joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001830f
pop dword [ebp - 0x24]
mov eax, 0x4d11d377
add eax, 0xc2efaf98
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x52e28646
add dword [ebp - 0x34], 0xfb6fbf05
mov dword [ebp - 0x30], 0xf47a4d19
sub dword [ebp - 0x30], 0xc24700d4
mov dword [ebp - 0x2c], 0xb3bb32f7
sub dword [ebp - 0x2c], 0x676eeec9
mov dword [ebp - 0x28], 0xc1085841
sub dword [ebp - 0x28], 0xc1085841
lea eax, [ebp - 0x34]
push eax
mov eax, 0x22cd63e9
sub eax, 0x12c912e5
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xb409cbb4
sub dword [ebp - 0x34], 0x3f97625e
mov dword [ebp - 0x30], 0x99d05df4
sub dword [ebp - 0x30], 0x5863fc7f
mov dword [ebp - 0x2c], 0x32093030
sub dword [ebp - 0x2c], 0xce99c3c4
mov dword [ebp - 0x28], 0x790ff9e1
sub dword [ebp - 0x28], 0x790ff9e1
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xb36a99ad
add eax, 0x5c99b70b
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x50377
push 0
call eax
mov ecx, 0x5f85
mov edi, eax
mov edx, 0xa96cb96f
sub edx, 0x9965696f
add edx, dword [ebp - 0x24]
mov esi, 0xaeadd7d6
sub esi, 0x4cfe0c36
sub dword [ebp - 0x14], 0xd56e3a29
mov ebx, dword [edx]
xor dword [ebp - 0x10], ecx
xor ebx, esi
add dword [ebp - 0x1c], eax
mov dword [edi], ebx
add dword [ebp - 0xc], 0x15653d3d
add edi, 0x53bae3e5
add edi, 0xac451c1f
add edx, 0xd9d74d9f
sub edx, 0xd9d74d9b
loop 0x1001842b
add eax, 0x6444c338
sub eax, 0x64435251
xor ebx, ebx
add ebx, eax
add eax, 0x7fabb55d
add eax, 0x80544aa8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x401010
Capabilities:
Check for software breakpoints
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0x402004
mov dword [ebp - 8], 0
push 0x8002
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x40103d
jmp 0x4010cf
pushal
cmp dword [section..data], 0
jne 0x40104a
mov eax, dword [ebp - 4]
cmp dword [section..data], 1
jne 0x401056
mov ecx, dword [ebp - 4]
cmp dword [section..data], 2
jne 0x401062
mov edx, dword [ebp - 4]
cmp dword [section..data], 3
jne 0x40106e
mov ebx, dword [ebp - 4]
cmp dword [section..data], 4
jne 0x40107a
mov edi, dword [ebp - 4]
push 0x401089
push 0x401089
jmp dword [ebp - 4]
pop eax
popal
cmp dword [ebp - 8], 0xa
jae 0x4010af
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 0x40311a]
cmp edx, 0xcc
jne 0x4010af
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x40108b
cmp dword [ebp - 8], 0xa
je 0x4010b7
jmp 0x4010cb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4010c1
jmp 0x401089

Function at 0x40673e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4073c8
push 0x406880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40818c], 0xffffffff
or dword [0x408190], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x408178]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x408174]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x408194], eax
call fcn.00406875
cmp dword [0x40801c], 0
jne 0x4067c1
push 0x406872
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00406860
push 0x40800c
push 0x408008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x408170]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40816c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x408004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004062c0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x411c20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00411c00
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x411c6c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x411c40
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4156b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4156e6
mov dword [0x45a560], eax
mov edx, 0x415690
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041a950
test eax, eax
sete al
movzx eax, al
mov dword [0x4500a0], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x4500a0], eax
leave
ret
Function at 0x4157d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x40f4b0
mov dword [ebp - 0x24], 0x44f8d0
mov dword [ebp - 0x1c], 0x415890
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0041adb0
cmp dword [0x4500a0], 0
mov dword [ebp - 0x44], 0x45a570
je 0x415870
jl 0x4158b0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x45a560]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x415953
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0041ae90
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45ab60]
mov eax, 0xffffffff
test edx, edx
je 0x4158ca
mov eax, dword [0x4500a4]
test eax, eax
je 0x41590a
xor eax, eax
test eax, eax
jne 0x415900
mov edi, dword [0x4500a0]
test edi, edi
js 0x415900
mov dword [ebp - 0x44], 0x45a570
mov ebx, dword [0x4500a0]
test ebx, ebx
je 0x415870
jmp 0x41581e
xor esi, esi
mov dword [0x4500a0], esi
jmp 0x4158d8
mov dword [esp], 0x4500a8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x415991
mov eax, dword [0x4500a4]
test eax, eax
jne 0x4158c8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x4500a4]
test eax, eax
je 0x41592d
jmp 0x4158c8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x415985
mov dword [esp + 4], eax
mov eax, dword [0x45a560]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4159ba
test edx, edx
je 0x4159a5
mov dword [ebp - 0x3c], 1
call fcn.00415230
call fcn.004156b0
mov eax, 1
mov dword [0x4500a4], eax
jmp 0x4158c8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x415866
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x415981

Function at 0x41aca0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x45abb0]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x41ace0
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0041a950
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x41b090
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x45abb0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x41b16c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x41b181
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x41b140
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x41b0d8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x41b0e8
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x41b133
test edx, edx
jne 0x41b126
test ecx, ecx
je 0x41b0d0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x41b190
cmp eax, 8
je 0x41b0d0
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x41b0c2
call fcn.0041aa60
mov eax, dword [0x45abb0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x41b0b4
call fcn.0041ad00
mov eax, dword [0x45abb0]
jmp 0x41b0b4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0041b000
cmp eax, 7
jne 0x41b12b
mov eax, dword [0x45abb0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x41b1e3
mov edi, dword [eax + 0x30]
test edi, edi
js 0x41b20e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x41b1ef
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0041aa60
mov eax, dword [0x45abb0]
jmp 0x41b1c1
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x41b1d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41b1d2
call fcn.0041ad00
mov eax, dword [0x45abb0]
jmp 0x41b1c8
Function at 0x41b470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x45abb0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x41b504
mov esi, dword [eax + 0x30]
test esi, esi
js 0x41b520
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x41b540
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x41b4f8
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0041b000
cmp eax, 7
jne 0x41b5bf
mov eax, dword [0x45abb0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x41b596
mov edx, dword [eax + 0x30]
test edx, edx
js 0x41b5b0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x41b570
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0041b220
jmp 0x41b4b5
call fcn.0041aa60
mov eax, dword [0x45abb0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x41b490
lea esi, [esi]
call fcn.0041ad00
mov eax, dword [0x45abb0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x41b49b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x41b49e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x41b4e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41b4e7
call fcn.0041aa60
mov eax, dword [0x45abb0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x41b4d9
nop
lea esi, [esi]
call fcn.0041ad00
mov eax, dword [0x45abb0]
jmp 0x41b4d9
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x41b5d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x41b662
mov eax, dword [0x45abb0]
test eax, eax
je 0x41b656
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x41b6d1
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x41b677
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0041b220
cmp eax, 7
jne 0x41b6ef
mov eax, dword [0x45abb0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x41b6c2
mov edx, dword [eax + 0x30]
test edx, edx
js 0x41b6e0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x41b6a3
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0041aa60
mov eax, dword [0x45abb0]
jmp 0x41b5f2
mov dword [esp], edi
call fcn.0041b090
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x41b607
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x41b645
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41b645
call fcn.0041aa60
mov eax, dword [0x45abb0]
jmp 0x41b630
call fcn.0041ad00
mov eax, dword [0x45abb0]
jmp 0x41b5fd
call fcn.0041ad00
mov eax, dword [0x45abb0]
jmp 0x41b63b
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40288e
pop dword [ebp - 0x4c]
mov eax, 0x7c627b16
sub eax, 0x7c225288
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xc97b6938
sub dword [ebp - 0x5c], 0x7b2923ed
mov dword [ebp - 0x58], 0x25961006
add dword [ebp - 0x58], 0xc9d3c3f
mov dword [ebp - 0x54], 0x83546464
add dword [ebp - 0x54], 0xc8f7dfca
mov dword [ebp - 0x50], 0xc18cdca0
sub dword [ebp - 0x50], 0xc18cdca0
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x6b62503a
add dword [ebp - 0x5c], 0x910191c
mov dword [ebp - 0x58], 0x480fe5fc
add dword [ebp - 0x58], 0xf95c7b79
mov dword [ebp - 0x54], 0x4b42f8eb
add dword [ebp - 0x54], 0x182c7381
mov dword [ebp - 0x50], 0x79206d8b
add dword [ebp - 0x50], 0x86df9275
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x5c195d98
add eax, 0xa427233c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38f1a
push 0
call eax
mov ecx, 0x6168eb56
sub ecx, 0x616899f2
xor ebx, ebx
add ebx, eax
mov edi, 0xf298a63c
sub edi, 0xf257963c
add edi, dword [ebp - 0x4c]
mov edx, 0x5cd10436
add edx, 0x15d62e10
sub dword [ebp - 0x1c], edx
mov esi, dword [edi]
xor dword [ebp - 0x2c], 0x16a48dac
sub esi, edx
add dword [ebp - 0x18], 0x529bfb8c
mov dword [ebx], esi
sub dword [ebp - 0x3c], ecx
add ebx, 0x1cf37a4c
add ebx, 0xe30c85b8
add edi, 4
loop 0x4029ad
add eax, 0x13863
mov ebx, eax
add eax, 5
mov ecx, 0x1a47f642
sub ecx, 0x1a07f642
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10001560
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10013158]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
push 4
call fcn.10002fa5
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10001605
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10003954
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x1000162e
mov dword [ebp - 0x20], 0
jmp 0x1000163b
mov dword [ebp - 0xc], 0x8123
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003959
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001b10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000b283
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x10013158]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.hide.vmp.dll
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.10002c70
add esp, 8
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x50], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.10001000
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x90]
call fcn.100013a0
push 2
lea ecx, [ebp - 0x28]
call fcn.10002010
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x10001c87
push 0
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
call fcn.10002fa5
add esp, 4
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll__lread]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10002eb0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x78], 0
xor edx, edx
mov dword [ebp - 0x77], edx
mov dword [ebp - 0x73], edx
mov dword [ebp - 0x6f], edx
mov dword [ebp - 0x6b], edx
mov dword [ebp - 0x67], edx
mov dword [ebp - 0x63], edx
mov dword [ebp - 0x5f], edx
mov byte [ebp - 0x5b], dl
mov eax, dword [ebp - 0x38]
add eax, 0x8ce0
mov dword [ebp - 0x58], eax
mov ecx, 1
test ecx, ecx
je 0x10001c4a
push 4
mov edx, dword [ebp - 0x38]
add edx, 0x8ce0
push edx
push 0xffffffffffffffff
call fcn.10001560
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x10001c40
jmp 0x10001c4a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001c19
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x38]
push eax
call dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
push edx
call fcn.10003954
add esp, 4
cmp dword [ebp - 0x3c], 0
jne 0x10001c7a
mov dword [ebp - 0x44], 0
jmp 0x10001c87
mov dword [ebp - 0x2c], 0x8123
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100013a0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003959
mov esp, ebp
pop ebp
ret 4