joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2983d943
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x2983d952
pop dword [ebp - 0x14]
mov eax, 0x2983d952
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xb48be448
add dword [ebp - 0x24], 0x99c66103
mov dword [ebp - 0x20], 0x5cb74b4f
sub dword [ebp - 0x20], 0x2a83ff0a
mov dword [ebp - 0x1c], 0xa437f88f
sub dword [ebp - 0x1c], 0x57ebb461
mov dword [ebp - 0x18], 0xa7ea1c5f
add dword [ebp - 0x18], 0x5815e3a1
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc1ce17d1
sub eax, 0x9848a711
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe70a0d2e
add dword [ebp - 0x24], 0x8d685c28
mov dword [ebp - 0x20], 0x3113be02
add dword [ebp - 0x20], 0x1058a373
mov dword [ebp - 0x1c], 0x27a7ce51
add dword [ebp - 0x1c], 0x3bc79e1b
mov dword [ebp - 0x18], 0xa26b592c
sub dword [ebp - 0x18], 0xa26b592c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xaffa2bd7
sub eax, 0x8674bb1f
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x45eb3
push 0
call eax
mov ecx, 0x3f60
mov edx, eax
mov ebx, 0x29896400
add ebx, dword [ebp - 0x14]
mov edi, 0x56b7cabe
sub edi, 0xb424aa85
add dword [ebp - 8], edx
mov esi, dword [ebx]
sub dword [ebp - 0x10], 0x99d7c600
xor esi, edi
xor dword [ebp - 4], edi
mov dword [edx], esi
add edx, 0x6e298d3
add edx, 0xf91d6731
add ebx, 4
loop 0x2983da63
add eax, 0xeb8b2a82
add eax, 0x1475c5d1
mov ebx, eax
add eax, 0xc7bcd9f9
sub eax, 0xc7bcd9f4
mov ecx, 0x29800000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, reloc.comsvcs.dll_RecycleSurrogate
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x7003567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x7003576
pop dword [ebp - 8]
mov eax, 0xe4415691
add eax, 0x22bedee5
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x8ba007d8
add dword [ebp - 0x18], 0xc2b23d73
mov dword [ebp - 0x14], 0x4c7ee690
sub dword [ebp - 0x14], 0x1a4b9a4b
mov dword [ebp - 0x10], 0xefbe6ac4
add dword [ebp - 0x10], 0x5c8dd96a
mov dword [ebp - 0xc], 0x3c2b0bd9
add dword [ebp - 0xc], 0xc3d4f427
lea eax, [ebp - 0x18]
push eax
mov eax, 0x63b5222b
sub eax, 0x5cb3f1fb
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x73dcb044
sub dword [ebp - 0x18], 0xff6a46ee
mov dword [ebp - 0x14], 0xbac46964
sub dword [ebp - 0x14], 0x795807ef
mov dword [ebp - 0x10], 0xc99aaa59
sub dword [ebp - 0x10], 0x662b3ded
mov dword [ebp - 0xc], 0xe67df424
add dword [ebp - 0xc], 0x19820bdc
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe77e4c2a
sub eax, 0xe07d1bf6
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39b73
push 0
call eax
mov ecx, 0xb3427be4
add ecx, 0x4cbdc82f
xor edi, edi
add edi, eax
mov ebx, 0x6a383462
sub ebx, 0x63363262
add ebx, dword [ebp - 8]
mov esi, 0xd3757c5
sub esi, 0xb3d9da5d
xor dword [ebp - 4], edx
mov edx, dword [ebx]
xor dword [ebp - 4], ecx
add edx, esi
sub dword [ebp - 4], 0xe929970e
mov dword [edi], edx
add dword [ebp - 4], 0xd3137b6c
add edi, 0x3a27e826
sub edi, 0x3a27e822
add ebx, 0x82db5405
add ebx, 0x7d24abff
loop 0x700369a
add eax, 0xac48c5f
sub eax, 0xac38940
mov ebx, eax
add eax, 0xeb3928f1
add eax, 0x14c6d714
mov ecx, 0xb8fb4107
add ecx, 0x4e04bef9
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003567
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003567
int3
Function at 0x700de90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700def4
cmp byte [esi + 0x10], 0
je 0x700deb2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [esi + 0xc]
pop ecx
mov byte [esi + 0x10], 0
push edi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700dee2
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
test eax, eax
je 0x700defb
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700def6
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.07003567
int3

Function at 0x700e170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700e1c3
cmp dword [esi + 0xc], 0
je 0x700e1be
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700e1b1
push str.stream_write_error
jmp 0x700e1c8
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.07003567
int3
Function at 0x1c3cca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3fc000]
push edi
jmp 0x1c3ccba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1c3ccc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c3ccb0
mov eax, 1
add ebx, ebx
jne 0x1c3ccd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1c3cce4
jne 0x1c3cd03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c3cd03
dec eax
add ebx, ebx
jne 0x1c3ccf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1c3ccc8
add ebx, ebx
jne 0x1c3ccff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1c3cd55
xor ecx, ecx
sub eax, 3
jb 0x1c3cd1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1c3cd8a
sar eax, 1
mov ebp, eax
jmp 0x1c3cd26
add ebx, ebx
jne 0x1c3cd26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c3ccf4
inc ecx
add ebx, ebx
jne 0x1c3cd34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c3ccf4
add ebx, ebx
jne 0x1c3cd41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1c3cd36
jne 0x1c3cd52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1c3cd36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1c3cd74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1c3cd66
jmp 0x1c3ccb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1c3cd74
add edi, ecx
jmp 0x1c3ccb6
pop esi
mov edi, esi
mov ecx, 0x5bdf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1c3cd92
cmp byte [edi], 0x24
jne 0x1c3cd92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1c3cd97
lea edi, [esi + 0x1839000]
mov eax, dword [edi]
or eax, eax
je 0x1c3ce0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x183e378]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x183e4c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1c3cdc4
mov ecx, edi
jns 0x1c3cdf3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x183e4cc]
or eax, eax
je 0x1c3ce09
mov dword [ebx], eax
add ebx, 4
jmp 0x1c3cde1
call dword [esi + 0x183e4c8]
mov ebp, dword [esi + 0x183e4d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1c3ce43
sub esp, 0xffffff80
jmp 0x4ca06d
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x71f71c6d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x54055df9
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x1000194d
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
cmp dword [0x1003b75c], eax
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
jne 0x1002adb4
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [ebp - 0x10]
mov dword [0x1003b75c], ecx
sbb eax, eax
mov dword [0x1003b758], eax
and eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, esi
pop esi
leave
ret 4
mov eax, dword [0x1003b758]
jmp 0x1000198e
Function at 0x10007bac
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
test byte [0x1003b8a0], 1
push ebx
push esi
push edi
jne 0x10007bd1
or dword [0x1003b8a0], 1
call fcn.10007b56
mov dword [0x1003b89c], eax
push 4
pop eax
call fcn.10001a44
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10007c70
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
lea edi, [eax - 1]
not edi
and edi, esi
sub edi, eax
mov dword [ebp - 8], eax
mov eax, dword [0x1003b894]
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xffff1000
add esi, 0x11000
add esi, ebx
cmp edi, esi
jb 0x10007c70
cmp eax, 1
je 0x10007cad
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10007c70
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10007c37
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10007c6c
xor eax, eax
inc eax
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
cmp edi, eax
jae 0x10007c74
xor eax, eax
jmp 0x10007c64
cmp eax, esi
jae 0x10007c7b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1003b894]
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10007c64
mov dword [ebp - 4], edi
jmp 0x10007c8f
Function at 0x1001610c
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebx + 0x54]
call fcn.10008af9
fldz
xor eax, eax
fstp dword [ebx + 0x74]
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x98], eax
lea edi, [ebx + 0x9c]
mov esi, 0x10007588
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [0x1003b8c0], eax
jne 0x1001623e
push 0x1003b200
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0x1003b8c0], edi
jne 0x10016233
cmp dword [0x1003b8c4], edi
je 0x100161a8
push 0x1e3
push 0x10002580
push 0x1001627c
call fcn.100280bc
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x1001221f
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x10016233
push 0x15f90
push dword [0x1003b1f4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
inc esi
test eax, eax
je 0x10016219
mov eax, 0x10016248
push eax
push 0x1ef
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push 0x10002580
push eax
mov dword [ebp - 0x28], edi
mov word [ebp - 0x24], 0x62
mov dword [ebp - 0x20], 0xc00212d6
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call fcn.1002a981
add esp, 0x10
cmp dword [0x1003b898], edi
je 0x100162aa
mov eax, dword [ebp - 4]
mov dword [0x1003b8c4], eax
mov dword [0x1003b8c0], esi
push 0x1003b200
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10016233
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x33196762
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4f6124e4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6bf502b8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x424222a7
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x38d97d64
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x7af0b59
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219