joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403040
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
mov eax, dword [0x430068]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
push edi
mov edi, dword [ebp + 8]
push str.AccessUpdateCheck
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40307b
push eax
jmp 0x4031b2
push str.AccessUpdateCheck
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4031b1
test esi, esi
je 0x4031b1
call fcn.00401ea0
call fcn.00402120
movups xmm0, xmmword [str.ClipboardViewerClass]
mov ax, word [0x42cc84]
mov word [esp + 0x78], ax
lea eax, [esp + 0x50]
movups xmmword [esp + 0x50], xmm0
mov dword [esp + 0x2c], eax
lea eax, [esp + 8]
movups xmm0, xmmword [0x42cc6c]
push eax
mov dword [esp + 0xc], 0
movups xmmword [esp + 0x64], xmm0
mov dword [esp + 0x10], 0x402ec0
movq xmm0, qword [0x42cc7c]
movq qword [esp + 0x74], xmm0
xorps xmm0, xmm0
movlpd qword [esp + 0x14], xmm0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Clipboard_Viewer
lea eax, [esp + 0x78]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
push 0
lea eax, [esp + 0x3c]
movaps xmmword [esp + 0x3c], xmm0
push eax
movq qword [esp + 0x50], xmm0
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x403199
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x30]
push eax
call esi
lea eax, [esp + 0x30]
push eax
call edi
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x403176
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0040c069
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x8c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.0040c069
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x403b71
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x403b60
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10008510
Capabilities:
Hash data with md5
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10040050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
mov esi, ecx
push 0x1003c0f8
push eax
lea eax, [ebp - 0x408]
push eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.10015419
add esp, 0xc
test eax, eax
jne 0x1000861f
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.10016dac
add esp, 0x10
test eax, eax
je 0x100085c6
push eax
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
call fcn.10005fb0
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.10016dac
add esp, 0x10
test eax, eax
jne 0x10008597
mov ecx, esi
call fcn.10006060
push dword [ebp - 0x408]
call fcn.10015ab9
mov edx, dword [ebp + 0x1c]
add esp, 4
cmp edx, 0x10
jb 0x1000860b
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10008601
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008626
push edx
push ecx
call fcn.1000f8f3
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi + 0x68]
xor ecx, ebp
pop esi
call fcn.1000f59b
mov esp, ebp
pop ebp
ret 0x18
push 0
call fcn.100151f7
call fcn.10013b50
int3
Function at 0x10008b80
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10040050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x10041d44]
lea eax, [ebp - 0x20]
push edi
push eax
push 0x28
mov eax, dword [esi + 0x1e8]
mov edi, edx
call eax
push eax
mov eax, dword [esi + 0x40]
call eax
test eax, eax
je 0x10008bd8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x10041d44]
push str.SeDebugPrivilege
push 0
mov eax, dword [eax + 0x38]
call eax
test eax, eax
jne 0x10008bea
mov eax, dword [0x10041d44]
push dword [ebp - 0x20]
mov eax, dword [eax + 0x30]
call eax
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
neg edi
mov ecx, dword [ebp - 8]
push 0
push 0
mov dword [ebp - 0x18], eax
sbb edi, edi
push 0x10
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
push eax
mov eax, dword [0x10041d44]
and edi, 2
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edi
mov eax, dword [eax + 0x3c]
call eax
mov ecx, dword [0x10041d44]
mov esi, eax
push dword [ebp - 0x20]
mov ecx, dword [ecx + 0x30]
call ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1000f59b
mov esp, ebp
pop ebp
ret
Function at 0x1000b900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f24d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
mov eax, dword [0x10040050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
jne 0x1000b9c7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 1
call fcn.1000f5a9
add esp, 4
mov ecx, eax
call fcn.10004860
cmp al, 1
jne 0x1000b9de
mov ecx, 0x29
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1003c1c8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x38], al
and ecx, 0x800000ff
jns 0x1000b97d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x28
jl 0x1000b960
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
mov eax, dword [0x10041d44]
push 0
push 0
push 0
mov eax, dword [eax + 0xb0]
call eax
mov ecx, dword [0x10041d44]
mov esi, eax
mov ecx, dword [ecx + 0xd4]
call ecx
cmp eax, 0xb7
jne 0x1000b9c7
mov eax, dword [0x10041d44]
push esi
mov eax, dword [eax + 0x30]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000bcc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x1000bda6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x1000bd95
jg 0x1000bd00
test edx, edx
je 0x1000bd95
nop dword [eax]
call fcn.1000d210
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000bd54
jg 0x1000bd17
test esi, esi
je 0x1000bd54
cmp ebx, eax
jg 0x1000bd27
jl 0x1000bd21
cmp edi, esi
jae 0x1000bd27
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10010cc0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1000bd79
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x1000bd8f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x1000bd00
jl 0x1000bd8f
test edi, edi
jne 0x1000bd00
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1000bdc8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1000bdca
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x1000be48
jg 0x1000bddd
test esi, esi
je 0x1000be48
test eax, eax
jl 0x1000be2c
jg 0x1000bde7
test ebx, ebx
je 0x1000be2c
cmp edi, eax
jg 0x1000bdf7
jl 0x1000bdf1
cmp esi, ebx
jae 0x1000bdf7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.10010cc0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x1000be48
jg 0x1000be2f
test esi, esi
je 0x1000be48
jmp 0x1000be2f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1000be48
push eax
push esi
push 1
push edx
call fcn.10016514
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000be60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1000be92
jl 0x1000be85
test ecx, ecx
jne 0x1000be92
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000bf52
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.1000d230
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000befe
jg 0x1000bebd
test esi, esi
je 0x1000befe
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1000bed5
mov eax, dword [esp + 0x10]
jl 0x1000becf
cmp eax, esi
jae 0x1000bed5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10010cc0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000bf1f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000bf3b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1000bea4
jl 0x1000bf3b
test ecx, ecx
jne 0x1000bea4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000bf91
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1000bf91
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.10010cc0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x1000c000
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x1000bfb7
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x1000bfe9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10016dac
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1000c014
cmp edi, eax
ja 0x1000bfc5
test ecx, ecx
je 0x1000c000
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10016dac
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000c380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10040050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1000c3b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000c3ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1000c3ec
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1000c4d4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1000c414
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000c447
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10015236
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x1000c4a7
sub eax, 1
je 0x1000c4a7
sub eax, 2
jne 0x1000c4d4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.10015236
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000c4c4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10016514
add esp, 0x10
cmp edi, eax
jne 0x1000c4d4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1000c3d7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000f59b
mov esp, ebp
pop ebp
ret 4
Function at 0x1000cf40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10040050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000cffa
cmp byte [esi + 0x3d], 0
je 0x1000cffa
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000cfe8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1000cfb0
sub eax, 1
je 0x1000cfb4
sub eax, 2
jne 0x1000cfe8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000cfd1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10016514
add esp, 0x10
cmp edi, eax
jne 0x1000cfe8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f59b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1000f59b
mov esp, ebp
pop ebp
ret

Function at 0x10021787
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100215fd

Function at 0x10026605
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10026282

Function at 0x42ea92
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
pushal
call fcn.0042eaa1

Function at 0x42f262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.0042f26e

Function at 0x42f8e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.0042f8fa

Function at 0x42f961
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.0042f974
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x406243
pop dword [ebp - 0x20]
mov eax, 0x7b424eb7
sub eax, 0x7b01ec74
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xbcf1a845
sub dword [ebp - 0x30], 0x6e9f62fa
mov dword [ebp - 0x2c], 0x1a64f103
add dword [ebp - 0x2c], 0x17ce5b42
mov dword [ebp - 0x28], 0xf920a623
sub dword [ebp - 0x28], 0xacd461f5
mov dword [ebp - 0x24], 0x1584e934
sub dword [ebp - 0x24], 0x1584e934
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf6215861
sub dword [ebp - 0x30], 0x81aeef0b
mov dword [ebp - 0x2c], 0x68aa5f5e
sub dword [ebp - 0x2c], 0x273dfde9
mov dword [ebp - 0x28], 0xd3bd86b
add dword [ebp - 0x28], 0x56339401
mov dword [ebp - 0x24], 0x45d8d69f
add dword [ebp - 0x24], 0xba272961
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x8fb662f0
sub eax, 0x8f75e1f0
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x38a0f
push 0
call eax
mov ecx, 0x4e6c
xor edx, edx
add edx, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x20]
mov esi, 0xa9dd7621
add esi, 0xaa0d234b
xor dword [ebp - 8], 0xfba75edc
mov ebx, dword [edi]
add ebx, esi
add dword [ebp - 8], ecx
mov dword [edx], ebx
xor dword [ebp - 0xc], 0xd692afbf
add edx, 0xbffd6b85
sub edx, 0xbffd6b81
add edi, 0xd77d7082
sub edi, 0xd77d707e
loop 0x406356
add eax, 0xf2d0e820
add eax, 0xd304463
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x100034b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003b680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 0xc]
mov ecx, 0x1003f103
push esi
call fcn.1000e93d
mov esi, dword [ebp + 8]
xor edx, edx
movzx eax, bl
mov dword [ebp - 0x14], edx
test bl, bl
jne 0x100034e2
xor al, al
jmp 0x100034fe
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov bl, byte [esi]
test al, al
je 0x1000351c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e96f
mov esp, ebp
pop ebp
ret

Function at 0x10003530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003b680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 0xc]
mov ecx, 0x1003f103
push esi
call fcn.1000e93d
movzx eax, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], 0
test eax, eax
jne 0x10003576
mov byte [ebp - 8], al
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e96f
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov byte [esi], bl
test eax, eax
je 0x100035ad
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e96f
mov esp, ebp
pop ebp
ret
Function at 0x10004ef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003b680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 0x10]
mov ecx, 0x1003f103
push esi
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 8], bl
call fcn.1000e93d
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push esi
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.100034b0
movzx eax, al
add esp, 8
sub eax, 0xe8
je 0x10004fe5
sub eax, 1
je 0x10004fe5
sub eax, 0x16
jne 0x10004fcc
mov eax, dword [ebp + 0xc]
push esi
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.100034b0
add esp, 8
cmp al, 0x15
je 0x10004f64
cmp al, 0x25
jne 0x10004fcc
mov esi, dword [ebp + 0xc]
xor edx, edx
movzx eax, bl
add esi, 2
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
shl eax, 2
mov dword [ebp - 0x18], edx
test eax, eax
jne 0x10004f83
xor al, al
jmp 0x10004f9b
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call ebx
mov edx, dword [ebp - 0x18]
test eax, eax
setne al
mov byte [ebp - 0xc], al
mov esi, dword [esi]
test al, al
je 0x10004fb5
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push edx
call ebx
mov ecx, dword [esi]
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e96f
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e96f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push esi
push 4
push ecx
mov ecx, esp
inc eax
push edi
mov dword [ecx], eax
call fcn.100052b0
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000e96f
mov esp, ebp
pop ebp
ret