joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058700
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
lea esp, [esp - 8]
xor eax, eax
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
and edi, 0xfffffffe
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
jle 0x10058845
movdqa xmm5, xmmword [0x102b09e0]
mov dword [esp + 4], edi
mov dword [esp], ebx
nop dword [eax + eax]
nop dword [eax]
nop
mov ebx, dword [esp + 0x1c]
mov edi, dword [ebx + eax*4]
mov ebx, dword [ebx + eax*4 + 4]
add eax, 2
movq xmm7, qword [edi + ecx - 6]
pshufd xmm1, xmm7, 1
movdqa xmm6, xmm7
pshufb xmm6, xmm5
pshufb xmm1, xmm5
cvtdq2ps xmm3, xmm6
cvtdq2ps xmm2, xmm1
movups xmm6, xmmword [edx]
movups xmm7, xmmword [edx + 0x10]
mulps xmm3, xmm6
mulps xmm2, xmm7
movups xmm6, xmmword [edx + 0x48]
addps xmm3, xmm2
movq xmm4, qword [ebx + ecx - 6]
movdqa xmm0, xmm4
pshufd xmm4, xmm4, 1
pshufb xmm0, xmm5
pshufb xmm4, xmm5
cvtdq2ps xmm1, xmm0
cvtdq2ps xmm0, xmm4
movups xmm4, xmmword [edx + 0x38]
mulps xmm0, xmm6
mulps xmm1, xmm4
movups xmm4, xmmword [edx + 0x58]
addps xmm1, xmm0
movd xmm2, dword [edi + ecx + 2]
pshufb xmm2, xmm5
movd xmm0, dword [ebx + ecx + 2]
cvtdq2ps xmm6, xmm2
pshufb xmm0, xmm5
movups xmm2, xmmword [edx + 0x20]
cvtdq2ps xmm7, xmm0
mulps xmm6, xmm2
mulps xmm7, xmm4
addps xmm3, xmm6
addps xmm1, xmm7
movzx edi, word [edi + ecx + 6]
movzx ebx, word [ebx + ecx + 6]
movsd xmm4, qword [edx + 0x30]
movd xmm0, edi
pshufb xmm0, xmm5
movd xmm2, ebx
pshufb xmm2, xmm5
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
mulps xmm0, xmm4
movsd xmm6, qword [edx + 0x68]
add edx, 0x70
mulps xmm2, xmm6
addps xmm3, xmm0
movaps xmm4, xmm3
addps xmm1, xmm2
movlhps xmm4, xmm1
shufps xmm3, xmm1, 0xee
addps xmm4, xmm3
pshufd xmm0, xmm4, 8
pshufd xmm3, xmm4, 0xd
addps xmm0, xmm3
movlps qword [esi], xmm0
add esi, 8
cmp eax, dword [esp + 4]
jl 0x10058740
mov ebx, dword [esp]
cmp eax, dword [esp + 0x18]
jge 0x100588e2
mov edi, dword [esp + 0x1c]
movups xmm4, xmmword [edx]
movups xmm5, xmmword [edx + 0x10]
mov eax, dword [edi + eax*4]
movq xmm2, qword [eax + ecx - 6]
pshufd xmm3, xmm2, 1
movdqa xmm1, xmm2
pshufb xmm1, xmmword [0x102b09e0]
pshufb xmm3, xmmword [0x102b09e0]
cvtdq2ps xmm0, xmm1
cvtdq2ps xmm6, xmm3
movups xmm1, xmmword [edx + 0x20]
mulps xmm0, xmm4
mulps xmm6, xmm5
movd xmm7, dword [eax + ecx + 2]
addps xmm0, xmm6
pshufb xmm7, xmmword [0x102b09e0]
movzx ecx, word [eax + ecx + 6]
cvtdq2ps xmm2, xmm7
movd xmm3, ecx
pshufb xmm3, xmmword [0x102b09e0]
mulps xmm2, xmm1
cvtdq2ps xmm5, xmm3
addps xmm0, xmm2
movsd xmm4, qword [edx + 0x30]
mulps xmm5, xmm4
addps xmm0, xmm5
movaps xmm6, xmm0
shufps xmm6, xmm0, 0x4e
addps xmm6, xmm0
movaps xmm0, xmm6
shufps xmm0, xmm6, 1
addss xmm6, xmm0
movss dword [esi], xmm6
lea esp, [esp + 8]
pop edi
pop esi
ret
Function at 0x100706e0
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x14
xor edx, edx
mov eax, dword [0x102e9794]
lea ecx, [esp]
xor eax, esp
mov dword [ecx + 0x10], eax
mov dword [ecx], edx
push edx
push edx
push ecx
call fcn.1024e910
add esp, 0xc
mov ecx, dword [esp + 0x10]
xor ecx, esp
mov eax, dword [esp]
cmp ecx, dword [0x102e9794]
jne 0x10070714
add esp, 0x14
ret
call fcn.1023c450
nop dword [eax]
Function at 0x10070ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102e59d0]
jmp dword [eax*4 + 0x102e97b4]

Function at 0x10070b00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102e59d0]
jmp dword [eax*4 + 0x102e97cc]

Function at 0x10070b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102e59d0]
jmp dword [eax*4 + 0x102e97fc]

Function at 0x10070bc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102e59d0]
jmp dword [eax*4 + 0x102e9814]

Function at 0x10070c00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102e59d0]
jmp dword [eax*4 + 0x102e982c]

Function at 0x10070ca0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102e59d0]
jmp dword [eax*4 + 0x102e988c]

Function at 0x10070ce0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102e59d0]
jmp dword [eax*4 + 0x102e98a4]
Function at 0x100bdae0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
cmp dword [esp + 0x10], 0
je 0x100bdc0c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100bdc0c
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x100bdc01
cmp dword [esp + 0x14], 4
jl 0x100bdbf8
mov esi, dword [esp + 0x10]
and esi, 0xf
je 0x100bdb2e
test esi, 3
jne 0x100bdbf8
neg esi
add esi, 0x10
shr esi, 2
mov edx, esi
add edx, 4
cmp edx, dword [esp + 0x14]
jg 0x100bdbf8
mov edi, ebx
mov ecx, 0x80000000
sub edi, esi
and edi, 3
neg edi
add edi, ebx
test esi, esi
jbe 0x100bdb72
mov eax, dword [esp + 0x10]
xor edx, edx
nop word [eax + eax]
cmp ecx, dword [eax + edx*4]
cmovle ecx, dword [eax + edx*4]
lea edx, [edx + 1]
cmp edx, esi
jb 0x100bdb60
mov eax, dword [esp + 0x18]
movd xmm0, ecx
pshufd xmm0, xmm0, 0
mov edx, dword [esp + 0x10]
nop
movdqa xmm1, xmmword [edx + esi*4]
add esi, 4
movdqa xmm2, xmm1
pxor xmm1, xmm0
pcmpgtd xmm2, xmm0
cmp esi, edi
pand xmm2, xmm1
pxor xmm0, xmm2
jb 0x100bdb80
pshufd xmm1, xmm0, 0xe
movdqa xmm2, xmm0
pcmpgtd xmm2, xmm1
pxor xmm0, xmm1
pand xmm2, xmm0
pxor xmm2, xmm1
pshufd xmm0, xmm2, 0x39
movdqa xmm3, xmm2
pcmpgtd xmm3, xmm0
pxor xmm2, xmm0
pand xmm3, xmm2
pxor xmm3, xmm0
movd edx, xmm3
cmp edi, dword [esp + 0x14]
jae 0x100bdbee
mov ecx, dword [esp + 0x10]
cmp edx, dword [ecx + edi*4]
cmovle edx, dword [ecx + edi*4]
lea edi, [edi + 1]
cmp edi, ebx
jb 0x100bdbe0
mov dword [eax], edx
xor eax, eax
pop ebx
pop edi
pop esi
ret 0xc
mov edx, 0x80000000
xor edi, edi
jmp 0x100bdbd6
mov eax, 0xfffffffa
pop ebx
pop edi
pop esi
ret 0xc
mov eax, 0xfffffff8
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x100bf260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100bf26f
pop dword [ebp - 0x28]
mov eax, 0x9d04fe
sub eax, 0xf091128f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xf79f126d
sub dword [ebp - 0x38], 0xa94ccd22
mov dword [ebp - 0x34], 0x6b0de2e1
add dword [ebp - 0x34], 0xc7256964
mov dword [ebp - 0x30], 0x2de7cdd0
add dword [ebp - 0x30], 0x1e64765e
mov dword [ebp - 0x2c], 0xd75efcd8
add dword [ebp - 0x2c], 0x28a10328
lea eax, [ebp - 0x38]
push eax
mov eax, 0xf816e1ff
sub eax, 0xe7ef61d7
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xcdb05f02
add dword [ebp - 0x38], 0xa6c20a54
mov dword [ebp - 0x34], 0x38bf7a43
sub dword [ebp - 0x34], 0xf75318ce
mov dword [ebp - 0x30], 0xc4f96540
add dword [ebp - 0x30], 0x9e76072c
mov dword [ebp - 0x2c], 0x2eee70be
add dword [ebp - 0x2c], 0xd1118f42
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x6af6f0a0
sub eax, 0x5acf707c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x61c1a
push 0
call eax
mov ecx, 0x3f98
mov ebx, eax
mov esi, 0xf5f8f417
sub esi, 0xe5c7fa17
add esi, dword [ebp - 0x28]
mov edx, 0x5e7080a7
xor dword [ebp - 8], 0xdafd232
mov edi, dword [esi]
xor dword [ebp - 0x1c], edx
xor edi, edx
add dword [ebp - 4], 0xb2a8698
mov dword [ebx], edi
sub dword [ebp - 0x10], ecx
add ebx, 0xe660adc8
sub ebx, 0xe660adc4
add esi, 4
loop 0x100bf385
add eax, 0x91144ff0
add eax, 0x6eeca143
xor ebx, ebx
add ebx, eax
add eax, 0x676d3a0e
sub eax, 0x676d3a09
mov ecx, 0x4c45b0f5
add ecx, 0xc3ba4f0b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10110860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023e79b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x101108a9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102e354c], 0
jne 0x101108c0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1011090d
mov eax, dword [esi]
test eax, eax
je 0x10110892
cmp dword [esi + 4], 0
je 0x10110892
push eax
call fcn.100bf260
add esp, 4
push dword [esi + 4]
call fcn.100bf260
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x101108fe
push eax
call fcn.100bf260
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10110945
push eax
call fcn.100bf260
jmp 0x10110942
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.100bf260
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.100bf260
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.100bf260
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.100bf260
add esp, 4
push 8
call fcn.100bf260
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10110980
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100bf260
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1019c030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023ff89
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.1019d620
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.1019d600
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101f7900
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x101f7911
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1021e7c0
push 0x100
push 0
push 0x102f1ce8
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
nop word [eax + eax]
mov byte [eax + 0x102f1de8], al
inc eax
cmp eax, 0x100
jl 0x1021e7e0
push esi
push edi
push 0x100
push 0xff
push 0x102f1ee8
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0xfe317780
mov edx, 0xfc403180
mov esi, 0xf6b26d80
mov edi, 0xf8a3b8c0
xor eax, eax
nop dword [eax]
mov dword [eax + 0x102f1fe8], edi
add edi, 0x166e9
mov dword [eax + 0x102f49e8], esi
add esi, 0x1c5a2
mov dword [eax + 0x102f73e8], edx
add edx, 0xb6d2
mov dword [eax + 0x102f9de8], ecx
add eax, 4
add ecx, 0x581a
cmp eax, 0x29e0
jle 0x1021e820
xorps xmm0, xmm0
mov dword [0x102fb2f8], 0
pop edi
movups xmmword [0x102fb2d8], xmm0
mov dword [0x102f88f8], 0
movups xmmword [0x102fb2e8], xmm0
mov dword [0x102f5ef8], 0
movups xmmword [0x102f88d8], xmm0
mov dword [0x102f34f8], 0
movups xmmword [0x102f88e8], xmm0
pop esi
movups xmmword [0x102f5ed8], xmm0
movups xmmword [0x102f5ee8], xmm0
movups xmmword [0x102f34d8], xmm0
movups xmmword [0x102f34e8], xmm0
ret
Function at 0x10209e80
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10209e91
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1023bf90
movss xmm5, dword [0x102bd82c]
movss xmm4, dword [0x102bd834]
movss xmm6, dword [0x102bd828]
movss xmm7, dword [0x102bd820]
movss xmm3, dword [0x1027b890]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x102d46d0]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x102fc9f0], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x102bd830]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd818]
add eax, edx
mov dword [esi*4 + 0x102fd1f0], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x102bd824]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd81c]
add eax, ecx
mov dword [esi*4 + 0x102fcdf0], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fd5f0], eax
mulss xmm0, dword [0x102bd83c]
mov dword [esi*4 + 0x102fddf0], edx
mov dword [esi*4 + 0x102fd9f0], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe1f0], eax
mulss xmm0, dword [0x102bd840]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe5f0], eax
mulss xmm0, dword [0x102bd844]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100bf260
mov dword [esi*4 + 0x102fe9f0], eax
mulss xmm2, dword [0x102bd838]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.100bf260
mov dword [esi*4 + 0x102fedf0], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1023bfc0
pop esi
ret
Function at 0x411ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x411ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ac8
mov eax, 1
add ebx, ebx
jne 0x411aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ae0
jne 0x411afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ae0
xor ecx, ecx
sub eax, 3
jb 0x411b10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411b82
mov ebp, eax
add ebx, ebx
jne 0x411b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411b28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411b4c
inc ecx
add ebx, ebx
jne 0x411b38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411b2d
jne 0x411b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411b2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411b6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411b5d
jmp 0x411ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411b6c
add edi, ecx
jmp 0x411ace
pop esi
mov edi, esi
mov ecx, 0x203
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411b8a
cmp byte [edi], 0xa
jne 0x411b8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x411b8f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411bfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x113a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411bbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1140c]
or eax, eax
je 0x411bf8
mov dword [ebx], eax
add ebx, 4
jmp 0x411bd9
call dword [esi + 0x11410]
popal
jmp 0x403ae7

Function at 0x403afb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x406070]
mov ebx, eax
add edx, eax
mov eax, 0x406074
call fcn.00403a51
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x405ba4
push eax
sub edi, fcn.00405332
push edi
push fcn.00405332
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x403b6a
mov eax, fcn.00405332
mov ebx, esi
mov edx, edi
call fcn.00403a51
mov edx, 0x1c000
mov eax, 0x406074
mov ebx, esi
call fcn.00402219
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.0040474d
mov eax, 0x406074
lea edi, [esi + 0x1c000]
xor edx, edx
or edi, esi
inc esi
div esi
lea ebx, [ebp - 2]
mov edx, edi
call fcn.00405332
lea esp, [ebp + 0x82]
jmp 0x403bc3
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x31df1160
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7b294229
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4062d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x415e4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404204
call fcn.004074bb
push 4
mov dword [esp + 0x18], 0
call fcn.00408794
mov edi, eax
add esp, 4
test edi, edi
je 0x406344
push ebx
call fcn.004072b6
mov dword [edi], eax
call fcn.00407075
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0040747c
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406338
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.004074a4
pop ebx
jmp 0x406346
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40936b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419354]
jne 0x409375
repz ret
jmp fcn.0040dfac
Function at 0x41283e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b40f
and dword [ebp - 0x14], 0
cmp dword [0x4305ec], 0
mov dword [ebp - 0x18], eax
jne 0x4128f1
push 0x403e48
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412999
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e3c
push ebx
call edi
test eax, eax
je 0x412999
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e2c
push ebx
mov dword [0x4305ec], eax
call edi
push eax
call esi
push 0x403e18
push ebx
mov dword [0x4305f0], eax
call edi
push eax
call esi
push 0x403dfc
push ebx
mov dword [0x4305f4], eax
call edi
push eax
call esi
mov dword [0x4305fc], eax
test eax, eax
je 0x4128f1
push 0x403de4
push ebx
call edi
push eax
call esi
mov dword [0x4305f8], eax
mov eax, dword [0x4305f8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41294a
cmp dword [0x4305fc], ecx
je 0x41294a
push eax
call esi
push dword [0x4305fc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41294a
test ebx, ebx
je 0x41294a
call edi
test eax, eax
je 0x412941
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x412941
test byte [ebp - 8], 1
jne 0x41294a
or dword [ebp + 0x10], 0x200000
jmp 0x41297d
mov eax, dword [0x4305f0]
cmp eax, dword [ebp - 0x18]
je 0x41297d
push eax
call esi
test eax, eax
je 0x41297d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41297d
mov eax, dword [0x4305f4]
cmp eax, dword [ebp - 0x18]
je 0x41297d
push eax
call esi
test eax, eax
je 0x41297d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4305ec]
call esi
test eax, eax
je 0x412999
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41299b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040936b
leave
ret