joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb9bd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, ecx
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 0x20]
push ebx
push edi
mov dword [ebp - 0x28], eax
mov eax, dword [eax]
mov edi, dword [eax + 0x6c]
imul edi, dword [eax + 0x60]
mov ebx, dword [eax + 0x20]
add edi, ebx
cmp ebx, edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], edi
jae 0x4bbad5
push esi
mov esi, 0xf0
mov edx, dword [eax + 0x60]
mov eax, dword [eax + 0x68]
add eax, ebx
add edx, ebx
cmp ebx, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], eax
jae 0x4bbab5
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
movzx edi, byte [ebx + 1]
mov dword [ebp - 4], ecx
movzx ecx, byte [ebx]
mov ebx, ecx
and ebx, 0xf
mov edx, eax
and edx, 0xf
add edx, ebx
mov ebx, dword [ebp - 4]
and ebx, 0xf
add edx, ebx
mov dword [ebp - 0x1c], ecx
and cx, si
mov ebx, edi
and ebx, 0xf
lea edx, [edx + ebx + 2]
mov ebx, eax
and bx, si
shr edx, 2
and ax, si
add ebx, ecx
mov ecx, dword [ebp - 4]
and cx, si
add ebx, ecx
mov ecx, edi
and cx, si
and di, si
lea ecx, [ebx + ecx + 0x20]
shr ecx, 2
xor dl, cl
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
and cx, si
and dl, 0xf
add eax, ecx
mov ecx, dword [ebp - 4]
and cx, si
add eax, ecx
lea eax, [eax + edi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [eax], dl
mov edx, dword [ebp - 0x10]
inc ebx
inc ebx
inc edx
inc edx
cmp ebx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edx
jb 0x4bba15
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
add ecx, dword [edx + 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 0x60]
lea ebx, [ebx + edx*2]
cmp ebx, edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
jb 0x4bb9f7
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x4ca523
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
jne 0x4ca546
mov eax, 0x8876086c
jmp 0x4ca65b
cmp dword [ebp + 0xc], esi
push ebx
je 0x4ca5de
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x4ca5be
mov ebx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
push eax
mov dword [ebp + 0xc], eax
call fcn.0047058f
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
jne 0x4ca5a2
mov eax, 0x8007000e
jmp 0x4ca65a
push esi
push esi
push dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0xc], esi
je 0x4ca5de
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileW]
jmp 0x4ca5f7
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
push dword [ebp - 4]
mov dword [edi], eax
call fcn.0047059d
mov eax, dword [edi]
cmp eax, 0xffffffff
pop ecx
je 0x4ca648
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x4ca648
push esi
push dword [edi]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x4ca648
cmp eax, esi
je 0x4ca655
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x4ca658
call dword [sym.imp.kernel32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x4ca65a
mov dword [edi + 8], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x4e43d9
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ecx + 4]
test esi, esi
je 0x4e43fa
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x4e43fc
xor eax, eax
mov dword [edx], eax
movzx eax, word [ecx + 8]
mov dword [edx + 4], eax
movzx eax, word [ecx + 0xa]
mov dword [edx + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 2]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 6]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 0xa]
mov dword [edx + 0x24], eax
mov eax, dword [edx + 0x20]
imul eax, dword [edx + 0x18]
imul eax, dword [edx + 0x1c]
shl eax, 2
mov dword [edx + 0x28], eax
mov esi, dword [ecx + 0x14]
test esi, esi
je 0x4e446f
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x4e4471
xor eax, eax
pop edi
mov dword [edx + 0x2c], eax
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x4e87b8
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4e8828
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5848ac
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e881f
cmp dword [ebp - 0xc], 4
jne 0x4e881f
cmp dword [ebp - 0x10], edi
je 0x4e881f
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [0x5b03d8], edi
xor eax, eax
jmp 0x4e8867
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [0x5b03d8], edi
jge 0x4e8862
lea eax, [ebp - 0x34]
push eax
mov dword [0x5b03d8], edi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x4e8862
cmp word [ebp - 0x14], 5
jb 0x4e8862
call fcn.004e8790
test eax, eax
je 0x4e8862
emms
mov dword [0x5b03d8], 1
mov eax, dword [0x5b03d8]
pop edi
leave
ret
Function at 0x505c4a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
imul esi, esi, 0x64
mov edi, dword [ebp + 8]
imul edi, edi, 0x64
add edi, dword [ecx + 0x2c]
mov dword [ebp - 4], ecx
add esi, dword [edi + 4]
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [ebx + 0xc]
add eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x118], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], ecx
jne 0x505cc0
push ecx
push ecx
call fcn.00479e2c
mov ecx, dword [ebp - 4]
push 0x30000
push 0
mov dword [ecx + 0x114], eax
call fcn.00479e2c
mov eax, dword [ebp - 4]
add esp, 0x10
or dword [eax + 0x118], 1
xor edx, edx
cmp dword [esi + 0x3c], edx
je 0x505d9b
mov ecx, dword [edi]
mov eax, dword [ebx + 0x10]
add eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x14]
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
add eax, ecx
cmp word [esi + 0x4e], dx
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], edx
jbe 0x505d8d
movzx ecx, word [ebp + 8]
shl ecx, 5
add ecx, dword [esi + 0x34]
cmp dword [ecx], edx
je 0x505d7a
mov eax, dword [ecx + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0x10]
movzx edx, word [eax + 4]
sub edx, 0
je 0x505d55
dec edx
je 0x505d2e
dec edx
jne 0x505d7a
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0x10]
jmp 0x505d43
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0x14]
push dword [esi + 0x3c]
push edx
push eax
push dword [ecx + 0xc]
mov ecx, dword [ebp - 4]
call fcn.005050e4
jmp 0x505d7a
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
push dword [esi + 0x3c]
movzx eax, word [eax + 6]
push edx
mov edx, dword [ebp - 0x18]
lea eax, [edx + eax*8]
push eax
push dword [ecx + 0xc]
mov ecx, dword [ebp - 4]
call fcn.0050547d
inc dword [ebp + 8]
mov ax, word [ebp + 8]
xor edx, edx
cmp ax, word [esi + 0x4e]
jb 0x505cf2
mov edi, dword [edi]
add edi, dword [ebx + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push edx
push dword [ebp + 8]
push edx
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 8]
push edx
push dword [ebp - 0xc]
push edx
push dword [esi + 0x44]
push dword [esi + 0x40]
call fcn.004c9bf9
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x512fe0
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x513003
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x513029
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x513010
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x5130e0
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x513117
push esi
call fcn.00544ea0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x513110
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x513196
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x513180
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x51313a
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x513179
cmp eax, 2
je 0x513180
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x513130
cmp eax, 3
je 0x51315d
cmp eax, 1
jne 0x513130
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x513130
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x513130
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.00512fe0
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x5131ad
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.00512fe0
pop esi
pop ebp
ret 4

Function at 0x5199bd
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov dword [esi + 4], ecx
lea eax, [ecx + eax - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 4], eax
jne 0x519a02
mov ecx, 0x100000
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x546326
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x546335
xor eax, eax
jmp 0x546418
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x5463f8
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
inc edx
dec edi
jne 0x546355
pop edi
test eax, eax
je 0x546412
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x594480]
inc edx
dec eax
jne 0x5463fc
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x5465b9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x5465e5
test ecx, ecx
jne 0x5465ef
test esi, esi
jne 0x5465ef
mov eax, edx
jmp 0x546660
cmp eax, 0xffffffff
jne 0x5465ef
push 0xfffffffffffffffe
pop eax
jmp 0x546660
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x546660
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x546625
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x546644
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x54670d
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x546685
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x54668f
xor ecx, ecx
jmp 0x5466ce
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x5466b1
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.0056cc03
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x5466f9
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x54670d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x5465c7
pop edi
pop esi
leave
ret
Function at 0x573034
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
xor ebx, ebx
cmp dword [0x875d14], ebx
push esi
push edi
jne 0x5730bd
lea eax, [ebp - 0x270]
push 0x208
push eax
mov dword [0x875d14], 1
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x270]
push str._atl.dll
push eax
call fcn.00479470
pop ecx
lea eax, [ebp - 0x270]
pop ecx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x573143
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AtlAxWinInit
push edi
call esi
push str.AtlAxCreateControl
push edi
mov dword [0x875d00], eax
call esi
push str.AtlAxGetControl
push edi
mov dword [0x875d08], eax
call esi
mov dword [0x875d04], eax
push 0x13
mov esi, str.d27cdb6e_ae6d_11cf_96b8_444553540000
pop ecx
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0xd27cdb6c
mov word [ebp - 0x10], 0xae6d
mov word [ebp - 0xe], 0x11cf
mov byte [ebp - 0xc], 0x96
mov byte [ebp - 0xb], 0xb8
mov byte [ebp - 0xa], 0x44
mov byte [ebp - 9], 0x45
mov byte [ebp - 8], 0x53
mov byte [ebp - 7], 0x54
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov dword [ebp - 4], ebx
movsw word es:[edi], word [esi]
call dword [0x875d00]
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x68]
push eax
call dword [0x875d08]
test eax, eax
jne 0x57313f
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x875d04]
test eax, eax
jne 0x57313f
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x14]
push 0x875d10
push edx
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
je 0x573153
xor eax, eax
jmp 0x57318d
push ebx
push ebx
push str.ATL.DLL
push ebx
call dword [sym.imp.user32.dll_MessageBoxA]
jmp 0x57313f
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [0x875d10]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [0x875d10]
lea edx, [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [0x875d10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
inc dword [0x875d0c]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5755b4
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], eax
test eax, eax
je 0x575661
mov esi, eax
mov edx, dword [esi]
xor eax, eax
mov byte [edx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ebx, dword [esi]
mov byte [ebx + 0x18], al
mov ebp, dword [esi]
mov byte [ebp + 0x19], al
mov ebp, dword [esi + 4]
test ebp, ebp
jle 0x57560b
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, ecx
shl edi, 8
shr ecx, 0x18
xor ecx, esi
mov eax, ecx
mov ecx, edi
xor ecx, dword [eax*4 + 0x598fa0]
inc ebx
cmp ebx, ebp
jl 0x5755eb
jmp 0x575611
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [esp]
mov edi, dword [eax + 0xc]
test edi, edi
jle 0x57563f
mov ebp, dword [eax + 8]
xor esi, esi
movzx eax, byte [ebp + esi]
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
xor ecx, eax
mov eax, ecx
mov ecx, ebx
xor ecx, dword [eax*4 + 0x598fa0]
inc esi
cmp esi, edi
jl 0x575620
mov esi, dword [esp]
mov byte [edx + 0x16], cl
mov ebp, dword [esi]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0x17], al
mov ebx, dword [esi]
mov edx, ecx
shr edx, 0x10
mov byte [ebx + 0x18], dl
mov edi, dword [esi]
shr ecx, 0x18
mov byte [edi + 0x19], cl
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x8daa90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x128]
call eax
push eax
push 0x8d97ec
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push 0x10
push eax
movups xmmword [ebp - 0x24], xmm0
call fcn.008d9e30
mov al, byte [ebp - 0x24]
lea edx, [ebp - 0x23]
mov ch, al
add esp, 0x10
xor al, 0x55
mov edi, 1
mov byte [ebp - 0x24], al
mov eax, 2
sub eax, edx
mov dword [ebp - 4], eax
mov eax, 3
mov ebx, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 8], eax
mov eax, 4
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, 5
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, edi
lea esi, [ebp - 0x24]
and eax, 0x1f
add esi, edi
add edi, 5
movzx eax, byte [eax + 0x8d9870]
mov cl, byte [esi]
xor al, cl
mov dl, byte [esi + 1]
xor al, ch
mov ch, byte [esi + 4]
mov byte [esi], al
lea eax, [ebx + esi]
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, dl
xor al, cl
mov cl, byte [esi + 2]
mov byte [esi + 1], al
mov eax, dword [ebp - 8]
add eax, esi
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, cl
xor al, dl
mov dl, byte [esi + 3]
mov byte [esi + 2], al
mov eax, dword [ebp - 0xc]
add eax, esi
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, dl
xor al, cl
mov byte [esi + 3], al
mov eax, dword [ebp - 0x10]
add eax, esi
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, ch
xor al, dl
mov byte [esi + 4], al
cmp edi, 0x10
jb 0x8dab01
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
push 0x10
push ecx
push 0xfc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8dad10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], 1
sete al
ret
Function at 0x1000b610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a17f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.10096ea3
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.1000c910
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x1000b664
jmp dword [ecx*4 + 0x1000b7cc]
mov al, byte [esi]
test al, al
je 0x1000b692
cmp al, 0x20
je 0x1000b67e
cmp al, 0xa1
jne 0x1000b692
cmp byte [esi + 1], al
jne 0x1000b692
test al, 0x80
je 0x1000b68a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1000b692
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1000b671
test ecx, ecx
je case.default.0x1000b664
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x1000b664
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x1000b6d8
cmp dl, 0xa1
jne 0x1000b6cc
cmp byte [eax + 1], 0xa1
jne 0x1000b6cc
test ecx, ecx
jne 0x1000b6c4
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1000b6ec
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x1000b706
jmp 0x1000b6ec
cmp dl, 0x20
jne 0x1000b6ea
test ecx, ecx
jne 0x1000b6e3
mov edi, eax
mov ecx, 1
jmp 0x1000b6ec
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1000b6ac
cmp ecx, 1
jne case.default.0x1000b664
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1000b664
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1000b664
mov al, byte [esi]
test al, al
je 0x1000b75e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x1000b744
mov cl, byte [esi + 1]
test cl, cl
je 0x1000b75e
cmp al, 0xa1
jne 0x1000b734
cmp cl, al
je 0x1000b741
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.1000cbe0
inc esi
jmp 0x1000b756
cmp al, 0x20
je 0x1000b756
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.1000cc20
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1000b71d
push 0
lea ecx, [esp + 0x14]
call fcn.1000cc20
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10015b60
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x1000b791
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x100a7848
call fcn.1000cb10
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10096e35
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret