joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518070
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc1000]
push edi
jmp 0x51808a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x518091
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518080
mov eax, 1
add ebx, ebx
jne 0x5180a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5180b4
jne 0x5180d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5180d3
dec eax
add ebx, ebx
jne 0x5180c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x518098
add ebx, ebx
jne 0x5180cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x518125
xor ecx, ecx
sub eax, 3
jb 0x5180eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51815a
sar eax, 1
mov ebp, eax
jmp 0x5180f6
add ebx, ebx
jne 0x5180f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5180c4
inc ecx
add ebx, ebx
jne 0x518104
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5180c4
add ebx, ebx
jne 0x518111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x518106
jne 0x518122
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x518106
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x518144
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x518136
jmp 0x518086
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x518144
add edi, ecx
jmp 0x518086
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x518162
cmp byte [edi], 0x11
jne 0x518162
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x518167
lea edi, [esi + 0x111000]
mov eax, dword [edi]
or eax, eax
je 0x5181df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x157710]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15788c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x518194
mov ecx, edi
jns 0x5181c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x157890]
or eax, eax
je 0x5181d9
mov dword [ebx], eax
add ebx, 4
jmp 0x5181b1
call dword [esi + 0x1578a0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x518210
cmp al, 0xef
ja 0x518203
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5181e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5181f2
mov ebp, dword [esi + 0x157894]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x518244
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x438774
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x438783
pop dword [ebp - 0x4c]
mov eax, 0x438783
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x521e5
push 0
mov eax, 0x55fe5394
sub eax, 0x55b970c0
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4cce
xor edi, edi
add edi, eax
mov ebx, 0xbb2e68a8
sub ebx, 0xbae6d8a8
add ebx, dword [ebp - 0x4c]
mov edx, 0x6080b495
sub edx, 0xf7b13085
xor dword [ebp - 0x48], 0xd9dd4388
mov esi, dword [ebx]
sub dword [ebp - 8], edi
add esi, edx
add dword [ebp - 0x30], 0x1e1ec1e5
mov dword [edi], esi
xor dword [ebp - 0x44], 0x8bb0434b
add edi, 0xaf34c35a
sub edi, 0xaf34c356
add ebx, 0x3232f6
add ebx, 0xffcdcd0e
loop 0x4387d9
add eax, 0x3ab512c4
add eax, 0xc54c1347
mov ebx, eax
add eax, 0x15038d1c
add eax, 0xeafc72e9
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x444db9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46f748
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x444dfc
push str.SystemFunction040
push dword [0x46f748]
call edi
push str.SystemFunction041
push dword [0x46f748]
mov dword [0x46f738], eax
call edi
mov dword [0x46f73c], eax
jmp 0x444e01
mov eax, dword [0x46f73c]
cmp dword [0x46f738], 0
je 0x444e12
test eax, eax
jne 0x444eb9
push 0x46f74c
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x444ec3
push str.CryptProtectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f738], 0
mov dword [0x46f740], eax
jne 0x444e77
test eax, eax
jne 0x444e77
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444e61
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444e68
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work35_swix_srclibsdutilcryputil.cpp
call fcn.004013b3
jmp 0x444ec3
push str.CryptUnprotectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f73c], 0
mov dword [0x46f744], eax
jne 0x444eb9
test eax, eax
jne 0x444eb9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444ead
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444eb4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x444e6b
mov dword [0x46f750], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402c00
pop dword [ebp - 0x38]
mov eax, 0x8a733b11
sub eax, 0x8a330f11
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x66e35efe
add dword [ebp - 0x48], 0xe76ee64d
mov dword [ebp - 0x44], 0x58dcdf88
sub dword [ebp - 0x44], 0x26a99343
mov dword [ebp - 0x40], 0xbb11ae76
sub dword [ebp - 0x40], 0x6ec56a48
mov dword [ebp - 0x3c], 0x9f6cd778
add dword [ebp - 0x3c], 0x60932888
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x5ff4d6f4
add dword [ebp - 0x48], 0x147d9262
mov dword [ebp - 0x44], 0xa0a971c0
sub dword [ebp - 0x44], 0x5f3d104b
mov dword [ebp - 0x40], 0xa715fa11
add dword [ebp - 0x40], 0xbc59725b
mov dword [ebp - 0x3c], 0xf3948cc0
sub dword [ebp - 0x3c], 0xf3948cc0
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xfb69ddc2
sub eax, 0xfb295cee
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3951a
push 0
call eax
mov ecx, 0xe141faf2
add ecx, 0x1ebe5793
xor edi, edi
add edi, eax
mov edx, 0xee874b97
sub edx, 0xee463b97
add edx, dword [ebp - 0x38]
mov esi, 0xfac341d8
sub esi, 0xaa6155e9
add dword [ebp - 4], esi
mov ebx, dword [edx]
xor dword [ebp - 8], 0xd9d1c3c1
add ebx, esi
xor dword [ebp - 0xc], 0x392dd492
mov dword [edi], ebx
add edi, 4
add edx, 4
loop 0x402d1f
add eax, 0xae69c8c
sub eax, 0xae55fa5
xor ebx, ebx
add ebx, eax
add eax, 0xe081694e
add eax, 0x1f7e96b7
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x1171058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011711a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x117107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x117106a
add dl, dl
jne 0x1171089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11710dc
xor eax, eax
add dl, dl
jne 0x1171096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x117117d
add dl, dl
jne 0x11710a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11710b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11710bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11710c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11710d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1171075
mov eax, 1
add dl, dl
jne 0x11710ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11710f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11710e1
sub eax, ebx
mov ebx, 1
jne 0x1171128
mov ecx, 1
add dl, dl
jne 0x117110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1171119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1171105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1171075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x117113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x117114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1171136
cmp eax, 0x7d00
jae 0x117116d
cmp eax, 0x500
jb 0x1171168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1171075
cmp eax, 0x7f
ja 0x1171170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1171075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x117119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1171075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x45a4f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52362f
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x580ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x224], ax
push 0x208
push 0
lea ecx, [ebp - 0x222]
push ecx
call fcn.004ba280
add esp, 0xc
push 0x104
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x240]
call fcn.004012e0
mov byte [ebp - 4], 1
push 0x52fc40
lea ecx, [ebp - 0x240]
call fcn.0040d8a0
push 0x52fc3c
lea ecx, [ebp + 8]
call fcn.00401340
push eax
call fcn.004bafaa
add esp, 8
test eax, eax
je 0x45a691
push 0x52fc38
lea ecx, [ebp - 0x25c]
call fcn.004012e0
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2bc]
push edx
lea eax, [ebp + 8]
push eax
push 0x52fc38
lea ecx, [ebp - 0x278]
call fcn.004012e0
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c4], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2c4]
push edx
lea eax, [ebp - 0x294]
push eax
call fcn.0040de30
add esp, 0xc
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x2cc], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x2cc]
push edx
lea eax, [ebp - 0x2b0]
push eax
call fcn.0040de30
add esp, 0xc
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2d4], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2d4]
push edx
lea ecx, [ebp + 8]
call fcn.0040b1f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b0]
call fcn.00401320
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x294]
call fcn.00401320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x278]
call fcn.00401320
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x25c]
call fcn.00401320
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x45a6ab
push 0x52fc30
lea ecx, [ebp - 0x240]
call fcn.0040d8a0
jmp 0x45a6bb
push str.__u
lea ecx, [ebp - 0x240]
call fcn.0040d8a0
push str.__s
lea ecx, [ebp - 0x240]
call fcn.0040d8a0
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x240]
call fcn.0040e060
lea edx, [ebp - 0x240]
push edx
call fcn.0045a730
add esp, 4
mov byte [ebp - 0x2b1], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.00401320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401320
mov al, byte [ebp - 0x2b1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ba1db
mov esp, ebp
pop ebp
ret
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000e9bf
pop dword [ebp - 0x40]
mov eax, 0x1000e9bf
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x6ff7070c
sub dword [ebp - 0x50], 0x21a4c1c1
mov dword [ebp - 0x4c], 0xab67bac0
add dword [ebp - 0x4c], 0x86cb9185
mov dword [ebp - 0x48], 0xbe7c27b5
add dword [ebp - 0x48], 0x8dd01c79
mov dword [ebp - 0x44], 0x23b4f187
sub dword [ebp - 0x44], 0x23b4f187
lea eax, [ebp - 0x50]
push eax
mov eax, 0x80af114c
sub eax, 0x70ad8110
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x7ffc34e9
sub dword [ebp - 0x50], 0xb89cb93
mov dword [ebp - 0x4c], 0x597bc994
add dword [ebp - 0x4c], 0xe7f097e1
mov dword [ebp - 0x48], 0xefd683ff
add dword [ebp - 0x48], 0x7398e86d
mov dword [ebp - 0x44], 0x5eda39fb
sub dword [ebp - 0x44], 0x5eda39fb
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x37db5
push 0
call eax
mov ecx, 0x386e2eb8
add ecx, 0xc7921e78
xor ebx, ebx
add ebx, eax
mov edx, 0x81b2b870
sub edx, 0x71b09070
add edx, dword [ebp - 0x40]
mov edi, 0x4d4ce745
sub edi, 0x7092a380
xor dword [ebp - 0x34], 0xfafd5be1
mov esi, dword [edx]
xor dword [ebp - 4], 0xbe901aad
add esi, edi
sub dword [ebp - 0x3c], 0xe58d5186
mov dword [ebx], esi
sub dword [ebp - 4], 0x7baffd6e
add ebx, 0x56e5f5df
add ebx, 0xa91a0a25
add edx, 0xaef3fb42
sub edx, 0xaef3fb3e
loop 0x1000ead9
add eax, 0xe7eb1154
add eax, 0x1816163f
mov ebx, eax
add eax, 0x4be33345
sub eax, 0x4be33340
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x401000
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210c
push ebx
push esi
push edi
push edx
call fcn.0040101c
add byte [edi + 0x3a], al
cmp dword [edi + 0x4c], ecx
xor dh, byte [edi]
inc ebp
cmp al, 0x83
add esp, 4
invalid
retf 0x6858
Function at 0x40101c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x6858
sub edx, 0x10027
sub edx, 0xdb6e
pop edx
push esi
push eax
add esp, 4
and esi, 0x17d8a
pop esi
mov eax, 0x4d
mov word [ebp - 0x2048], ax
mov ecx, 0x42
mov word [ebp - 0x2046], cx
mov edx, 0x53
mov word [ebp - 0x2044], dx
mov eax, 0x65
mov word [ebp - 0x2042], ax
mov ecx, 0x72
add byte [eax], al
add byte [esi - 0x77], ah
invalid
rcr bh, 0xff
invalid
mov edx, 0x76
mov word [ebp - 0x203e], dx
mov eax, 0x69
mov word [ebp - 0x203c], ax
mov ecx, 0x63
mov word [ebp - 0x203a], cx
mov edx, 0x65
mov word [ebp - 0x2038], dx
mov eax, 0x2e
mov word [ebp - 0x2036], ax
mov ecx, 0x65
mov word [ebp - 0x2034], cx
mov edx, 0x78
mov word [ebp - 0x2032], dx
mov eax, 0x65
mov word [ebp - 0x2030], ax
xor ecx, ecx
mov word [ebp - 0x202e], cx
mov dword [ebp - 0x1060], 1
push eax
or eax, 0x16fe8
add eax, 0x44c8
pop eax
push eax
push edx
add esp, 4
add eax, 0x10364
pop eax
push eax
push edi
add esp, 4
xor eax, 0xed96
and eax, 0x6f4f
jmp 0x40111e
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push edx
push ecx
add esp, 4
or edx, 0x81fd
pop edx
push edi
push eax
add esp, 4
or edi, 0x161df
sub edi, 0xfc5a
pop edi
push ecx
xor ecx, 0x1ea7
pop ecx
push esi
push eax
add esp, 4
add esi, 0xeeb5
pop esi
mov dword [ebp - 0x10], 1
push edx
push esi
add esp, 4
or edx, 0x292b
pop edx
push edx
sub edx, 0x11141
pop edx
push edx
push ebx
add esp, 4
xor edx, 0xc439
sub edx, 0x2662
sub edx, 0x43e0
add edx, 0x8b3c
pop edx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push edi
add esp, 4
add esi, 0x1541f
pop esi
push ecx
and ecx, 0x555c
or ecx, 0xfc7f
and ecx, 0x59c0
sub ecx, 0x15689
pop ecx
push ebx
push ecx
add esp, 4
xor ebx, 0x14bf4
pop ebx
push eax
push edi
add esp, 4
jmp 0x40121b
add eax, 0x5425
and eax, 0x14b6
pop eax
push edx
push ebx
add esp, 4
xor edx, 0x149a
pop edx
push esi
jmp 0x40123c
xor esi, 0xd718
pop esi
mov dword [ebp - 0x2c], 1
push ebx
push ecx
add esp, 4
sub ebx, 0x150c5
or ebx, 0xf944
pop ebx
push eax
push ebx
add esp, 4
or eax, 0x11c2f
or eax, 0x1460f
jmp 0x401275
add eax, 0x7c31
pop eax
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401439
push esi
push eax
add esp, 4
add esi, 0x15dca
pop esi
push esi
sub esi, 0x11abf
call 0x401c89
add byte [edi], bh
xor al, 0x4d
cmp al, 0x50
dec esp
xor al, 0x49
add esp, 4
or esi, 0xba72
and esi, 0x1253c
pop esi
mov edx, dword [ebp - 0x278]
add edx, 0x70
imul eax, dword [ebp - 0x274], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x274], 0x70
sub eax, ecx
xor edx, eax
invalid