joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b27
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43733c]
jne 0x404b31
repz ret
jmp fcn.0040ad06

Function at 0x40bd34
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c2c
and dword [ebp - 4], 0
cmp dword [0x4419f4], 0
mov ebx, eax
jne 0x40bde5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40be96
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40be96
push eax
call fcn.00404bba
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4419f4], eax
call esi
push eax
call fcn.00404bba
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4419f8], eax
call esi
push eax
call fcn.00404bba
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4419fc], eax
call esi
push eax
call fcn.00404bba
pop ecx
mov dword [0x441a04], eax
test eax, eax
je 0x40bde5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404bba
pop ecx
mov dword [0x441a00], eax
mov eax, dword [0x441a00]
cmp eax, ebx
je 0x40be3d
cmp dword [0x441a04], ebx
je 0x40be3d
push eax
call fcn.00404c35
push dword [0x441a04]
mov esi, eax
call fcn.00404c35
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40be3d
test edi, edi
je 0x40be3d
call esi
test eax, eax
je 0x40be34
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40be34
test byte [ebp - 0xc], 1
jne 0x40be3d
or dword [ebp + 0x10], 0x200000
jmp 0x40be76
mov eax, dword [0x4419f8]
cmp eax, ebx
je 0x40be76
push eax
call fcn.00404c35
pop ecx
test eax, eax
je 0x40be76
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40be76
mov eax, dword [0x4419fc]
cmp eax, ebx
je 0x40be76
push eax
call fcn.00404c35
pop ecx
test eax, eax
je 0x40be76
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4419f4]
call fcn.00404c35
pop ecx
test eax, eax
je 0x40be96
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40be98
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101e9139
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101f6a48], 0
mov byte [0x101f6a4c], 0
mov dword [0x101f6a40], 0xdd8
mov dword [0x101f6a3c], 0x1867
mov dword [0x101f6a44], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101e9254
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x101f6a50], 0
add ecx, 0xfffff22e
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x101f6a48]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101f6a50], esi
mov dword [0x101f6a3c], ecx
mov eax, esi
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x101f6a48], edx
mov esi, dword [ebp - 0x28]
mov cl, byte [ebx + esi]
mov byte [0x101f6a4c], cl
mov dword [0x101f6a3c], 0x1300
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101f6a4c]
mov edx, dword [0x101f6a48]
mov byte [ebx + edx], cl
mov edx, dword [0x101f6a40]
mov ecx, edx
add ecx, 0xfffff3f9
mov dword [0x101f6a3c], ecx
mov esi, dword [0x101f6a44]
add esi, 1
mov dword [0x101f6a44], esi
cmp esi, 0x100
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x20], esi
jl 0x101e918d
jmp 0x101e92a0
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101f6a44]
add eax, 1
mov dword [0x101f6a44], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101e9254
mov eax, 0x1c52
xor ecx, ecx
mov dword [0x101f6a3c], 0x1c52
mov dword [0x101f6a44], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x101e918d
mov eax, dword [ebp - 0x30]
add eax, 0xffffef7b
mov dword [0x101f6a3c], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101e9b1f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101f6a40], 0xbaf
mov dword [0x101f6a3c], 0x77a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x101e9c27
lea eax, [ebp - 0x20]
mov dword [0x101f6a40], 0x8c2
mov dword [0x101f6a3c], 0x2310
mov dword [ebp - 0x30], eax
call fcn.101e965d
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.101e8ec9
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x101e9c74
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101f6a3c]
add ecx, 0xffffee8b
mov dword [0x101f6a3c], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.101e950d
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101f6a40], 0x322
mov dword [ecx + 0xd0], 0x4550
mov dword [0x101f6a3c], 0xfb1
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x5c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x14], ecx
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x101e9c74
jmp 0x101e9c57
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101eb5b0]
mov dh, byte [eax + 0x101eb581]
sub dh, dl
mov byte [ebp + eax - 0x20], dh
cmp ecx, 0xe
mov dword [ebp - 0x2c], ecx
je 0x101e9b4f
jmp 0x101e9c27
mov eax, dword [ebp - 0x3c]
add eax, 0x1b87
mov ecx, dword [0x101f6a40]
add ecx, 0xfffff237
mov dword [0x101f6a3c], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
Function at 0x101e9d08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.101ea183
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x101f6a3c], 0xda3
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x101f6a40], 0xffffecc6
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
jne 0x101e9d97
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x101f6a3c], 0x47ea
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [0x101f6a40], 0x114b
mov dword [ebp - 0x24], edx
jmp 0x101e9d5b
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x101e9e14
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x101e9dc3
mov al, byte [ebp - 0x42]
test al, 1
jne 0x101e9d66
jmp 0x101e9e21
xor eax, eax
mov ecx, dword [ebp - 0x28]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], ecx
jb 0x101e9da9
jmp 0x101e9d5b
Function at 0x101e9e4e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101f6a40]
add eax, 0xfffffd5c
mov dword [0x101f6a40], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x101f6a3c], 0x2650
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101f6a40], 0x129
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101e9f65
mov eax, 0x29da
mov dword [0x101f6a3c], 0x13c5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x18], eax
je 0x101e9fbe
jmp 0x101e9ff2
mov eax, 0x29da
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x101e9fdb
jmp 0x101e9ff2
mov eax, dword [ebp - 0x1c]
mov ecx, 0x35f0
mov dword [0x101f6a3c], 0x1fdb
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
je 0x101e9f9b
jmp 0x101e9ff2
mov eax, 0xfffff9e7
mov dword [0x101f6a3c], 0xffffe3d2
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x18], eax
je 0x101e9ea0
jmp 0x101e9ff2
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
mov eax, 0x199d
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x18], eax
je 0x101e9f17
jmp 0x101e9ff2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edx
je 0x101e9eea
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
jl 0x101e9f65
jmp 0x101e9eea
mov eax, 0x199d
mov dword [0x101f6a3c], 0x388
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x18], eax
je 0x101e9f49
jmp 0x101e9ff2
mov eax, 0x29da
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x18], eax
je 0x101e9eca
jmp 0x101e9ff2
mov eax, 1
mov dword [0x101f6a40], 0xfa2
mov dword [ebp - 0x20], eax
jmp 0x101e9f41
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [0x101f6a3c], eax
mov dword [ebp - 0x20], ecx
jmp 0x101e9f41
Function at 0x101ea317
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101f6a44], 0
mov dword [0x101f6a48], 0
mov dword [0x101f6a54], 0
mov dword [0x101f6a3c], 0x2bc
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x101ea472
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, edx
add edi, 1
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101f6a44], edx
mov dword [0x101f6a3c], 0x97e
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101f6a48], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101f6a4c], cl
mov ebx, dword [0x101f6a40]
add ebx, 0xfffff27d
mov dword [0x101f6a3c], ebx
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101f6a4c]
mov edx, dword [0x101f6a48]
mov byte [ebx + edx], cl
mov edx, dword [0x101f6a44]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101f6a48]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x101f6a54], ecx
mov dword [0x101f6a3c], 0x2e2
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
xor cl, byte [edx + esi]
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], cl
mov dword [0x101f6a3c], 0x130b
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x38], edi
je 0x101ea472
mov eax, dword [0x101f6a48]
mov ecx, dword [0x101f6a44]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jmp 0x101ea37a
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101ea47a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov dword [0x101f6a3c], 0x1b4a
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.101e97e4
lea ecx, [0x101e90e8]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x58], edx
mov dword [esp + 0x50], 0x138800
mov dword [0x101f6a40], 0x894
mov edx, dword [0x101f6a28]
mov dword [esp + 0x54], edx
mov edx, dword [0x101f6a2c]
mov dword [esp + 0x6c], edx
mov edx, dword [0x101f6a30]
mov dword [esp + 0x30], edx
mov edx, dword [0x101f6a34]
mov dword [esp + 0x28], edx
mov edx, dword [0x101f6a38]
mov dword [esp + 0x38], edx
mov dword [0x101f6a3c], 0x1e0a
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x101ea531
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101ea545
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x101ea50e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [0x101f6a40], 0xe2d
mov dword [0x101f6a3c], 0xf67
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x60], edx
call fcn.101e9e4e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x101ea5b6
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101e9b1f
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x101f6a40], 0x5b1
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a6f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a49
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a44
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406aa0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406a82
pop edi
not eax
pop esi
ret 0xc

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40942f
pop dword [ebp - 8]
mov eax, 0x54e5f4e7
add eax, 0xab5a9f48
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xc85e090d
add dword [ebp - 0x18], 0x85f43c3e
mov dword [ebp - 0x14], 0x767ce74a
sub dword [ebp - 0x14], 0x44499b05
mov dword [ebp - 0x10], 0x149e3d9d
sub dword [ebp - 0x10], 0xc851f96f
mov dword [ebp - 0xc], 0x9c226eee
add dword [ebp - 0xc], 0x63dd9112
lea eax, [ebp - 0x18]
push eax
mov eax, 0xffdbda73
sub eax, 0xff9b0a1f
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x747da2fc
add dword [ebp - 0x18], 0xfff4c65a
mov dword [ebp - 0x14], 0x38107181
sub dword [ebp - 0x14], 0xf6a4100c
mov dword [ebp - 0x10], 0x69b04991
sub dword [ebp - 0x10], 0x640dd25
mov dword [ebp - 0xc], 0xec4ba82e
sub dword [ebp - 0xc], 0xec4ba82e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x5251b7c9
add eax, 0xadef1883
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3c432
push 0
call eax
mov ecx, 0x238f71e
add ecx, 0xfdc75bc7
xor esi, esi
add esi, eax
mov edi, 0xa4c68a96
add edi, 0x5b7b256a
add edi, dword [ebp - 8]
mov ebx, 0xe01aed8
sub dword [ebp - 4], ecx
mov edx, dword [edi]
xor dword [ebp - 4], 0xf47d5b6e
add edx, ebx
sub dword [ebp - 4], edx
mov dword [esi], edx
xor dword [ebp - 4], 0xba2a944b
add esi, 0x9b12c677
sub esi, 0x9b12c673
add edi, 0x79da6473
add edi, 0x86259b91
loop 0x40954d
add eax, 0x13e67
xor ebx, ebx
add ebx, eax
add eax, 0xc5b8399e
sub eax, 0xc5b83999
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0xa17553
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov edi, ecx
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x20]
and dword [edi + 0x60], 0
and dword [edi + 0x5c], 0
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x24]
and eax, 0xe0000000
mov dword [ebp + 8], eax
jne 0xa1759e
push 0xffffffffffffffec
push dword [edi + 0x38]
call dword [fcn.009d13c8]
shl eax, 7
not eax
and eax, 0x20000000
or eax, 0x40000000
mov dword [ebp + 8], eax
mov ecx, edi
call fcn.00a0d3a8
lea ebx, [edi + 0x6c]
mov eax, dword [ebx]
test eax, eax
jne 0xa2e9fb
push ebx
call fcn.009e5aed
mov eax, dword [edi + 0x58]
and dword [ebp - 4], 0
cmp eax, dword [edi + 0x1e0]
je 0xa2ea0b
push dword [esi + 0xc]
mov ecx, edi
call fcn.00a17255
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.00a1730c
xor ebx, ebx
cmp eax, ebx
jl 0xa1764f
mov eax, dword [esi + 0x24]
or eax, dword [ebp + 8]
mov ecx, dword [edi + 0x6c]
push eax
add esi, 0x10
push esi
call fcn.00a1765d
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ebx
jne 0xa2ea5f
cmp dword [0xa824cc], ebx
je 0xa1763a
mov al, byte [0xa824d0]
cmp al, 4
jb 0xa17649
mov ecx, dword [0xa824b8]
mov edx, dword [0xa824bc]
mov eax, 0x10000
mov esi, 0x80000000
and ecx, eax
and edx, esi
or ecx, edx
jne 0xa2eac9
cmp dword [ebp + 8], 0
jl 0xa1764f
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
test al, al
je 0xa17618
jmp 0xa1763a
mov ecx, edi
call fcn.00a16b8e
jmp 0xa17640
mov eax, dword [eax + 4]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x24]
jmp 0xa175b2
lea ebx, [edi + 0x68]
mov eax, dword [ebx]
mov dword [ebp - 4], 1
test eax, eax
je 0xa2ea2e
push dword [esi + 0xc]
push dword [eax + 0xc]
call fcn.00a50329
test eax, eax
je 0xa2ea2e
xor eax, eax
jmp 0xa2ea53
push ebx
call fcn.009e5aed
push dword [esi + 0xc]
mov ecx, edi
call fcn.00a17255
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.00a1730c
test eax, eax
jl 0xa1764f
mov ebx, dword [ebx]
mov dword [edi + 0x6c], ebx
inc dword [ebx]
jmp 0xa175e2
cmp dword [0xa824cc], ebx
je 0xa1763a
mov al, byte [0xa824d0]
cmp al, 4
jae 0xa2ea7c
test al, al
jne 0xa1763a
mov ecx, dword [0xa824b8]
mov edx, dword [0xa824bc]
mov eax, 0x10000
mov esi, 0x80080000
and ecx, eax
and edx, esi
or ecx, edx
je 0xa1763a
mov ecx, dword [0xa824c0]
mov ebx, dword [0xa824c4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0xa1763a
cmp eax, ebx
jne 0xa1763a
push 0xa1c218
jmp 0xa2eaf2
mov ecx, dword [0xa824c0]
mov ebx, dword [0xa824c4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0xa1763a
cmp eax, ebx
jne 0xa1763a
push 0xa2eb08
push dword [0xa8247c]
push dword [0xa82478]
call fcn.009de7c9
jmp 0xa1763a
Function at 0xa4f0b1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
or ecx, 0xffffffff
sub ecx, dword [ebp + 0x10]
cmp dword [ebp + 0xc], 0
je 0xa4f0e3
mov eax, dword [ebp + 8]
push esi
movzx edx, byte [eax]
dec dword [ebp + 0xc]
movzx esi, cl
xor edx, esi
shr ecx, 8
xor ecx, dword [edx*4 + 0xa4f0f0]
inc eax
cmp dword [ebp + 0xc], 0
jne 0xa4f0c6
pop esi
or eax, 0xffffffff
sub eax, ecx
pop ebp
ret 0xc
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x430a1f
pop dword [ebp - 0x28]
mov eax, 0x7ef1c97b
add eax, 0x815140a4
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3a46b
push 0
mov eax, 0xeaefb073
sub eax, 0xeaac3043
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xe57aa758
sub ecx, 0xe57a6107
mov edi, eax
mov esi, 0xc8ebb46f
add esi, 0x37591191
add esi, dword [ebp - 0x28]
mov ebx, 0x1b6ebc2d
add ebx, 0x34899259
xor dword [ebp - 0x14], edi
mov edx, dword [esi]
sub dword [ebp - 8], 0x91d21b2d
xor edx, ebx
add dword [ebp - 0xc], 0xcb7082cf
mov dword [edi], edx
sub dword [ebp - 0xc], edx
add edi, 0x8b586fd6
add edi, 0x74a7902e
add esi, 4
loop 0x430a7e
add eax, 0xc4126e44
add eax, 0x3bee9dd3
xor ebx, ebx
add ebx, eax
add eax, 0x59d7650b
sub eax, 0x59d76506
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4