cmp eax, dword [ebp + 0xc]
je 0x1004c01
push eax
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push dword [edi]
push eax
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1004bbf
mov esi, dword [edi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1004bbf
push esi
call fcn.01004a84
mov ecx, dword [ebp + 8]
lea esi, [esi + ecx*2 + 2]
mov ecx, dword [ebp + 0x18]
cmp eax, dword [ecx]
ja 0x1004c53
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx + eax*4], esi
push esi
call edi
lea esi, [esi + eax*2 + 2]
push esi
jmp 0x1004c2e
Function at 0x1004c60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002078
push 0x1005db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x100c808], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x100c804], ecx
shl ecx, 8
add ecx, edx
mov dword [0x100c800], ecx
shr eax, 0x10
mov dword [0x100c7fc], eax
call fcn.01005c80
test eax, eax
jne 0x1004cca
push 0x1c
call fcn.01004e30
add esp, 4
mov dword [ebp - 4], 0
call fcn.01005a80
call fcn.01005a70
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100ce0c], eax
call fcn.01005640
mov dword [0x100c7dc], eax
test eax, eax
je 0x1004cfd
mov eax, dword [0x100ce0c]
test eax, eax
jne 0x1004d07
push 0xffffffffffffffff
call fcn.01004fa0
add esp, 4
call fcn.01005390
call fcn.010052a0
call fcn.01004f70
mov esi, dword [0x100ce0c]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x1004de6
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x1004d4e
test al, al
je 0x1004d4e
and eax, 0xff
push eax
call fcn.01005240
add esp, 4
test eax, eax
je 0x1004d28
inc esi
mov dword [ebp - 0x64], esi
jmp 0x1004d28
cmp byte [esi], 0x22
jne 0x1004d57
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x1004d67
cmp al, 0x20
ja 0x1004d67
inc esi
mov dword [ebp - 0x64], esi
jmp 0x1004d57
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x1004d88
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x1004d8d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.01004fa0
jmp 0x1004dcb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x1004d57
inc esi
mov dword [ebp - 0x64], esi
jmp 0x1004de6

Function at 0x1004e30
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100c7e4], 1
jne 0x1004e3e
call fcn.01005e90
mov eax, dword [esp + 4]
push eax
call fcn.01005ed0
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1004fe0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x100c838]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x1004fff
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x100c834], 1
mov byte [0x100c830], bl
jne 0x1005059
mov ecx, dword [0x100ce08]
test ecx, ecx
je 0x1005047
mov esi, dword [0x100ce04]
sub esi, 4
cmp esi, ecx
jb 0x1005047
mov eax, dword [esi]
test eax, eax
je 0x1005040
call eax
mov ecx, dword [0x100ce08]
sub esi, 4
cmp esi, ecx
jae 0x1005032
push 0x100a014
push 0x100a010
call fcn.01005090
add esp, 8
push 0x100a01c
push 0x100a018
call fcn.01005090
add esp, 8
test ebx, ebx
jne 0x1005080
push ebp
mov dword [0x100c838], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret

Function at 0x1005640
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x100c948]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x1005682
call edi
mov esi, eax
test esi, esi
je 0x100566c
mov eax, 1
jmp 0x100567d
call ebp
mov ebx, eax
test ebx, ebx
je 0x100578f
mov eax, 2
mov dword [0x100c948], eax
cmp eax, 1
jne 0x1005722
test esi, esi
jne 0x100569b
call edi
mov esi, eax
test esi, esi
je 0x100578f
cmp word [esi], 0
mov eax, esi
je 0x10056b5
add eax, 2
cmp word [eax], 0
jne 0x10056a3
add eax, 2
cmp word [eax], 0
jne 0x10056a3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x1005714
push edi
call fcn.010069a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1005714
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1005706
push ebx
call fcn.01006950
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x100578f
test ebx, ebx
jne 0x1005733
call ebp
mov ebx, eax
test ebx, ebx
je 0x100578f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x100574b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100573b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100573b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.010069a0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x100576d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x1005ed0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x100a1f0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x1005ef4
add eax, 8
inc ebp
cmp eax, 0x100a280
jb 0x1005ee5
cmp ecx, dword [ebp*8 + 0x100a1f0]
jne 0x100609b
mov eax, dword [0x100c7e4]
cmp eax, 1
je 0x100605d
test eax, eax
jne 0x1005f20
cmp dword [0x100a034], 1
je 0x100605d
cmp ecx, 0xfc
je 0x100609b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1005f5b
mov ecx, 5
mov esi, 0x100235c
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x1005fa4
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x1002358
add ebx, ecx
push ebx
call fcn.01007200
add esp, 0xc
mov ecx, 6
mov esi, 0x100233c
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1002338
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1002310
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x100a1f4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.01007170
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x100cd00]
test eax, eax
je 0x100606e
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x1006078
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x100a1f4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4e7726bb
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x433d3286
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402a7f
pop dword [ebp - 0x18]
mov eax, 0x228ca24a
sub eax, 0x224c77cb
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xfaaffd67
add dword [ebp - 0x28], 0x53a247e4
mov dword [ebp - 0x24], 0xf2e90d53
add dword [ebp - 0x24], 0x3f4a3ef2
mov dword [ebp - 0x20], 0x5e2de584
add dword [ebp - 0x20], 0xee1e5eaa
mov dword [ebp - 0x1c], 0x21600ce9
sub dword [ebp - 0x1c], 0x21600ce9
lea eax, [ebp - 0x28]
push eax
mov eax, 0x681c7cd
add eax, 0xf9bf78c3
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x65bcc7bc
sub dword [ebp - 0x28], 0xf14a5e66
mov dword [ebp - 0x24], 0xe9aa58b3
sub dword [ebp - 0x24], 0xa83df73e
mov dword [ebp - 0x20], 0xe007fb86
add dword [ebp - 0x20], 0x836770e6
mov dword [ebp - 0x1c], 0x8279b23e
sub dword [ebp - 0x1c], 0x8279b23e
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39bca
push 0
call eax
mov ecx, 0x43fd
mov edx, eax
mov esi, 0x41c000
add esi, dword [ebp - 0x18]
mov ebx, 0x87141cab
add ebx, 0xcd7e5b28
xor dword [ebp - 8], edi
mov edi, dword [esi]
mov dword [ebp - 4], 0x125c29b5
sub edi, ebx
xor dword [ebp - 4], 0x3f8743b4
mov dword [edx], edi
sub dword [ebp - 0xc], edi
add edx, 4
add esi, 4
loop 0x402b90
add eax, 0x1d2b1167
add eax, 0xe2d5f160
mov ebx, eax
add eax, 5
mov ecx, 0x6dceabcf
add ecx, 0x92715431
add ecx, dword [ebp - 0x18]
call ebx
leave
ret