joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100100f0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100104e0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10036608], 0
jne 0x1001012d
cmp dword [0x10036604], 0
je 0x1001012d
mov eax, dword [0x10036604]
mov dword [0x10036608], eax
cmp dword [0x10036608], 0
je 0x100101aa
mov ecx, dword [0x10036608]
cmp dword [ecx + 8], 0
je 0x100101aa
mov edx, dword [0x10036608]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x100101aa
mov ecx, dword [0x10036608]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100101aa
mov eax, dword [0x10036608]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10010179
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10010180
xor eax, eax
jmp 0x100102c9
mov ecx, dword [0x10036608]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10015970
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100102c9
mov edx, dword [0x10036604]
mov dword [0x10036608], edx
jmp 0x100101c6
mov eax, dword [0x10036608]
mov ecx, dword [eax + 4]
mov dword [0x10036608], ecx
cmp dword [0x10036608], 0
je 0x10010206
cmp dword [0x10036608], 0
je 0x10010204
mov edx, dword [0x10036608]
cmp dword [edx + 8], 0
je 0x10010204
mov eax, dword [0x10036608]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10010204
mov edx, dword [0x10036608]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10010204
jmp 0x1001015e
jmp 0x100101b8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100102d0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100102c7
mov eax, dword [ebp - 0x18]
mov dword [0x10036608], eax
mov ecx, dword [0x10036608]
mov dword [ecx], 0x52727464
mov edx, dword [0x10036608]
mov dword [edx + 8], 0
mov eax, dword [0x10036608]
mov ecx, dword [0x10036604]
mov dword [eax + 4], ecx
mov edx, dword [0x10036608]
mov dword [0x10036604], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10036608]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10010297
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x100102b7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1001028e
mov eax, dword [0x10036608]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1001015e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10011010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10036604]
mov dword [ebp - 4], eax
jmp 0x10011029
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10011050
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1001104e
call sub.KERNEL32.dll_GetLastError
jmp 0x10011052
jmp 0x10011020
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100114f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10036614], eax
je 0x1001150d
mov eax, 0x10dd
jmp 0x100115f0
mov eax, dword [0x10036624]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001158c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10011568
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10011568
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10010570
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10012abf
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10011515
mov dword [0x10036624], 0
call fcn.10010e50
mov ecx, dword [0x10036620]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100115da
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10012abf
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100115a4
mov dword [0x10036620], 0
mov dword [0x10036614], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10011ad0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10036618], 0
je 0x10011ae9
mov eax, dword [0x10036618]
jmp 0x10011b88
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x10011afa
xor eax, eax
jmp 0x10011b88
push 8
call fcn.10012e2b
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10011b52
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10011b3b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10012abf
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10036618], eax
mov dword [0x1003661c], 0
mov eax, dword [ebp - 8]
jmp 0x10011b88
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x10011b6a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10011b1a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10036620]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10036620], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x59fca8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], cx
rdtsc
lea ebx, [esp + 0x20]
mov byte [esp + 2], ah
jmp 0x59fce4
push word [esp + 3]
js 0x59fc92
mov word [esp + 1], cx
jmp 0x59fd1c
lea esp, [esp + 2]
lea esp, [esp + 4]
neg esi
mov dh, byte [esp]
jmp 0x59fcce
rdtsc
lea ebx, [esp + 0x20]
mov byte [esp + 2], ah
lea esp, [esp + 2]
jmp 0x59fce8

Function at 0x59fdde
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0xb1ef8ebc
inc ax
call fcn.0059fe73
xor dword [ebx + reloc.MSVCRT.dll_strncpy], ebp
dec esi
fnstcw word [eax]
sbb eax, dword [edi + 0xcec1c3]
neg ax
jmp 0x59fe79
rdtsc
rdtsc
call fcn.0059fec7
fld qword [esi - 0x2c]
mov bl, 0x4e
invalid
jl 0x59fe45
rdtsc
rdtsc
jmp 0x59fe85
ror esi, 0
jmp 0x5a09e0
mov bx, word [esp]
rdtsc
xchg ebx, edx
mov al, 0x90
jmp 0x5a0312
xchg ebx, edx
mov al, 0x90
jae 0x59fe8e
mov bx, word [esp]
rdtsc
jmp 0x5a03e1
Function at 0x5ac4cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5ac508
lea esp, [esp + 2]
mov dword [esp], edx
call fcn.005ac4d1

Function at 0x5ac4d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
push eax
rdtsc
mov edx, dword [esp]
jmp 0x5ac4f2

Function at 0x5ac4e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 2]
call fcn.005ac4cf
lea edx, [edi*4]
rdtsc
mov ax, word [esp]
xchg al, dh
jmp 0x5ac52a
mov edx, 0x97979a16
push ebx
mov al, 0x1e
pushfd
call fcn.005ac514

Function at 0x5ac514
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
rdtsc
popal
call fcn.005931df
pushal
push word [esp + 0x11]
lea esp, [esp + 0x2c]
jmp 0x5ad51a
jmp 0x593200
jmp 0x59322e
push word [esp + 3]
rdtsc
jmp 0x5ac538
mov ax, dx
mov eax, dword [esp + 3]
lea esp, [esp + 2]
mov ebx, dword [esp + 8]
jmp 0x5ac58a
mov edx, dword [esp + 0x10]
lea esp, [esp + 0x14]
jmp 0x59331f
xchg dh, dl
not dh
mov dh, byte [esp]
lea edx, [eax + 0x3b]
not edx
xchg dh, dl
jmp 0x5ac559
lea edx, [esi + 0xbb]
mov ah, 6
xchg edx, eax
mov dl, 0xdd
not dx
mov eax, dword [esp + 0xc]
jmp 0x5ac56f
pushfd
lea esp, [esp + 4]
call fcn.005e1b29
and al, 0x78
ljmp 0x228b

Function at 0x5ac5df
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x592e88
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
cpuid
nop
jmp 0x592e9f
pop ebx
ret
jmp 0x592e7c

Function at 0x5ad1c7
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
pushal
jmp 0x591c75
push edx
jmp 0x591c99
lea esp, [esp + 0x20]
and dword [eax], 0
mov dword [eax + 8], 0x819d62ae
jmp 0x591c5f
mov edx, eax
jmp 0x5d325c
lea esp, [esp + 8]
jmp 0x591c30
lea edx, [edx + 0xc]
push edi
mov edi, 0x932b2661
lea edi, reloc.MSVCRT.dll_strncpy
call fcn.005d3226
Function at 0x3080194f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x308249ec]
jne 0x30801959
repz ret
jmp fcn.3081a014

Function at 0x30807ed2
Capabilities:
Get file attributes

Disassembly:
push 0x58
mov eax, 0x3081ac18
call fcn.3081997e
mov eax, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 4], esi
xor ebx, ebx
call fcn.30807c9a
pop ecx
pop ecx
test eax, eax
je 0x30807f69
push str.__
lea ecx, [ebp - 0x64]
call fcn.308143b5
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.308143b5
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.308143b5
push esi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.308143b5
push esi
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.308143b5
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807f60
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x2c]
and bl, 1
call fcn.308143b5
mov al, bl
call fcn.308199b4
ret
Function at 0x30807f83
Capabilities:
Create directory

Disassembly:
push 0x88
mov eax, 0x3081ac6d
call fcn.3081997e
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x10]
push str.__
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x8c], eax
call fcn.308143b5
push esi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.308143b5
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.308143b5
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807fe2
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push 0x5c
pop esi
cmp word [eax + ecx*2 - 2], si
je 0x30807ffa
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.308143b5
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x94], esi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x90]
push 1
push dword [ebp - 0x88]
lea eax, [ebp - 0x94]
push eax
call fcn.308143b5
mov ecx, dword [ebp - 0x90]
mov esi, eax
cmp esi, edi
je 0x30808078
sub eax, dword [ebp - 0x88]
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.308143b5
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.308143b5
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.308143b5
push 0x5c
push 1
lea ecx, [ebp - 0x2c]
call fcn.308143b5
inc esi
mov dword [ebp - 0x88], esi
jmp 0x308080ac
push edi
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.308143b5
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.308143b5
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.308143b5
mov dword [ebp - 0x88], edi
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x308080b8
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
setne byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x308080f5
push edi
push 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.308143b5
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 5
call fcn.308143b5
lea ecx, [ebp - 0x48]
jmp 0x30808153
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x30808106
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x88], edi
jne 0x30808009
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
sete byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x3080816b
push edi
push 4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.308143b5
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 6
call fcn.308143b5
lea ecx, [ebp - 0x64]
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.308143b5
cmp dword [ebp - 0x88], edi
jne 0x30808009
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.308143b5
mov al, byte [ebp - 0x81]
call fcn.308199b4
ret
Function at 0x30808ae4
Capabilities:
Enumerate process modules

Disassembly:
push 0x20
mov eax, 0x3081ae31
call fcn.30801ee1
push dword [ebp + 8]
xor edi, edi
push edi
push 0x410
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
je 0x30808b87
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], edi
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x30808b87
push 0x20
pop esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
push edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.308143b5
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
push ebx
call sub.psapi.dll_GetModuleBaseNameA
cmp eax, esi
jb 0x30808b62
push edi
add esi, esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.308143b5
cmp esi, 0x208
jbe 0x30808b3d
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
je 0x30808b7b
mov dword [ebp - 0x14], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.30806a0c
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x30808c2f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x138
mov eax, 0x3081ae8b
call fcn.3081997e
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x138], edi
cmp ebx, edi
je 0x30808d1c
lea eax, [ebp - 0x134]
push eax
call fcn.30808b97
pop ecx
cmp dword [ebp - 0x120], 0x10
mov eax, dword [ebp - 0x134]
mov dword [ebp - 4], edi
jae 0x30808c76
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x13c]
push ecx
push 1
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x30808d0a
mov esi, 0x105
push esi
lea eax, [ebp - 0x118]
push edi
push eax
mov dword [ebp - 0x140], 0x104
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push ebx
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x30808cfe
mov eax, dword [0x30825cd8]
push esi
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x138], eax
cmp eax, edi
je 0x30808cfe
push esi
lea ecx, [ebp - 0x118]
push ecx
push esi
push eax
call dword [sym.imp.MSVCR100.dll_strncpy_s]
add esp, 0x10
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x134]
call fcn.308143b5
mov eax, dword [ebp - 0x138]
call fcn.308199b4
ret
Function at 0x30809222
Capabilities:
Enumerate process modules

Disassembly:
push 0x24
mov eax, 0x3081af3b
call fcn.30801ee1
xor ebx, ebx
push 8
pop esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.308143b5
push 0x20
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x30]
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x3080928c
mov eax, dword [ebp - 0x18]
cmp eax, edi
jb 0x30809285
push ebx
add esi, esi
push esi
lea ecx, [ebp - 0x30]
call fcn.308143b5
mov edi, esi
shl edi, 2
jmp 0x30809294
shr eax, 2
mov esi, eax
jmp 0x30809291
xor esi, esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
jne 0x3080925a
cmp dword [ebp - 0x14], ebx
je 0x308092c8
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.308143b5
cmp esi, ebx
jbe 0x308092c8
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, edi
call fcn.308143b5
add ebx, 4
dec esi
jne 0x308092ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.30806a0c
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x308143b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x308143c4
pop dword [ebp - 0x34]
mov eax, 0x2965bf28
add eax, 0x71b849c
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xd8a95067
sub dword [ebp - 0x44], 0x8a570b1c
mov dword [ebp - 0x40], 0x8328a6d1
sub dword [ebp - 0x40], 0x50f55a8c
mov dword [ebp - 0x3c], 0x9835e070
sub dword [ebp - 0x3c], 0x4be99c42
mov dword [ebp - 0x38], 0xc12c12d6
sub dword [ebp - 0x38], 0xc12c12d6
lea eax, [ebp - 0x44]
push eax
mov eax, 0xb9ff4cdf
add eax, 0x76828375
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9366850c
sub dword [ebp - 0x44], 0x1ef41bb6
mov dword [ebp - 0x40], 0xb47d9e94
sub dword [ebp - 0x40], 0x73113d1f
mov dword [ebp - 0x3c], 0x72c0b18c
add dword [ebp - 0x3c], 0xf0aebae0
mov dword [ebp - 0x38], 0x54c50675
sub dword [ebp - 0x38], 0x54c50675
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3dc0d
push 0
call eax
mov ecx, 0xa370f56
add ecx, 0xf5c93b96
xor ebx, ebx
add ebx, eax
mov esi, 0x3082f200
add esi, dword [ebp - 0x34]
mov edi, 0x7ef46bce
mov dword [ebp - 0x10], 0x3cb1470f
mov edx, dword [esi]
xor edx, edi
xor dword [ebp - 0x28], ecx
mov dword [ebx], edx
add dword [ebp - 0x24], 0x5071389d
add ebx, 0x8ed3d62c
add ebx, 0x712c29d8
add esi, 0xb0de5cb
add esi, 0xf4f21a39
loop 0x308144d7
add eax, 0xd0ff83f0
sub eax, 0xd0fe656d
xor ebx, ebx
add ebx, eax
add eax, 0xcc3da311
add eax, 0x33c25cf4
mov ecx, 0x9b4ece45
sub ecx, 0x6acece45
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x58a3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.058a378f
jae 0x58a370e
xor ecx, ecx
call fcn.058a378f
jae 0x58a373d
xor eax, eax
call fcn.058a378f
jae 0x58a374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.058a378f
adc al, al
jae 0x58a372f
jne 0x58a3779
stosb byte es:[edi], al
jmp 0x58a3711
call fcn.058a379b
sub ecx, ebx
jne 0x58a3756
call fcn.058a3799
jmp 0x58a3775
lodsb al, byte [esi]
shr eax, 1
je 0x58a3783
adc ecx, ecx
jmp 0x58a3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.058a3799
cmp eax, 0x7d00
jae 0x58a3772
cmp ah, 5
jae 0x58a3773
cmp eax, 0x7f
ja 0x58a3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x58a3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x58bea1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x100]
lodsb al, byte [esi]
or al, al
je 0x58bea45
inc ecx
test cl, 3
je 0x58bea42
shl eax, 8
jmp 0x58bea32
stosd dword es:[edi], eax
jmp 0x58bea32
mov al, 0x80
push ecx
inc ecx
test cl, 3
je 0x58bea53
shl eax, 8
jmp 0x58bea48
stosd dword es:[edi], eax
xor eax, eax
jmp 0x58bea5c
stosd dword es:[edi], eax
add ecx, 4
cmp ecx, 0x3c
jb 0x58bea58
pop eax
shl eax, 3
stosd dword es:[edi], eax
sub ecx, 0xc
mov eax, dword [edi - 0x3c]
push ecx
mov ecx, eax
mov edx, eax
ror eax, 7
ror ecx, 0x12
shr edx, 3
xor eax, ecx
xor eax, edx
push eax
mov eax, dword [edi - 8]
mov ecx, eax
mov edx, eax
ror eax, 0x11
ror ecx, 0x13
shr edx, 0xa
xor eax, ecx
xor eax, edx
add dword [esp], eax
pop eax
add eax, dword [edi - 0x40]
pop ecx
add eax, dword [edi - 0x1c]
stosd dword es:[edi], eax
loop 0x58bea69
call int.058beac6
out 9, al
push 0xffffffffffffff85
scasb al, byte es:[edi]
mov ebx, 0x3c6ef372
cmp dh, ch
dec edi
movsd dword es:[edi], dword [esi]
jg 0x58beb0a
push cs
push ecx
mov word [eax + 5], gs
wait
stosd dword es:[edi], eax
fld dword [ebx - 0x1f32e6e1]
pop ebx
invalid

Function at 0x115473c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1154746
pushal
call 0x115474c
pop ebp
sub ebp, 0x10
sub ebp, 0xd5473c
jmp 0x1154762
mov eax, 0xd5473c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0x1b97f233
xor byte [eax], dl
inc eax
dec ecx
jne 0x1154779
jmp 0x115478c
mov eax, 0xfbab8fe
xor esi, dword [ebx]
xor esi, dword [edx + 0x3333cbf2]
xor esi, dword [eax]
dec byte [ebx + 0x33333334]
mov dword [ebx], ebx
xor esi, dword [ebx]
xor eax, esp
sal dword [eax], 1
sti
mov eax, 0x33333fb2
xor esi, dword [eax]
mul byte [ebx - 0x42]
push edi
pop ss
iretd
Function at 0x1003c41
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
sub ecx, dword [ebp + 0x10]
test edx, edx
je 0x1003c70
mov eax, dword [ebp + 8]
push esi
push edi
movzx esi, byte [eax]
movzx edi, cl
xor esi, edi
shr ecx, 8
xor ecx, dword [esi*4 + 0x100e020]
inc eax
dec edx
jne 0x1003c58
pop edi
pop esi
or eax, 0xffffffff
sub eax, ecx
pop ebp
ret 0xc

Function at 0x10065ee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x1000
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [edi], ebx
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x1006639
push dword [ebp + 8]
push 0x1001860
push 0x10023f0
push dword [ebp + 0x10]
call fcn.01008969
add esp, 0x10
xor eax, eax
jmp 0x10066c2
lea eax, [ebp - 0xc]
push eax
push 0x8000
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__open]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1006695
push dword [ebp + 8]
push 0x1001860
push 0x10023d8
push dword [ebp + 0x10]
call fcn.01008969
add esp, 0x10
jmp 0x10066b5
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp eax, 0xffffffff
je 0x10066c9
test eax, eax
je 0x1006695
push dword [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.01003c41
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.msvcrt.dll__eof]
test eax, eax
pop ecx
je 0x100666f
mov eax, dword [ebp - 4]
mov dword [ebp - 8], 1
mov dword [edi], eax
push ebx
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp + 8]
push 0x1001860
push 0x10023b4
push dword [ebp + 0x10]
call fcn.01008969
add esp, 0x10
jmp 0x10066ad