joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017360
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x100174f5
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x100174f5
movzx eax, word [eax + ecx + 0x14]
test ax, ax
je 0x100174f5
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], 0
push ebx
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x10017414
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10017414
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1001740d
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x100173f0
cmp esi, 0x820621f3
je 0x10017418
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x100173d7
mov eax, dword [eax]
jmp 0x100173b2
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
mov esi, dword [ebp - 0x18]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + edx]
movzx ebx, cx
add eax, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], ebx
push ecx
push 0x40
push ebx
push esi
call eax
push ebx
push 0
push esi
call fcn.1001bb00
mov eax, dword fs:[0x30]
add esp, 0xc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x10], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x14], ecx
cmp ecx, edx
je 0x100174c4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x100174c4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x100174bd
nop dword [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x100174a0
cmp esi, 0x820621f3
je 0x100174c8
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x10017486
mov eax, dword [eax]
jmp 0x10017461
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
add eax, edx
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019893
mov esp, ebp
pop ebp
ret
Function at 0x10017570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1003e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], ebx
lea edx, [ecx + 1]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017598
sub ecx, edx
lea eax, [ecx*2 + 0x400]
push eax
call fcn.10019f1c
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 8]
mov ecx, esi
call fcn.10001180
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100175d0
mov edi, dword [ebx]
sub ecx, edx
cmp byte [ebp + 0x14], al
jne 0x10017653
test edi, edi
je 0x100175fe
mov edx, dword [ebp - 0xc]
lea ebx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x100175f0
sub edx, ebx
jne 0x10017622
mov ebx, dword [ebp - 0x10]
xor al, al
mov ecx, 8
push esi
mov byte [ebx + ecx], al
call fcn.100198a1
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10019893
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x10017639
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017630
sub ecx, edx
push ecx
push esi
push 1
push 0
push dword [ebp - 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [ebp - 0x10]
test eax, eax
sete al
jmp 0x10017600
test edi, edi
je 0x100175fe
mov edx, dword [ebp - 0xc]
lea ebx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10017660
sub edx, ebx
je 0x100175fb
test ecx, ecx
jne 0x1001767d
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017674
sub ecx, edx
push ecx
push esi
push 7
push 0
push dword [ebp - 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [ebp - 0x10]
test eax, eax
sete al
jmp 0x10017600
Function at 0x10017a0d
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003e024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x10017b18
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10017b11
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x10017ad5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10017ad5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10017ad5
mov edx, dword [esi]
test edx, edx
jne 0x10017a9e
push 0x200
push edx
push dword [0x1003fe18]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10017afa
lea ebx, [esi + 8]
jmp 0x10017ac8
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x10017ac8
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x1003fe18]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10017b29
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10017a56
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10017b11
xor edi, edi
cmp dword [esi], edi
je 0x10017b11
push dword [esi]
push edi
push dword [0x1003fe18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019893
leave
ret
mov ebx, dword [ebp - 0x24]
jmp 0x10017afa

Function at 0x10017b2e
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.10017a0d
test eax, eax
jne 0x10017b52
push 9
pop esi
jmp 0x10017b99
cmp dword [edi], esi
je 0x10017b99
push ebx
mov ebx, esi
cmp dword [edi + 8], esi
jbe 0x10017b98
mov eax, dword [edi]
push dword [eax + ebx*4]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
test eax, eax
je 0x10017b92
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.100178ba
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [edi + 8]
jb 0x10017b5e
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x10017b9f
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x10017beb
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10017bda
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10017bd3
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10017bb0
pop ebx
push dword [esi]
push 0
push dword [0x1003fe18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x10017bed
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
imul esi, ecx, 0x2c
push edi
mov edi, edx
mov dword [ebp - 0x10], edi
add esi, dword [0x1003fe70]
mov dword [ebp - 8], esi
mov al, byte [esi + 0x14]
mov ebx, dword [esi]
and al, 1
je 0x10017c13
sub ebx, 5
movzx eax, al
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10017c3a
push 0xa
pop eax
jmp 0x10017cba
test edi, edi
je 0x10017c5b
mov byte [ebx], 0xe9
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [esi + 0x14], 1
je 0x10017c7a
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10017c7a
test byte [esi + 0x14], 1
je 0x10017c6f
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
jmp 0x10017c7a
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [ebp - 0x10]
mov cl, byte [esi + 0x14]
and dl, 1
mov al, dl
and cl, 0xfd
add al, al
shl dl, 2
or cl, al
and cl, 0xfb
or cl, dl
xor eax, eax
mov byte [esi + 0x14], cl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001821f
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x1003fe68]
push esi
xor esi, esi
jmp 0x10018231
cmp dword [edx + 4], esi
jne 0x10018285
mov edx, dword [edx]
test edx, edx
jne 0x1001822a
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x10018281
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x10018258
mov eax, dword [0x1003fe68]
mov dword [edx], eax
mov dword [0x1003fe68], edx
pop edi
test edx, edx
jne 0x10018285
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x1002893a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100285b7
Function at 0x10030300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003032d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003032d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401630
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x4017b5
cmp dword [ebp + 0xc], 0
je 0x4017b5
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4017b5
mov eax, dword [ebp + 0x14]
test al, 3
jne 0x4017b5
push edi
xor edi, edi
test eax, eax
jle 0x4017af
add esi, 2
push ebx
lea ecx, [ecx]
mov cl, byte [esi - 2]
lea ebx, [ecx - 0x41]
cmp bl, 0x19
jbe 0x4016a9
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x401688
lea ebx, [ecx - 0x47]
jmp 0x4016a9
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x401695
lea ebx, [ecx + 4]
jmp 0x4016a9
cmp cl, 0x2b
je 0x4016a7
cmp cl, 0x2f
je 0x4016a3
xor bl, bl
jmp 0x4016a9
mov bl, 0x3f
jmp 0x4016a9
mov bl, 0x3e
mov cl, byte [esi - 1]
lea edx, [ecx - 0x41]
cmp dl, 0x19
jbe 0x4016e2
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x4016c1
lea edx, [ecx - 0x47]
jmp 0x4016e2
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x4016ce
lea edx, [ecx + 4]
jmp 0x4016e2
cmp cl, 0x2b
je 0x4016e0
cmp cl, 0x2f
je 0x4016dc
xor dl, dl
jmp 0x4016e2
mov dl, 0x3f
jmp 0x4016e2
mov dl, 0x3e
mov cl, byte [esi]
mov al, cl
sub al, 0x41
cmp al, 0x19
jbe 0x40171a
mov al, cl
sub al, 0x61
cmp al, 0x19
mov al, cl
ja 0x4016fa
sub al, 0x47
jmp 0x40171a
sub al, 0x30
cmp al, 9
ja 0x401706
mov al, cl
add al, 4
jmp 0x40171a
cmp cl, 0x2b
je 0x401718
cmp cl, 0x2f
je 0x401714
xor al, al
jmp 0x40171a
mov al, 0x3f
jmp 0x40171a
mov al, 0x3e
mov ch, byte [esi + 1]
mov ah, ch
sub ah, 0x41
cmp ah, 0x19
jbe 0x40175d
mov cl, ch
sub cl, 0x61
cmp cl, 0x19
ja 0x401738
mov ah, ch
sub ah, 0x47
jmp 0x40175d
mov cl, ch
sub cl, 0x30
cmp cl, 9
ja 0x401749
mov ah, ch
add ah, 4
jmp 0x40175d
cmp ch, 0x2b
je 0x40175b
cmp ch, 0x2f
je 0x401757
xor ah, ah
jmp 0x40175d
mov ah, 0x3f
jmp 0x40175d
mov ah, 0x3e
mov cl, dl
shl bl, 2
shr cl, 4
inc edi
or cl, bl
shl dl, 4
mov ebx, dword [ebp + 8]
mov byte [ebx], cl
mov cl, al
shr cl, 2
or cl, dl
mov byte [ebx + 1], cl
cmp byte [esi], 0x3d
je 0x4017ae
shl al, 6
inc edi
or al, ah
mov byte [ebx + 2], al
add ebx, 3
cmp byte [esi + 1], 0x3d
mov dword [ebp + 8], ebx
je 0x4017ae
mov eax, dword [ebp + 0x14]
inc edi
sub eax, 4
add esi, 4
mov dword [ebp + 0x14], eax
cmp edi, dword [ebp + 0xc]
jae 0x4017ae
test eax, eax
jg 0x401670
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x407994
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404e15
mov dword [ebp - 0x14], eax
cmp dword [0x416180], esi
jne 0x407a87
push 0x800
push esi
push 0x40f50c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x407a14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x407b67
push esi
push esi
push 0x40f50c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x407b67
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407b67
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x416180], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x416184], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x416188], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x416190], eax
test eax, eax
je 0x407a84
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41618c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x407aac
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x407a9f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x407ac1
push 4
pop eax
jmp 0x407b69
cmp dword [ebp - 0x14], esi
je 0x407ac1
push dword [0x416180]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x407aa6
mov eax, dword [0x41618c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x407b1f
cmp dword [0x416190], edi
je 0x407b1f
push eax
call ebx
push dword [0x416190]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x407b1f
test eax, eax
je 0x407b1f
call ecx
test eax, eax
je 0x407b14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x407b14
test byte [ebp - 8], 1
jne 0x407b1f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x407b4f
mov eax, dword [0x416184]
cmp eax, edi
je 0x407b4c
push eax
call ebx
test eax, eax
je 0x407b4c
call eax
mov esi, eax
test esi, esi
je 0x407b4c
mov eax, dword [0x416188]
cmp eax, edi
je 0x407b4c
push eax
call ebx
test eax, eax
je 0x407b4c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x416180]
call ebx
test eax, eax
je 0x407b67
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x407b69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401979
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403e59
pop dword [ebp - 0x34]
mov eax, 0x403e59
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xddef77af
sub dword [ebp - 0x44], 0x8f9d3264
mov dword [ebp - 0x40], 0x59d9924
sub dword [ebp - 0x40], 0xd36a4cdf
mov dword [ebp - 0x3c], 0xa92ab82b
add dword [ebp - 0x3c], 0xa3218c03
mov dword [ebp - 0x38], 0x51669a66
add dword [ebp - 0x38], 0xae99659a
lea eax, [ebp - 0x44]
push eax
mov eax, 0xee2791f8
add eax, 0x1218de6c
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xb28fe8cd
sub dword [ebp - 0x44], 0x3e1d7f77
mov dword [ebp - 0x40], 0xb98ae85b
sub dword [ebp - 0x40], 0x781e86e6
mov dword [ebp - 0x3c], 0x170fceba
add dword [ebp - 0x3c], 0x4c5f9db2
mov dword [ebp - 0x38], 0x7f08d30d
add dword [ebp - 0x38], 0x80f72cf3
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd3eb1768
sub eax, 0xd3aaa6c0
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x387d9
push 0
call eax
mov ecx, 0x427b86b2
add ecx, 0xbd84c847
mov edi, eax
mov ebx, 0x50d0256f
add ebx, 0xaf70da91
add ebx, dword [ebp - 0x34]
mov edx, 0xf2ee0a5d
sub edx, 0x664db570
add dword [ebp - 0x30], ebx
mov esi, dword [ebx]
add dword [ebp - 0x10], 0xd0994caa
xor esi, edx
xor dword [ebp - 0x30], 0x732dee43
mov dword [edi], esi
sub dword [ebp - 4], esi
add edi, 4
add ebx, 0xe9545d64
add ebx, 0x16aba2a0
loop 0x403f76
add eax, 0xd24d3c25
sub eax, 0xd24c0d6e
mov ebx, eax
add eax, 0x1b1e216f
add eax, 0xe4e1de96
mov ecx, 0xaa0ae83b
add ecx, 0x563517c5
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x407650
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x40766c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40766e
shr eax, 1
dec edx
jne 0x40765f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407658
pop esi
ret

Function at 0x407684
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x4076a7
call fcn.00407650
push 1
push 0x40b558
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x4076d2
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4076ad
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x78a669ad
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x78a7c1d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push ebx
push 1
push 3
push ebx
push ebx
push 0x80000000
push eax
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x81c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x78a669fc
call fcn.78a6440a
jmp 0x78a66b0f
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea esi, [edi + 1]
push esi
lea ecx, [ebp - 0x80c]
mov dword [ebp - 0x80c], ebx
call fcn.78a65a4d
cmp dword [ebp - 0x80c], ebx
jne 0x78a66a2f
mov edi, 0x8007000e
jmp 0x78a66ae6
push ebx
lea eax, [ebp - 0x814]
push eax
push edi
push dword [ebp - 0x80c]
push dword [ebp - 0x810]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x78a66a5d
call fcn.78a6440a
mov edi, eax
cmp edi, ebx
jl 0x78a66ae6
mov ecx, dword [ebp - 0x814]
mov eax, dword [ebp - 0x80c]
mov byte [eax + ecx], bl
push esi
lea ecx, [ebp - 0x408]
mov dword [ebp - 0x408], ebx
call fcn.78a65a17
cmp dword [ebp - 0x408], ebx
jne 0x78a66a95
lea eax, [ebp - 0x404]
mov edi, 0x8007000e
test eax, eax
jmp 0x78a66ad9
push esi
push dword [ebp - 0x408]
push esi
push dword [ebp - 0x80c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x78a66ab7
call fcn.78a6440a
jmp 0x78a66acb
push dword [ebp + 0xc]
lea ecx, [ebp - 0x81c]
push dword [ebp - 0x408]
call fcn.78a6661c
mov edi, eax
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x78a66ae6
lea ecx, [ebp - 0x408]
call fcn.78a654c1
push dword [ebp - 0x810]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x808]
cmp dword [ebp - 0x80c], eax
je 0x78a66b0b
lea ecx, [ebp - 0x80c]
call fcn.78a654c1
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.78a6f4f1
leave
ret 8

Function at 0x78a6f4f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78a7c1d8]
jne 0x78a6f4fb
repz ret
jmp fcn.78a71ec2
Function at 0x78a779ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6dc]
push eax
call fcn.78a76643
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.78a765f8
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x78a787c6
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.78a765a4
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x78a77a40
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x78a77a89
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x78a77a33
call fcn.78a76633
je 0x78a77aaf
mov dh, 0xc2
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
inc edx
test eax, ebx
clc
invalid

Function at 0x78a77aa5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edx
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.78a76633
sbb al, 0x80
jg 0x78a77aeb
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
lea eax, [ebp - 0x72c]
push eax
call fcn.78a76643
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.78a765f8
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.78a76633
insb byte es:[edi], dx
invalid