joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053050
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
push edi
mov edi, dword [ebp + 8]
jne 0x10053152
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x100530d7
cmp ecx, edi
jne 0x100530ce
mov edx, dword [eax + 4]
test edx, edx
je 0x1005309c
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
test edx, edx
je 0x1005309c
mov ecx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
test edx, edx
je 0x100530a8
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 0x10]
test edx, edx
je 0x100530b5
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [eax + 8]
test edx, edx
je 0x100530ce
mov ecx, dword [eax + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x100530ce
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x10053081
push esi
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call esi
push 0xc8
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1003e340
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10052730
push 0
push 0
call esi
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.10061099
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10053700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1005372c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1005374e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10053750
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100537d5
jg 0x10053765
test esi, esi
je 0x100537d5
test ecx, ecx
jl 0x100537b8
jg 0x1005376f
test eax, eax
je 0x100537b8
cmp edi, ecx
jg 0x10053783
jl 0x10053779
cmp esi, eax
jae 0x10053783
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x100537d5
jg 0x100537bb
test esi, esi
je 0x100537d5
jmp 0x100537bb
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100537d5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100537f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x1005381c
jl 0x10053810
test esi, esi
jne 0x1005381c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10053835
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x10053875
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10053875
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x1005392c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100538a0
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x100538ef
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10053919
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100538c0
cmp dword [ebp - 4], 0
jbe 0x1005392f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10053ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10053cd0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10053d00
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10053d00
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10053dd5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10053d29
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10053d35
movsx eax, bl
jmp 0x10053d6c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10053dd5
cmp eax, 1
jle 0x10053d96
cmp eax, 3
jne 0x10053dd5
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10053db4
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10053dd5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10053dd5
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10061099
mov esp, ebp
pop ebp
ret 4
Function at 0x1005c0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1005c19c
cmp byte [esi + 0x3d], 0
je 0x1005c19c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1005c18a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1005c151
sub eax, 1
je 0x1005c155
sub eax, 2
jne 0x1005c18a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005c173
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005c18a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10061099
mov esp, ebp
pop ebp
ret
Function at 0x10060e30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d9ad
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10060cd0
cmp byte [ebp - 0x84], 0
jne 0x10060f81
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10060ec5
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x1008d6f8
call fcn.10060cd0
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10060cd0
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10060f34
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10060d80
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10060fc3
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10060fb9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10060fb9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100619c0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061099
mov esp, ebp
pop ebp
ret
Function at 0x70012cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x70012de
pop dword [ebp - 0xc]
mov eax, 0x70012de
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x721b829c
sub dword [ebp - 0x1c], 0x23c93d51
mov dword [ebp - 0x18], 0x17f01eed
sub dword [ebp - 0x18], 0xe5bcd2a8
mov dword [ebp - 0x14], 0x16a88f0e
sub dword [ebp - 0x14], 0xca5c4ae0
mov dword [ebp - 0x10], 0x17305f07
add dword [ebp - 0x10], 0xe8cfa0f9
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x884ef923
sub eax, 0x814dd8f3
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x7754227d
add dword [ebp - 0x1c], 0xfd1e46d9
mov dword [ebp - 0x18], 0x17bf5089
sub dword [ebp - 0x18], 0xd652ef14
mov dword [ebp - 0x14], 0xc5b24552
sub dword [ebp - 0x14], 0x6242d8e6
mov dword [ebp - 0x10], 0x266fb604
add dword [ebp - 0x10], 0xd99049fc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d2a0
push 0
call eax
mov ecx, 0x403823fe
sub ecx, 0x4037d17a
mov esi, eax
mov edx, 0x18b705cb
add edx, 0xee4ada35
add edx, dword [ebp - 0xc]
mov edi, 0xe9fcb3c0
add edi, 0x58994924
add dword [ebp - 8], ebx
mov ebx, dword [edx]
add dword [ebp - 4], esi
xor ebx, edi
sub dword [ebp - 4], 0x67441c8f
mov dword [esi], ebx
sub dword [ebp - 4], edx
add esi, 0x7100e5c1
add esi, 0x8eff1a43
add edx, 4
loop 0x70013f6
add eax, 0x60699407
sub eax, 0x60685724
xor ebx, ebx
add ebx, eax
add eax, 0xd631998e
add eax, 0x29ce6677
mov ecx, 0x7000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x700cd52
Capabilities:
Set current directory

Disassembly:
push 4
mov eax, 0x7010fd1
call fcn.07001bfd
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cf67
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d518
lea ecx, [ebp + 8]
call fcn.0700ccf6
mov eax, dword [edi + 0x14]
mov esi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call esi
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700cdc1
mov eax, dword [eax + 0x14]
jmp 0x700cdc6
mov eax, 0x701221a
push 0x7013b90
push eax
call dword [sym.imp.MSVCR120.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
jne 0x700cde6
push str.file_does_not_exist
push ebx
call fcn.070012cf
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
mov dword [edi + 8], eax
mov byte [ebp - 4], 1
call esi
push dword [ebp + 8]
mov ecx, 0x701a094
call fcn.070012cf
mov eax, edi
call fcn.07001d82
ret 4
Function at 0x700d620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x700d684
cmp byte [esi + 0x10], 0
je 0x700d640
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d672
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_feof]
pop ecx
test eax, eax
je 0x700d68b
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d686
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.070012cf
int3

Function at 0x700d8f2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700d945
cmp dword [esi + 0xc], 0
je 0x700d940
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d933
push str.stream_write_error
jmp 0x700d94a
push dword [esi + 0xc]
call dword [sym.imp.MSVCR120.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.070012cf
int3

Function at 0x10016f78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10016f87
pop dword [ebp - 0xc]
mov eax, 0xf78f6deb
add eax, 0x1872019c
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xbf3e421d
sub dword [ebp - 0x1c], 0x70ebfcd2
mov dword [ebp - 0x18], 0xf43fcff4
add dword [ebp - 0x18], 0x3df37c51
mov dword [ebp - 0x14], 0x1ac58b35
sub dword [ebp - 0x14], 0xce794707
mov dword [ebp - 0x10], 0xfa5a810b
sub dword [ebp - 0x10], 0xfa5a810b
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x110c2c08
add dword [ebp - 0x1c], 0x63663d4e
mov dword [ebp - 0x18], 0xbe7ae37d
sub dword [ebp - 0x18], 0x7d0e8208
mov dword [ebp - 0x14], 0xe9023dbd
sub dword [ebp - 0x14], 0x8592d151
mov dword [ebp - 0x10], 0xb40dbe36
add dword [ebp - 0x10], 0x4bf241ca
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x5b9eb241
add eax, 0xb462fdd3
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x42b00
push 0
call eax
mov ecx, 0xf514e0a9
add ecx, 0xaeb790e
xor esi, esi
add esi, eax
mov edx, 0x539e4b64
sub edx, 0x439b9b64
add edx, dword [ebp - 0xc]
mov edi, 0xe5bbf041
add edi, 0x8dcf58b8
mov dword [ebp - 4], 0x49ea270d
mov ebx, dword [edx]
xor dword [ebp - 4], ecx
sub ebx, edi
xor dword [ebp - 8], 0x44e4194c
mov dword [esi], ebx
xor dword [ebp - 8], 0x1d9169ad
add esi, 4
add edx, 4
loop 0x100170a6
add eax, 0x5969d034
sub eax, 0x59687685
xor ebx, ebx
add ebx, eax
add eax, 0xe53bb00f
sub eax, 0xe53bb00a
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1001ec1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001ec29
pop dword [ebp - 0x40]
mov eax, 0xeabef8ea
sub eax, 0xdabd0cc1
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x8bed1382
sub dword [ebp - 0x50], 0x3d9ace37
mov dword [ebp - 0x4c], 0x8c61cc05
add dword [ebp - 0x4c], 0xa5d18040
mov dword [ebp - 0x48], 0xbfb255c7
add dword [ebp - 0x48], 0x8c99ee67
mov dword [ebp - 0x44], 0x70110157
add dword [ebp - 0x44], 0x8feefea9
lea eax, [ebp - 0x50]
push eax
mov eax, 0x99622f3e
sub eax, 0x89602f3a
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x35e2034f
add dword [ebp - 0x50], 0x3e906607
mov dword [ebp - 0x4c], 0x2febefad
sub dword [ebp - 0x4c], 0xee7f8e38
mov dword [ebp - 0x48], 0xfb313e79
sub dword [ebp - 0x48], 0x97c1d20d
mov dword [ebp - 0x44], 0xc0e50545
add dword [ebp - 0x44], 0x3f1afabb
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xf4bc477e
add eax, 0x1b45b882
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3d312
push 0
call eax
mov ecx, 0x92e47e85
add ecx, 0x6d1bcbe3
mov edi, eax
mov ebx, 0x1002bc00
add ebx, dword [ebp - 0x40]
mov edx, 0x9dabfc9d
add edx, 0x524801cb
xor dword [ebp - 0x20], 0xc56e2cd3
mov esi, dword [ebx]
xor dword [ebp - 0x2c], esi
xor esi, edx
add dword [ebp - 0x14], edx
mov dword [edi], esi
mov dword [ebp - 0x38], 0xea52e89a
add edi, 4
add ebx, 0x10a9518
add ebx, 0xfef56aec
loop 0x1001ed45
add eax, 0xe44778be
add eax, 0x1bb9a3b5
mov ebx, eax
add eax, 5
mov ecx, 0x2c2eda35
sub ecx, 0x1c2eda35
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4060d3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42228c], 0
push esi
jne 0x40610a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4060e4
mov dword [ecx*4 + 0x422288], eax
inc ecx
cmp ecx, 0x100
jl 0x4060df
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40613b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422288]
xor eax, esi
inc ecx
dec edx
jne 0x40611d
pop edi
not eax
pop esi
ret 0xc

Function at 0x4118d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x4118f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4118f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4118e8
mov eax, 1
add ebx, ebx
jne 0x41190b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411900
jne 0x41191c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411900
xor ecx, ecx
sub eax, 3
jb 0x411930
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4119a2
mov ebp, eax
add ebx, ebx
jne 0x41193b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411948
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41196c
inc ecx
add ebx, ebx
jne 0x411958
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41194d
jne 0x411969
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41194d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41198c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41197d
jmp 0x4118ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41198c
add edi, ecx
jmp 0x4118ee
pop esi
mov edi, esi
mov ecx, 0x24e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4119aa
cmp byte [edi], 0
jne 0x4119aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4119af
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411a1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11d78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11e18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4119dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11e1c]
or eax, eax
je 0x411a18
mov dword [ebx], eax
add ebx, 4
jmp 0x4119f9
call dword [esi + 0x11e24]
mov ebp, dword [esi + 0x11e20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x411a52
sub esp, 0xffffff80
jmp 0x404319