joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa94058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa941a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9406a
add dl, dl
jne 0xa94089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa940dc
xor eax, eax
add dl, dl
jne 0xa94096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9417d
add dl, dl
jne 0xa940a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa940d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa94075
mov eax, 1
add dl, dl
jne 0xa940ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa940e1
sub eax, ebx
mov ebx, 1
jne 0xa94128
mov ecx, 1
add dl, dl
jne 0xa9410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa94119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa94105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa94075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa94136
cmp eax, 0x7d00
jae 0xa9416d
cmp eax, 0x500
jb 0xa94168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa94075
cmp eax, 0x7f
ja 0xa94170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa94075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa94075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x715712b0
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5f7f1839
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100029f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10002a51
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10002a34
cmp edi, 2
jb 0x10002a34
cmp byte [esi], cl
jne 0x10002a34
cmp byte [esi + 1], cl
jne 0x10002a34
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10036ee8]
jmp 0x10002a05
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10036ee8]
test edi, edi
jne 0x10002a05
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10002a80
cmp cl, 0x23
jne 0x10002a67
cmp byte [esi], cl
jne 0x10002a67
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10036ee8]
test cl, cl
jne 0x10002a58
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10002c55
push 0x599
push str.C:UsersAK3D_ObjectsImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002c62
mov dword [edi], 0
mov edx, 0x10036be4
mov ecx, esi
call fcn.10002a90
mov esi, eax
test esi, esi
je 0x10002d52
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10002d48
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002d48
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10002d48
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002d48
mov eax, dword [0x1003f778]
test eax, eax
je 0x10002cdc
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10002d48
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x10002d2d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1003f778]
add esp, 4
test eax, eax
je 0x10002d1a
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002d3f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x10004db8
push 0x502
push str.C:UsersAK3D_ObjectsImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10036ee8]
sub edi, 1
jne 0x10004dd2
mov ecx, dword [0x1003f778]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19e4], eax
jne 0x10004e04
mov dword [ecx + 0x19e8], eax
cmp dword [ecx + 0x1a18], eax
jne 0x10004e13
mov byte [ecx + 0x1a1c], 1
pop ebp
ret 4

Function at 0x10007690
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x100076a9
cmp byte [edi + 0x2d2c], 0
je 0x100076c1
push 0xed0
push str.C:UsersAK3D_ObjectsImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], str.Window
mov al, 0x57
mov esi, 0x100353a1
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x100076ee
cmp byte [esi], al
jne 0x100076ee
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10036ee8]
test al, al
jne 0x100076e0
mov esi, dword [edi + 0x2d40]
not edx
mov ecx, dword [edi + 0x2d44]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x10014380
mov dword [ebp - 0x10], 0x100143e0
mov dword [ebp - 0xc], 0x100144b0
cmp esi, ecx
jne 0x100077be
inc esi
test ecx, ecx
je 0x10007745
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1000774a
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x100077be
mov eax, dword [0x1003f778]
test eax, eax
je 0x10007762
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, dword [edi + 0x2d48]
add esp, 4
mov dword [ebp - 4], eax
test ebx, ebx
je 0x100077b2
mov ecx, dword [edi + 0x2d40]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x1003f778]
add esp, 0xc
test eax, eax
je 0x100077a5
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
mov dword [edi + 0x2d48], eax
mov dword [edi + 0x2d44], esi
mov eax, dword [edi + 0x2d40]
movups xmm0, xmmword [ebp - 0x1c]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d48]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d40]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008be0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10008c1f
cmp bl, 0x23
jne 0x10008c01
cmp byte [esi], bl
jne 0x10008c01
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10036ee8]
test bl, bl
jne 0x10008bf2
mov ecx, dword [0x1003f778]
not eax
mov esi, dword [ecx + 0x19a0]
mov edi, dword [ecx + 0x19a8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10008c5e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10008c58
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10008c5a
mov esi, edx
test esi, esi
jne 0x10008c40
cmp edi, ebx
je 0x10008c6d
cmp dword [edi], eax
jne 0x10008c6d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10013ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x1003f778]
push edi
cmp byte [esi + 0x2d58], 0
je 0x10013b7f
cmp dword [esi + 0x2d60], 0
lea edi, [esi + 0x2d64]
je 0x10013b71
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10013b29
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100150a0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.100031f0
mov edx, dword [edi]
mov ecx, 0x1003f774
push dword [esi + 0x2d60]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d6c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.100031f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x1003f778]
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov dword [esi + 0x2d30], 0
test eax, eax
je 0x1001436f
lea edi, [esi + 0x2d34]
mov dword [esi + 0x2d30], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x100142b5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100150a0
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x100142ca
push 8
mov ecx, edi
call fcn.100150a0
mov eax, dword [edi]
xor ebx, ebx
mov ecx, dword [edi + 8]
mov byte [ecx + eax], 0
inc dword [edi]
mov eax, dword [esi + 0x2d40]
test eax, eax
jle 0x1001432c
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x10014305
push 0x4f8
push str.C:UsersAK3D_ObjectsImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [esi + 0x2d48]
add eax, ecx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
inc ebx
mov eax, dword [esi + 0x2d40]
add ecx, 0x18
add esp, 0xc
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x10014305
mov edi, dword [edi]
mov ebx, 0x1003f774
mov ecx, dword [ebp - 8]
mov edx, 0x10036c48
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2d3c]
test eax, eax
cmovne ebx, eax
call fcn.10002a90
mov esi, eax
test esi, esi
je 0x1001436f
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002fb00
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1002fbfa
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1002fbf3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x1002fbd9
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1002fbd9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1002fbd9
mov edx, dword [esi]
test edx, edx
jne 0x1002fba2
push 0x200
push edx
push dword [0x1003f780]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1002fbf3
jmp 0x1002fbcd
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1002fbcd
shl eax, 3
push eax
push edx
push 0
push dword [0x1003f780]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1002fbf3
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1002fb61
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1002fc3f
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1002fc3f
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1002fc39
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.1002f990
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1002fc06
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031f1c
mov esp, ebp
pop ebp
ret
Function at 0x1002fc50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x1003f8e0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1002fcb1
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031f1c
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1002fcd2
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1002fcf3
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1002fcf3
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1002fced
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1002fcf3
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.10031f1c
mov esp, ebp
pop ebp
ret
Function at 0x1002fd50
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x1003f8e8]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x1002fe41
mov eax, dword [0x1003f8e0]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x1002fd95
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x1002fd78
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1002fe41
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.1002fb00
mov ecx, dword [0x1003f8e8]
add esp, 4
cmp esi, ecx
jae 0x1002fdf5
imul edi, esi, 0x2c
mov eax, dword [0x1003f8e0]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1002fdea
mov edx, ebx
mov ecx, esi
call fcn.1002fc50
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002fdf2
mov ecx, dword [0x1003f8e8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x1002fdc1
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002fe41
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1002fe32
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1002fe26
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1002fe05
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1003f780]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030190
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, 1
mov ecx, 0x1003f77c
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
je 0x100301e5
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp esi, 0x20
jae 0x100301c9
push 0
jmp 0x100301cb
push 1
call ebx
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x1003f77c
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100301c0
mov ebx, dword [ebp - 4]
cmp dword [0x1003f780], 0
je 0x100302b8
test ebx, ebx
jne 0x10030204
mov ecx, edi
call fcn.1002fd50
mov edi, eax
jmp 0x100302bd
mov ecx, dword [0x1003f8e8]
xor esi, esi
test ecx, ecx
je 0x10030224
mov edx, dword [0x1003f8e0]
mov eax, edx
cmp ebx, dword [eax]
je 0x1003022e
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x10030218
mov edi, 4
jmp 0x100302bd
cmp esi, 0xffffffff
je 0x10030224
imul eax, esi, 0x2c
movzx eax, byte [eax + edx + 0x14]
shr eax, 1
and eax, 1
cmp eax, edi
je 0x100302af
push 1
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.1002fb00
add esp, 4
mov edx, edi
mov ecx, esi
call fcn.1002fc50
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
test eax, eax
je 0x100302bd
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1003029e
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10030292
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10030271
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1003f780]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100302bd
neg edi
sbb edi, edi
add edi, 6
jmp 0x100302bd
mov edi, 2
xor eax, eax
mov ecx, 0x1003f77c
xchg dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10031df8
sub eax, 1
jne 0x10031e2d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x10031d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
cmp dword [0x1003f830], 0
je 0x10031e2d
xor edx, edx
xor ecx, ecx
call fcn.10030190
push dword [0x1003f81c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x1003f81c], 0
mov dword [0x1003f830], 0
mov eax, 1
pop ebp
ret 0xc
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
push ebx
pop eax
and eax, 0x1f
push ebx
pop edx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
sub eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
push eax
pop edi
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
mov esi, eax
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
or eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219