joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b897
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x57b848
cmp edx, dword [eax]
je 0x53b8b9
add eax, 8
inc ecx
cmp eax, 0x57b8d8
jl 0x53b8aa
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x57b848]
jne 0x53b9e7
mov eax, dword [0x5c8ad8]
cmp eax, 1
je 0x53b9c1
test eax, eax
jne 0x53b8ea
cmp dword [0x578e08], 1
je 0x53b9c1
cmp edx, 0xfc
je 0x53b9e7
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x53b921
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0053cc10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005372b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x53b964
lea eax, [ebp - 0x1a4]
push eax
call fcn.005372b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5705b8
push edi
call fcn.0053ec20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0053cc10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0053cc20
lea eax, [ebp - 0xa0]
push 0x570598
push eax
call fcn.0053cc20
push dword [esi + 0x57b84c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0053cc20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0053f407
add esp, 0x2c
pop edi
jmp 0x53b9e7
lea eax, [ebp + 8]
lea esi, [esi + 0x57b84c]
push 0
push eax
push dword [esi]
call fcn.005372b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x5414b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x541550
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x541502
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x57c0f0]
xor eax, edx
inc esi
cmp esi, edi
jl 0x5414e3
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x54152b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x57c0f0]
xor eax, edx
inc esi
cmp esi, edi
jl 0x54150e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x550ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x550ef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005357ef
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x550f13
test byte [esp + 8], 2
je 0x550f13
call fcn.00535862
mov dword [eax], 0xd
call fcn.0053586b
mov dword [eax], 5
jmp 0x550eec
xor eax, eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10026f0
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
cmp dword [0x1006970], 0
je 0x1002732
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x1001164
call dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1002732
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10027ed
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx]
mov word [ebp - 0x12], ax
add dword [ebp - 0xc], 2
cmp word [ebp - 0x12], 0
jne 0x100274b
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
sar ecx, 1
mov dword [ebp - 0x18], ecx
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_WriteConsoleW]
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x100115c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_WriteConsoleW]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov dx, word [ecx]
mov word [ebp - 0x22], dx
add dword [ebp - 0x1c], 2
cmp word [ebp - 0x22], 0
jne 0x10027a9
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
sar eax, 1
mov dword [ebp - 0x28], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_WriteConsoleW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1002804
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov esp, ebp
pop ebp
ret 8
Function at 0x1002c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1002c7f
pop dword [ebp - 0x18]
mov eax, 0x1002c7f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x94614a06
sub dword [ebp - 0x28], 0x460f04bb
mov dword [ebp - 0x24], 0x1cac4cff
sub dword [ebp - 0x24], 0xea7900ba
mov dword [ebp - 0x20], 0x74bcd316
sub dword [ebp - 0x20], 0x28708ee8
mov dword [ebp - 0x1c], 0xf53e12b3
add dword [ebp - 0x1c], 0xac1ed4d
lea eax, [ebp - 0x28]
push eax
mov eax, 0x98054417
add eax, 0x68facc21
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xd439dd6
sub dword [ebp - 0x28], 0x98d13480
mov dword [ebp - 0x24], 0x77367208
add dword [ebp - 0x24], 0xca35ef6d
mov dword [ebp - 0x20], 0x8c27ca75
add dword [ebp - 0x20], 0xd747a1f7
mov dword [ebp - 0x1c], 0xed180ee8
sub dword [ebp - 0x1c], 0xed180ee8
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x507877f5
add eax, 0xb087987f
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3788c
push 0
call eax
mov ecx, 0x1b602623
add ecx, 0xe4a02316
xor ebx, ebx
add ebx, eax
mov esi, 0x1009c00
add esi, dword [ebp - 0x18]
mov edi, 0xa1d5fc0d
sub edi, 0xadfaeaaf
mov dword [ebp - 8], 0x74fee6ed
mov edx, dword [esi]
add dword [ebp - 8], ebx
add edx, edi
mov dword [ebp - 0xc], 0x95e465cc
mov dword [ebx], edx
xor dword [ebp - 4], 0xa59ed5f2
add ebx, 4
add esi, 0x53cae1dd
sub esi, 0x53cae1d9
loop 0x1002d98
add eax, 0x117b7
mov ebx, eax
add eax, 0x79722784
add eax, 0x868dd881
mov ecx, 0x1000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10041f9
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1004dd0
call fcn.010046d4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1007cc4
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100400e
cmp eax, esi
jne 0x1004001
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1004011
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x1003fe8
xor esi, esi
inc esi
mov eax, dword [0x1007cc0]
cmp eax, esi
jne 0x1004024
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100405f
mov eax, dword [0x1007cc0]
test eax, eax
jne 0x1004059
mov dword [0x1007cc0], esi
push 0x1001100
push 0x10010f4
call fcn.01002c70
pop ecx
pop ecx
test eax, eax
je 0x100405f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1004129
mov dword [0x1006da4], esi
mov eax, dword [0x1007cc0]
cmp eax, esi
jne 0x1004083
push 0x10010f0
push 0x10010e8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1007cc0], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1004090
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x1007ccc], ebx
je 0x10040b1
push 0x1007ccc
call fcn.01004649
pop ecx
test eax, eax
je 0x10040b1
push ebx
push 2
push ebx
call dword [0x1007ccc]
push dword [0x1006d8c]
push dword [0x1006d90]
push dword [0x1006d88]
call fcn.01002c70
add esp, 0xc
mov dword [0x1006da0], eax
cmp dword [0x1006d94], ebx
jne 0x100410f
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1006da4], ebx
jne 0x100411d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1006da0]
call fcn.01004719
ret
call fcn.01002c70
jmp 0x1003fc6
Function at 0x1017a4fa
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10182f60], 0
mov byte [0x10182f64], 0
mov dword [0x10182f58], 0x33f9
mov dword [0x10182f54], 0x9a0
mov dword [0x10182f5c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1017a566
xor eax, eax
mov dword [0x10182f58], 0x1f91
mov dword [0x10182f5c], 0
mov dword [ebp - 0x20], eax
jmp 0x1017a58e
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10182f5c]
add eax, 1
mov dword [0x10182f5c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1017a566
jmp 0x1017a54b
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10182f68], 0
mov dword [0x10182f54], 0x2391
mov edx, dword [0x10182f60]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x10182f68], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x10182f60], edx
mov dword [0x10182f54], 0x1197
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x10182f64], cl
mov dword [0x10182f54], 0xd5c
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x10182f64]
mov edx, dword [0x10182f60]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x10182f54], 0xcb9
mov edx, dword [0x10182f5c]
add edx, 1
mov dword [0x10182f5c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1017a58e
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1017aa08
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [0x10182f58], 0x1825
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10182f54], 0x262b
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1017aa96
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1017ab16
jmp 0x1017ab75
mov dword [0x10182f58], 0x2454
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x1017aa96
jmp 0x1017aaac
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [0x10182f54], ecx
add esp, 0x28
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x1017aa61
mov eax, dword [ebp - 0x20]
mov dword [0x10182f54], 0xca2
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1017ab75
mov dword [0x10182f54], 0xffffe703
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1017ab75
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff5
mov dword [0x10182f54], 0xffffde32
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x61
je 0x1017aa49
jmp 0x1017ab75
mov dword [0x10182f54], 0xb28
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1017ab75
mov dword [0x10182f54], 0x35
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1017ab75
mov eax, 0x1438
mov ecx, 1
mov dword [0x10182f54], 0x166f
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
je 0x1017aa84
mov eax, 0x1f59
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x1017aa84
Function at 0x1017ad34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.1017a0aa
mov ecx, eax
mov dword [0x10182f58], 0x11a4
mov edx, dword [eax + 0x3c]
mov dword [0x10182f54], 0x828
mov eax, dword [eax + edx + 0x78]
mov dword [0x10182f58], 0x1376
mov edx, eax
add edx, 0x20
mov esi, ecx
add esi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
add ecx, dword [edx]
mov dword [0x10182f54], 0x4d3
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi + edi + 0x18]
cmp ebx, 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jne 0x1017adf4
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, eax
mov edx, dword [ebp - 0x30]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], bh
mov byte [ebp - 0x36], cl
jne 0x1017ae22
mov al, byte [ebp - 0x36]
test al, 1
jne 0x1017ae79
jmp 0x1017ae50
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edx
jmp 0x1017adbe
mov eax, dword [ebp - 0x34]
add eax, 1
mov cl, byte [ebp - 0x35]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x36]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x2c], eax
jne 0x1017adbe
jmp 0x1017ade7
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 2
mov edx, dword [ebp - 0x44]
add edx, 1
mov esi, dword [ebp - 0x20]
cmp edx, esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edx
jb 0x1017ae06
jmp 0x1017adb3
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10182f58], 0x14e4
mov edx, dword [ebp - 0x14]
add edx, ecx
mov dword [0x10182f54], 0x674
mov dword [ebp - 0x28], edx
jmp 0x1017adb3
Function at 0x1017af6d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x10182f58]
mov dword [0x10182f5c], 0
mov dword [0x10182f60], 0
mov dword [0x10182f6c], 0
mov dword [ebp - 0x10], eax
mov eax, ebx
add eax, 0xfffff40b
mov dword [0x10182f54], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x1017b124
jmp 0x1017affc
mov eax, dword [0x10182f58]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
jmp 0x1017b124
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edi, 0x100
add ecx, 1
mov dword [ebp - 0x3c], eax
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x10182f5c], edx
mov ecx, dword [ebp - 0x2c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x40]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x44], edx
cdq
idiv edi
mov dword [0x10182f60], edx
mov ecx, esi
add ecx, 0xffffff04
mov dword [0x10182f58], ecx
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x44]
mov cl, byte [ecx + edi]
mov byte [0x10182f64], cl
add esi, 0xffffe8d2
mov dword [0x10182f54], esi
mov esi, dword [ebp - 0x2c]
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov cl, byte [0x10182f64]
mov edx, dword [0x10182f60]
mov byte [esi + edx], cl
mov dword [0x10182f54], 0xfea
mov edx, dword [0x10182f5c]
movzx edx, byte [esi + edx]
mov ebx, dword [0x10182f60]
movzx ebx, byte [esi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10182f6c], ebx
mov cl, byte [esi + ebx]
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x3c]
mov ch, byte [edx + ebx]
mov dword [0x10182f58], 0xd1
xor ch, cl
mov byte [0x10182f70], ch
mov dword [0x10182f54], 0x538
mov edx, dword [ebp - 0x28]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x48], ebx
je 0x1017afe9
mov eax, dword [0x10182f5c]
mov ecx, dword [0x10182f60]
mov edx, dword [0x10182f54]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], esi
jmp 0x1017affc
mov eax, dword [ebp - 0x34]
add eax, 0xffffefe2
mov dword [0x10182f54], eax
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1017b139
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x10182f58], 0xa89
mov edx, dword [0x10182f54]
add edx, 0xbf9
mov dword [0x10182f54], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1017a666
lea ecx, [0x1017b37d]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 0x14b400
mov edx, dword [0x10182f40]
mov dword [esp + 0x74], edx
mov edx, dword [0x10182f44]
mov dword [esp + 0x84], edx
mov edx, dword [0x10182f48]
mov dword [esp + 0x3c], edx
mov edx, dword [0x10182f4c]
mov dword [esp + 0x34], edx
mov edx, dword [0x10182f50]
mov dword [esp + 0x4c], edx
mov dword [0x10182f58], 0x2bd
mov dword [0x10182f54], 0xfffff059
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1017b20e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1017b21f
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
mov dword [0x10182f58], 0xfde
and eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x1017b1de
jmp 0x1017b1f2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x50], eax
mov dword [0x10182f54], 0x828
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x70], edx
mov dword [0x10182f58], 0x1419
call fcn.1017aa08
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1017b2a5
lea eax, [esp + 0x30]
mov dword [0x10182f54], 0xa5a
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1017b3de
mov dword [0x10182f54], 0x1f96
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x10182f58], 0x2262
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x1017b3de
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x1017c235]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov ebx, dword [0x10182f54]
add ebx, 0xfffff1bd
mov dword [0x10182f54], ebx
mov dword [0x10182f58], 0x1ac5
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.1017b2ad
call fcn.1017b6a4
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.1017a219
xor ecx, ecx
mov edx, dword [0x10182f58]
add edx, 0xffffe3d9
mov dword [0x10182f54], edx
cmp eax, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
je 0x1017b52f
jmp 0x1017b48c
mov dword [0x10182f54], 0xffffedf9
mov eax, dword [ebp - 0x48]
add eax, 0x1372
mov dword [ebp - 0x44], eax
jmp 0x1017b52f
mov eax, dword [ebp - 0x40]
mov dword [0x10182f58], 0x1f5
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x10182f58]
add ecx, 0x121d
mov dword [0x10182f54], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.1017a3f9
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x24], ecx
mov dword [0x10182f54], 0xb6b
mov ecx, dword [ebp - 0x48]
mov dword [edx + 0x4c], ecx
mov dword [0x10182f58], 0x1691
cmp ecx, 0
mov dword [ebp - 0x44], eax
jne 0x1017b472
mov eax, dword [ebp - 0x44]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx