joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf58110
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0xf77020]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x3b], xmm0
push ebx
movq qword [ebp - 0x2b], xmm0
mov eax, dword [edx + 0x18]
movdqu xmmword [ebp - 0x1f], xmm0
mov dword [ebp - 0x40], eax
mov eax, dword [edx + 0x34]
movq qword [ebp - 0xf], xmm0
movdqu xmm0, xmmword [edx]
mov dword [ebp - 0x5c], eax
xor eax, eax
inc ecx
mov byte [ebp - 0x3c], 0
movdqu xmmword [ebp - 0x58], xmm0
push esi
movq xmm0, qword [edx + 0x10]
movq qword [ebp - 0x48], xmm0
movdqu xmm0, xmmword [edx + 0x1c]
mov word [ebp - 0x23], 0
mov byte [ebp - 0x21], 0
movdqu xmmword [ebp - 0x74], xmm0
mov byte [ebp - 0x20], 0
movq xmm0, qword [edx + 0x2c]
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
movq qword [ebp - 0x64], xmm0
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb4], ecx
push edi
mov edi, edi
movsx ebx, byte [eax + 0xf74160]
mov esi, 0x1c
sub esi, ebx
lea eax, [ebp - 0x58]
add eax, ebx
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00f5f040
push ebx
lea eax, [ebp - 0x58]
mov edi, ebx
push eax
neg edi
lea eax, [ebp - 0x20]
add eax, edi
push eax
call fcn.00f5f040
lea eax, [ebp - 0x74]
add eax, ebx
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00f5f040
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 4]
add eax, edi
push eax
call fcn.00f5f040
push 0x37
lea eax, [ebp - 0xab]
push 0
push eax
call fcn.00f5ef30
movdqu xmm0, xmmword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
add esp, 0x3c
movdqu xmm2, xmmword [ebp - 0x20]
xor eax, eax
mov edi, dword [ebp - 8]
movq xmm1, qword [ebp - 0x2c]
movq xmm3, qword [ebp - 0x10]
mov edx, dword [ebp - 0xb4]
movdqu xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x94], esi
movq qword [ebp - 0x9c], xmm1
movdqu xmmword [ebp - 0x90], xmm2
mov dword [ebp - 0x78], edi
movq qword [ebp - 0x80], xmm3
lea ecx, [ecx]
movsx ecx, byte [eax + 0xf74170]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax - 1], cl
movsx ecx, byte [eax + 0xf74171]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax], cl
movsx ecx, byte [eax + 0xf74172]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 1], cl
movsx ecx, byte [eax + 0xf74173]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 2], cl
movsx ecx, byte [eax + 0xf74174]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 3], cl
movsx ecx, byte [eax + 0xf74175]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 4], cl
add eax, 6
cmp eax, 0x30
jl 0xf58250
mov eax, dword [ebp - 0xb0]
add edx, 0x30
inc eax
movq qword [ebp - 0x48], xmm1
mov dword [ebp - 0x40], esi
movq qword [ebp - 0x64], xmm3
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb4], edx
movdqu xmmword [ebp - 0x58], xmm0
movdqu xmmword [ebp - 0x74], xmm2
cmp eax, 0x10
jl 0xf581a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00f5d4b9
mov esp, ebp
pop ebp
ret 8
Function at 0xf584a0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, 0xf74123
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0xf74120
mov dword [ebp + 0xc], 0x10
mov edi, 0xf74121
mov ebx, 0xf74122
sub esi, eax
sub edi, eax
sub ebx, eax
sub ecx, eax
mov dword [ebp - 4], ecx
dec dword [ebp + 0xc]
lea eax, [eax + 4]
movsx ecx, byte [esi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 4], cl
movsx ecx, byte [edi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 3], cl
movsx ecx, byte [ebx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 4]
movsx ecx, byte [ecx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 1], cl
jne 0xf584d3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xf58520
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, 0xf740f3
mov edx, dword [ebp + 8]
sub ecx, eax
push ebx
mov dword [ebp - 4], ecx
mov ebx, 0xf740f2
push esi
mov ecx, 0xf740f4
mov dword [ebp + 0xc], 8
sub ecx, eax
mov esi, 0xf740f0
push edi
mov dword [ebp - 8], ecx
mov edi, 0xf740f1
mov ecx, 0xf740f5
sub esi, eax
sub edi, eax
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea esp, [esp]
dec dword [ebp + 0xc]
lea eax, [eax + 6]
movsx ecx, byte [esi + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 6], cl
movsx ecx, byte [edi + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 5], cl
movsx ecx, byte [ebx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movsx ecx, byte [ecx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movsx ecx, byte [ecx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movsx ecx, byte [ecx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 1], cl
jne 0xf58570
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xf585e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x10
xor ecx, ecx
test edx, edx
je 0xf586c5
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
cmp edx, 0x20
jb 0xf586a5
lea eax, [ebx - 1]
add eax, edx
cmp esi, eax
ja 0xf5861e
lea eax, [esi - 1]
add eax, edx
cmp eax, ebx
jae 0xf586a5
lea eax, [edi - 1]
add eax, edx
cmp esi, eax
ja 0xf58630
lea eax, [esi - 1]
add eax, edx
cmp eax, edi
jae 0xf586a5
mov eax, edx
mov dword [ebp - 4], edx
mov edx, esi
and eax, 0x1f
sub dword [ebp - 4], eax
sub edx, edi
mov dword [ebp - 8], edx
mov eax, edi
mov edx, ebx
sub edx, edi
mov dword [ebp - 0xc], edx
mov edx, esi
mov esi, dword [ebp - 8]
sub edx, ebx
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
lea edx, [ebx + 0x10]
jmp 0xf58660
movdqu xmm0, xmmword [eax]
mov ebx, dword [ebp - 0x10]
add ecx, 0x20
lea eax, [eax + 0x20]
lea edx, [edx + 0x20]
movdqu xmm1, xmmword [edi + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [esi + eax - 0x20], xmm1
movdqu xmm1, xmmword [eax - 0x10]
movdqu xmm0, xmmword [edx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [ebx + edx - 0x20], xmm1
mov ebx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 4]
jb 0xf58660
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
cmp ecx, edx
jae 0xf586c2
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
dec edx
jne 0xf586b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xf587a0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, 0xf73ed3
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0xf73ed0
mov dword [ebp + 0xc], 8
mov edi, 0xf73ed1
mov ebx, 0xf73ed2
sub esi, eax
sub edi, eax
sub ebx, eax
sub ecx, eax
mov dword [ebp - 4], ecx
dec dword [ebp + 0xc]
lea eax, [eax + 4]
movsx ecx, byte [esi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 4], cl
movsx ecx, byte [edi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 3], cl
movsx ecx, byte [ebx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 4]
movsx ecx, byte [ecx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 1], cl
jne 0xf587d3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xf80fca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xfe0b68
not bl
mov esi, 0xf664d2
push 0x86ed92e0
setge bh
mov esi, dword [esi + 0xc5c93]
movzx bx, cl
jmp 0xfe23ef
and al, 0x4c
jmp 0x1002d3e
rcl dword [eax - 0x79], cl
pop esp
and al, 8
pushal
pushfd
mov dword [esp + 0x28], ebx
movsx bx, cl
jmp 0x1021609
and al, 0x40
mov si, dx
jmp 0x102e207
mov dword [esp], ebx
mov dword [esi + 0x28], ebx
call fcn.00ff000d
dec ebp
aam 0x38
cwde
pop eax
jbe 0xfe0b59
test eax, 0xc575518b
sbb eax, 0x49eda559
xchg ecx, eax
sal ebp, 0x39
popfd
std
loope 0xfe0b15
pop esp
xor byte [ebp - 0x20], cl
ja 0xfe0b9d
imul byte [edx - 0x46d7ebc0]
pop ecx
cmp dword [edx], esp
mov eax, 0x29f1b99c
loope 0xfe0bd7
mov ecx, 0x35e129f1
sbb ecx, ebx
lodsd eax, dword [esi]
mov byte [eax + 0x58], al
sub al, 0xbc
je 0xfe0b3d
cmp dword [ecx + 0x5e], edx
push es
bound ecx, qword [ebx + 5]
xchg dword [esi - 0x7015d3dc], ecx
adc dword [eax - 0x7c], edi
mov eax, dword [0x5b7737dc]
sbb ebp, esi
cmpsb byte [esi], byte es:[edi]
mov esi, 0xa04677bf
xchg esi, eax
xchg ah, ah
jp 0xfe0bb2
add eax, 0x2c248e87
ljmp 0xa184
lodsd eax, dword [esi]
rcr dh, 1
add bh, byte [edx + 0x721a12d7]
inc esi
sbb dh, byte [edx + 0x46]
pushal
imul edi, dword [0xb70cd0cf], 0x26488d46
int3
setge bl
not bh
lea esi, [esi + 0x124d72e4]
push 0xff925724
movzx bx, dl
mov ebx, esi
movzx si, al
lea esi, [edi - 0x50e89708]
mov esi, dword [esp + 0x4c]
mov word [esp + 8], ax
mov byte [esp], al
mov byte [esp], 0xbd
push dword [esp + 0x50]
ret 0x54
push edx
call fcn.00fdfab5
pushfd
xchg dword [esp + 0x4c], eax
setle al
mov eax, dword [ebp + 0xc]
jmp 0xfeefbc
lea ebx, [0x6efb4089]
movzx bx, cl
mov dword [esp + 0x24], esi
pushal
jmp 0xfb9ecc

Function at 0xff4737
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 4], ah
call fcn.01003a05
clc
add byte [eax], al
add al, ch
cmp eax, 0x4f2f08e
in eax, dx
dec edx
push 0x45
cmp al, 0x45
adc byte [edi - 0x16d14cc9], ah
dec edx
and byte [eax + 0x472b7b72], ah
dec edx
push esi
add al, 0xa7
movsd dword es:[edi], dword [esi]
inc esp
je 0xff4707
fucompi st(7)
mov dh, 0x87
adc eax, 0x40f55a0f
lodsd eax, dword [esi]
mov ch, 0x72
pop esi
mov byte [edi + 0x1726aec1], al
scasb al, byte es:[edi]
jbe 0xff476e
sbb ah, dh
ja 0xff47e9
inc edx
and dword [eax + 0x4b0d57d2], 0xb0241810
mov al, byte [ecx]
out dx, al
invalid
sbb al, byte [0x6f1c5a9d]
bound ebx, qword [ebx]
mov ah, 0xac
cmp edi, dword [edi]
mov bl, 0x9b
mov edi, 0xb317ded7
sbb dword [edx + 0x753209b3], esi
mov bl, 0x78
out dx, al
dec edx
xor byte [esi - 0x57], 0x99
invalid
mov eax, dword [0x6fb946e4]
jae 0xff481d
inc ebp
mov bl, 1
and dword [edi - 0x71], 0x70b68ffe
out 0x66, al
mov bh, 0xbd
xor ah, dh
aam 0x7c
cmp al, 0xc4
lcall 0x8210, 0x37f2e210
and byte [ebx - 0x48504fe9], 0xc0
outsb dx, byte [esi]
cmc
push ds
cmpsd dword [esi], dword es:[edi]
popfd
or byte [ebx], bh
adc eax, 0x61dc6768
popal
jecxz 0xff47ba
hlt
Function at 0xff8e6b
Capabilities:
Encode data using xor

Disassembly:
lahf
mov eax, 0xf5a4bc
call fcn.00fa985a
xchg ecx, eax
mov cl, 0xed
sub dword [ebp - 0x4f], esi
add dword [ecx - 0x5f], ebx
std
sub dword [ebp - 0x5f], ebp
sbb dword [ecx - 0x4b2b2c87], 0xdbceb60e
mov ebx, 0xb2d34de7
inc edx
mov dword [ebp - 0x1fa03a35], esp
add al, 0x4c
in al, dx
pushfd
mov ah, 0xec
xchg esp, eax
out dx, al
sahf
cmp al, 0x49
stc
push ebx
add al, 0xd5
lahf
std
and edx, esi
inc edx
movsd dword es:[edi], dword [esi]
invalid
pushfd
nop
pushfd
pushfd
push 0x9e6b5e4a
pushal
mov dword [esp + 0x2c], eax
setb ah
mov eax, dword [esp + 0x30]
push ebx
pushfd
push 0xbabfd79d
lea eax, [eax + 1]
push dword [esp]
mov dword [esp + 0x40], eax
mov byte [esp + 4], dh
not ax
jmp 0xfa275b

Function at 0x10013da
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bh
inc ebx
cmc
add eax, ecx
stc
pushal
clc
cmp ebx, eax
push edx
push dword [esp]
mov word [esp], 0x6703
mov dword [ebp - 4], ebx
pushfd
push dword [esp]
mov dword [esp + 8], 0x25c25c2e
lea esp, [esp + 0x34]
jl 0xfc93ca
rdtsc
xchg di, si
pop edi
aaa
xor ch, dl
and ax, di
mov ecx, dword [ebp + 8]
lea esp, [esp + 4]
je 0xfacae1
jno 0xfa088b
lahf
movsx ax, al
seto cl
movzx eax, word [esi]
sete cl
inc ch
movzx ecx, word [esi + 2]
push 0x859734a6
jmp 0x102bbfc
jmp 0xfacab2

Function at 0x102dbce
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfc16db
push 0xe34af7
mov dword [esp + 8], edx
not dx
movsx dx, bl
mov edx, 0xf6328b
mov byte [esp], bh
pushal
mov dword [esp], ecx
mov edx, dword [edx + 0x886a3]
pushal
push eax
lea esp, [esp + 0x48]
je 0xfa2d37
lea edx, [edx + 0x7b3688e4]
call fcn.00ffaf19
pop edx
lea edx, [edi + 0x5a1822e3]
mov edx, dword [esp + 0x28]
pushal
push dword [esp + 0xc]
lea edx, [edx + 1]
mov word [esp + 8], dx
lea esp, [esp + 0x48]
jg 0xfa0db0
pushal
mov dword [esp + 0x24], edx
push esp
and al, 0x24
bswap dx
pop edx
mov edx, 0xf6328b
mov byte [esp + 8], 9
mov edx, dword [edx + 0x886a3]
mov byte [esp], dl
pushal
lea edx, [edx + 0x7b3688e4]
call fcn.00fa1e78
pop ebp
in al, 0x3c
insb byte es:[edi], dx
xor byte [eax], ah
xor dword [ebx + 0x71], ebp
imul ecx, dword [edi - 0x3c98cc31], 0x17
arpl bx, ax
and ecx, dword [edi - 0x69]
xlatb
sbb esi, ebx
mov bh, 0xd4
jl 0x102dbf5
dec ecx
das
test al, 0xb8
dec ecx
insd dword es:[edi], dx
xor eax, edi
mov dx, 0x39c1
pop ebp
xor eax, 0x4d72a252
push ebp
jge 0x102dca1
and eax, 0x7860a8cd
xor byte [edx], ah
retf 0x619d
ror byte [eax - 0x31], 0xf3
stosd dword es:[edi], eax
enter 0xfffffffffffffea3, 0x42
cli
mov dh, 0xe8
and ebp, dword [ebx]
out dx, eax
pop es
ret
Function at 0x104a7c5
Capabilities:
Encode data using xor

Disassembly:
stc
leave
test byte [esp + edx*8 - 0x25559c2f], al
stosb byte es:[edi], al
cmp eax, 0x60671be3
test byte [ecx + ebp*2 - 0x67], cl
dec ecx
and al, 0x5e
cmp bh, dl
invalid
mov edx, 0x80fa2a82
jbe 0x104a767
sub bh, dl
xor byte [esi - 0x5b], 0xee
out dx, al
xor dword [ebp + 1], edx
shr eax, 1
invalid
add ecx, edx
call fcn.010edf93
mov dl, byte [ecx]
popal
mov ch, 0x69
nop
jne 0x104a7bb
jp 0x104a838
xchg dh, bl
sbb ah, byte [edx - 0x72]
rcr byte [esi], cl
and dl, 0xa
push edx
jp 0x104a7bd
stosb byte es:[edi], al
pop esi
mov al, byte [0x6b5eae7c]
push esi
int 0x58
out dx, al
retf 0x557e
xor ecx, ebx
invalid

Function at 0x10f837b
Capabilities:
Encode data using xor

Disassembly:
jg 0x10f8342
inc dword [eax]
add dh, al
add al, 0x24
invalid
neg dl
call fcn.010f8c7d
lodsb al, byte [esi]
xor edi, dword [edi - 0x41]
wait
cmp dword [edx + 0x528a532c], ecx
jbe 0x10f8331
out 0x4a, al
xchg dh, bl
or ch, byte [edx - 0x62]
out dx, al
dec esi
mov byte [0xfb53366e], al
sbb byte [ebx + ebx*8], bh
mov word [eax + esi*4 + 0x39f69cd4], es
shl dword [eax + 0x67], cl
std
leave
or esp, esi
loope 0x10f8341
insb byte es:[edi], dx
push ss
xchg ecx, eax
mov dl, 0xfb
fld dword [ebx + 0x1375fbc8]
aaa
pop ss
pop esp
and al, 0x7e
mov edx, 0x2b4fcfee
xor byte [ebp + 0x11], al
scasd eax, dword es:[edi]
sub dword [ebx], ebx
insb byte es:[edi], dx
adc dword [edi + 0x6c2e1b29], ebp
push edi
lahf
xor eax, 0x76625a7a
xchg dword [ebx + 0x59fb832d], edi
mov al, byte [0x614c846c]
mov ebx, dword [ecx - 0x2a]
out 0x71, eax
pop es
xor al, 0xaf
push eax
cdq
popal
jle 0x10f83c7
push ss
xor edx, dword [edi]
invalid
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5286070a
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x20004959
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001e1b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10001ece
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x10004b1b
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10004b3d
mov eax, 0xfffffffd
jmp 0x10004c0f
cmp dword [0x1002d3e9], 0
je 0x10004be8
cmp dword [0x1002d3e5], 5
jl 0x10004b6b
cmp dword [0x1002d3e5], 7
jg 0x10004b6b
mov eax, 1
jmp 0x10004b70
mov eax, 0
test eax, eax
jne 0x10004b89
cmp dword [0x1002d3e5], 0xfffffffb
je 0x10004b89
xor eax, eax
jmp 0x10004b8e
mov eax, 1
test eax, eax
je 0x10004bba
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10004ba3
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x1002d3e9], 0
jne 0x10004c05
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10004c0f
mov esp, ebp
pop ebp
ret 4

Function at 0x100067f8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10001e1b
test eax, eax
je 0x1000683b
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x1000683b
cmp word [eax], 0x5a4d
jne 0x1000683b
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x1000683b
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10001eed
mov eax, dword [ebp + 8]
jmp 0x10006854
mov esp, ebp
pop ebp
ret 4
Function at 0x10008785
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x1000878f
add dword [esp], 5
retf

Function at 0x1000894b
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10008955
add dword [esp], 5
retf

Function at 0x100089de
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x10008a5e
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x10008a5e
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x10008a5e
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x10008a5e
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x10008a4f
test bl, bl
je 0x10008a62
dec eax
mov eax, edx
jmp 0x10008a3b
inc ebp
test al, al
je 0x10008a62
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x10008a36
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x10008a22
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x10008a5c
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x10008a94
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10008a9e
add dword [esp], 5
retf

Function at 0x1000b1d3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x1000b1dd
add dword [esp], 5
retf

Function at 0x100119fd
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10011a07
add dword [esp], 5
retf

Function at 0x10011df6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10011e00
add dword [esp], 5
retf
Function at 0x10017d41
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0
push 1
mov ebx, 0x184
call fcn.100289c0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10017da8
push 0x44
push 0x4011496
push 6
call fcn.10027499
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10017dbb
push ebx
call fcn.10027487
add esp, 4
push 0x80000301
push 0
push dword [ebp - 0x10]
push 1
mov ebx, 0x184
call fcn.100289c0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10017dee
push ebx
call fcn.10027487
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10017e05
mov eax, 0x1002c200
push eax
push 1
mov ebx, 0x130
call fcn.10028800
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10017e4f
push 0x8c
push 0x4011496
push 6
call fcn.10027499
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10017e6b
push eax
mov ebx, eax
call fcn.10004c15
inc eax
push eax
call fcn.1002748d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10017e70
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10017e81
push ebx
call fcn.10027487
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100188e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100289c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10018926
push ebx
call fcn.10027487
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1001895b
push 0x5a
push 0x4010d0e
push 6
call fcn.10027499
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10018977
mov eax, 0x1002c200
jmp 0x10018998
mov eax, dword [ebp - 4]
test eax, eax
je 0x10018993
push eax
mov ebx, eax
call fcn.10004c15
inc eax
push eax
call fcn.1002748d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10018998
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100189a9
push ebx
call fcn.10027487
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1001a4c7
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret