joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001595
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, esp
mov dword [eax + 4], 0x2eb
mov dword [eax], 0x2542a4
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
xor ecx, ecx
lea edx, [esp + 0x60]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], ecx
jmp 0x10001627
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
call eax
xor ecx, ecx
mov edx, 0x18
mov esi, dword [esp + 0x58]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x18
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], edx
call fcn.1000b3d0
mov eax, esp
lea ecx, [esp + 0x60]
mov dword [eax], ecx
mov dword [eax + 4], 0xfe6
mov eax, dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
call eax
sub esp, 8
mov dword [esp + 0x44], eax
jmp 0x10001730
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, esp
mov dword [edx], 0x63f80a
mov edx, dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
call edx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xdb1045
mov ecx, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov dword [esp + 0x38], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 8], 0x634
mov dword [ecx + 4], 0xb67f0d
mov dword [ecx], 0x896e5a
mov ecx, dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov dword [esp + 0x34], eax
call ecx
sub esp, 0xc
xor ecx, ecx
mov edx, dword [esp + 0x40]
sub edx, 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
je 0x100015cf
jmp 0x100016a1
mov eax, dword [esp + 0x40]
sub eax, 0x2e
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jne 0x100016fc
jmp 0x100016b8
mov eax, esp
mov dword [eax], 0x178594
mov eax, dword [sym.imp.GDI32.dll_BeginPath]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x52df89
mov ecx, dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov dword [esp + 0x1c], eax
call ecx
sub esp, 4
mov eax, esp
mov dword [eax], 0x4cf98d
mov eax, dword [sym.imp.GDI32.dll_GetBkColor]
call eax
sub esp, 4
mov dword [esp + 0x18], eax
jmp 0x100015cf
mov eax, dword [esp + 0x20]
add eax, 1
mov ecx, esp
mov dword [ecx], 0x9af
mov ecx, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x14], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x14]
cmp ecx, 0xa
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
jne 0x100016fc
mov eax, dword [esp + 0x40]
add eax, 1
cmp eax, 0xfa
mov dword [esp + 0x54], eax
jne 0x10001627
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x1000b7dc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10123740]
jne 0x1000b7e6
repz ret
jmp fcn.1000ba8d
Function at 0x1000c240
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 0x20f3
xor edi, edi
mov dword [0x10123718], 0x20f3
mov dword [0x10123724], 0
mov byte [0x10123728], 0
mov dword [0x1012371c], 0x1f84
mov dword [0x10123720], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x1000c2b6
xor eax, eax
mov dword [0x10123720], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x1856
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000c30a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffffed74
mov edx, eax
mov bl, dl
mov dword [0x1012371c], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x1012371c]
mov edx, eax
add edx, 0x22fb
mov dword [0x10123718], edx
mov esi, dword [0x10123720]
add esi, 1
mov dword [0x10123720], esi
cmp esi, 0x100
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
jl 0x1000c2b6
jmp 0x1000c299
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, 0x23e
mov esi, 0x100
mov dword [ebp - 0x30], eax
xor edi, edi
mov dword [ebp - 0x34], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov dword [0x1012372c], 0
mov dword [0x1012371c], ecx
mov ecx, dword [0x10123724]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x30]
movzx edi, byte [ebx + edi]
add edi, ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
add edi, edx
mov dword [0x1012372c], edi
mov eax, edi
cdq
idiv esi
mov dword [0x10123724], edx
mov dword [0x10123718], 0x133c
mov esi, dword [ebp - 0x30]
mov cl, byte [ebx + esi]
mov byte [0x10123728], cl
mov dword [0x1012371c], 0x2285
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10123728]
mov edx, dword [0x10123724]
mov byte [ebx + edx], cl
mov dword [0x10123718], 0xce3
mov edx, dword [0x10123720]
add edx, 1
mov dword [0x10123720], edx
cmp edx, 0x100
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edx
jl 0x1000c30a
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000c455
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1012371c], 0x1669
mov dword [0x10123718], 0x5a0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x1000c53b
mov dword [0x10123718], 0xb1f
mov eax, dword [ebp - 0x30]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10123718], 0xc6
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x34], eax
call fcn.1000c076
xor eax, eax
mov ecx, dword [ebp - 0x34]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x10123718], 0xf02
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x38], ecx
mov ecx, dword [ebp - 0x34]
mov dword [edx + 0x28], ecx
mov dword [0x1012371c], 0x123a
cmp ecx, 0
mov dword [ebp - 0x38], eax
jne 0x1000c524
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
mov dword [0x1012371c], 0x1815
mov eax, dword [ebp - 0x34]
add eax, 0x19e0
mov dword [ebp - 0x38], eax
jmp 0x1000c51c
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1011f7e8]
mov dh, byte [eax + 0x1011f7b9]
sub dh, dl
mov byte [ebp + eax - 0x20], dh
cmp ecx, 0xe
mov dword [ebp - 0x2c], ecx
jne 0x1000c53b
lea eax, [ebp - 0x20]
mov dword [0x10123718], 0x26eb
mov dword [0x1012371c], 0x7fc
mov dword [ebp - 0x3c], eax
call fcn.1000cdab
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call fcn.1000be6f
xor ecx, ecx
mov dword [0x10123718], 0x79
cmp eax, 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ecx
je 0x1000c51c
jmp 0x1000c485
Function at 0x1000c66c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [0x1012371c]
add ecx, 0xfffff6df
mov dword [0x10123718], ecx
mov dword [0x1012371c], 0x1131
mov dword [ebp - 0x10], eax
call fcn.1000d172
xor ecx, ecx
mov edx, eax
mov dword [0x1012371c], 0x1283
mov dword [0x10123718], 0x15c6
mov esi, dword [eax + 0x3c]
mov dword [0x1012371c], 0x8cd
mov esi, dword [eax + esi + 0x78]
mov dword [0x1012371c], 0x3582
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x10123718], 0xffffecce
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x1000c70d
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jmp 0x1000c725
mov eax, dword [ebp - 0x24]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x2d]
test al, 1
jne 0x1000c7cd
jmp 0x1000c7a0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [0x10123718], 0x2c61
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x2d], cl
je 0x1000c718
mov al, byte [ebp - 0x45]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x44]
add edx, 1
mov ah, byte [ebp - 0x2d]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x40], edx
jne 0x1000c749
jmp 0x1000c718
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov edx, dword [ebp - 0x34]
add edx, 2
mov esi, dword [ebp - 0x18]
cmp ecx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jb 0x1000c725
jmp 0x1000c70d
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x1012371c], 0x553
mov ecx, dword [edx + ecx*4]
mov dword [0x10123718], 0x15a4
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
jmp 0x1000c70d
Function at 0x1000c801
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1012371c], 0x1d26
mov dword [0x10123718], 0x60c
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
jmp 0x1000c8d6
mov eax, dword [ebp - 0x3c]
add eax, 0x105ee
mov ecx, dword [ebp - 0x3c]
add ecx, 0xd1d71
mov edx, dword [ebp - 0x3c]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x40]
mov dword [esp + 8], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
call fcn.1000ccfe
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x48]
mov dword [ecx], edx
mov dword [ecx + 4], 0x142000
mov edx, dword [ebp - 0x44]
mov dword [ecx + 8], edx
mov edx, dword [0x10123718]
add edx, 0x1cd8
mov dword [0x1012371c], edx
mov dword [ecx + 0xc], 0x2090
mov edx, dword [0x1012371c]
add edx, 0xffffe7ff
mov dword [0x1012371c], edx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1011f7e8]
mov dh, byte [eax + 0x1011f7b9]
sub dh, dl
mov byte [ebp + eax - 0x2c], dh
cmp ecx, 0xe
mov dword [ebp - 0x4c], ecx
je 0x1000c942
jmp 0x1000c8aa
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
mov esi, ecx
add esi, 1
imul edi, ecx, 0x1c
mov ebx, edx
add ebx, edi
add ebx, 0x14
imul ecx, ecx, 0x1c
add edx, ecx
add edx, 0x18
mov ecx, dword [edx]
movzx edx, word [ebx]
xor edx, ecx
add edx, eax
cmp esi, 0x1f7
mov eax, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], eax
jne 0x1000c8d6
xor eax, eax
mov dword [0x1012371c], 0x780
mov dword [0x10123718], 0x5a0
mov dword [ebp - 0x4c], eax
jmp 0x1000c8aa
lea eax, [ebp - 0x2c]
mov dword [0x10123718], 0xfffe294f
mov dword [0x1012371c], 0xfffe0a60
mov dword [ebp - 0x50], eax
call fcn.1000cdab
mov dword [esp], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
call fcn.1000be6f
mov ecx, eax
mov dword [0x10123734], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [0x10123718]
add edx, 0xffffe776
mov dword [0x10123718], edx
mov edx, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
lea edx, section..data
imul esi, ecx, 0x1c
mov edi, edx
add edi, esi
add edi, 0x14
imul esi, ecx, 0x1c
mov ebx, edx
add ebx, esi
mov esi, dword [ebp - 0x3c]
add esi, eax
mov dword [ebp - 0x5c], eax
mov eax, ecx
add eax, 1
imul ecx, ecx, 0x1c
add edx, ecx
add edx, 0x18
mov ecx, dword [edx]
mov edx, dword [ebx]
movzx edi, word [edi]
xor edi, ecx
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], edi
call fcn.1000d0cd
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x60]
cmp edx, 0x1f7
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], eax
je 0x1000c833
jmp 0x1000c9b7
Function at 0x1000cee9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x10123718], 0x1557
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x1012371c], 0x43b
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000cf5f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1000cfaa
jmp 0x1000d028
mov dword [0x1012371c], 0xfffff81a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000cfe2
jmp 0x1000d028
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x1000cf96
mov dword [0x10123718], 0x96f
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jl 0x1000cf5f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x1000cf29
jmp 0x1000d028
mov dword [0x10123718], 0xffffeee6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000d028
mov dword [0x1012371c], 0xffffd45e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000cf3d
jmp 0x1000d028
mov dword [0x10123718], 0x2244
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1000d028
mov dword [0x1012371c], 0x220f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x1000d028
mov eax, 1
mov dword [0x10123718], 0x720
mov dword [ebp - 0x20], eax
jmp 0x1000d037
xor eax, eax
mov dword [0x1012371c], 0xe66
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x1000d304
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10123720], 0
mov dword [0x10123724], 0
mov dword [0x10123730], 0
mov ebx, dword [0x10123718]
add ebx, 0xffffe9e9
mov dword [0x1012371c], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1000d491
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
mov ebx, esi
add ebx, 1
add ecx, 0xffffe742
add eax, 1
mov dword [ebp - 0x30], edx
cdq
idiv edi
mov dword [0x10123720], edx
mov dword [0x10123718], 0x1896
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x30]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x10123724], edx
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x38]
mov cl, byte [ecx + edi]
mov byte [0x10123728], cl
mov ecx, dword [ebp - 0x34]
mov dword [0x10123718], ecx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x24]
mov byte [edx + edi], cl
mov cl, byte [0x10123728]
mov edx, dword [0x10123724]
mov edi, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov edx, dword [0x10123718]
add edx, 0xffffee17
mov dword [0x1012371c], edx
mov edx, dword [0x10123720]
movzx edx, byte [edi + edx]
mov ecx, dword [0x10123724]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x10123730], ecx
mov dword [0x10123718], 0x1309
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x1c]
mov ch, byte [edx + esi]
mov dword [0x1012371c], 0x904
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov dword [0x10123718], 0x1ce0
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x3c], ebx
je 0x1000d491
mov eax, dword [0x10123720]
mov ecx, dword [0x1012371c]
mov edx, dword [0x10123724]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2c], eax
jmp 0x1000d372
mov dword [0x10123718], 0x129a
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d4a3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x10123718]
add edx, 0x148
mov dword [0x1012371c], edx
mov dword [0x10123718], 0x1530
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000c801
lea ecx, [0x1000c1ca]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x44], edx
mov dword [esp + 0x3c], 0x142000
mov edx, dword [0x10123704]
mov dword [esp + 0x54], edx
mov edx, dword [0x10123708]
mov dword [esp + 0x38], edx
mov edx, dword [0x1012370c]
mov dword [esp + 0x70], edx
mov edx, dword [0x10123710]
mov dword [esp + 0x40], edx
mov edx, dword [0x10123714]
mov dword [esp + 0x24], edx
mov dword [0x10123718], 0xfe6
mov dword [0x1012371c], 0xf09
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1000d60d
mov dword [0x10123718], 0x1c76
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1000d60d
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x20]
mov ecx, dword [0x10123718]
add ecx, 0xffffdda3
mov dword [0x1012371c], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000c455
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x10123718]
add ecx, 0xffffe64c
mov dword [0x10123718], ecx
mov dword [esp + 0xc], eax
jmp 0x1000d56f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x50], eax
mov dword [0x10123718], 0x15c6
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x20], edx
mov dword [0x1012371c], 0x10f6
call fcn.1000cee9
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
je 0x1000d577
jmp 0x1000d56f
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1000d54e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x1000d5ca
jmp 0x1000d54e

Function at 0x427432
Capabilities:
Encode data using xor

Disassembly:
pop ebp
clc
pushal
lea edi, [ebp + 0x42]
mov si, 0x256
cld
mov cl, byte [edi]
xor cl, 0x59
rol cl, 0xc4
xor cl, 0x18
mov byte [edi], cl
inc edi
dec si
jne 0x42743d
jmp 0x427495
fmul st(0)
fdivr dword [esi + 0x7d0c6bc0]
invalid
Function at 0x402451
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [ebp - 0x14], edx
mov ebx, dword [eax + 0x2c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
test ebx, ebx
jne 0x4024b7
sub esp, 0xc
push dword [eax + 0xc]
call dword [0x41e014]
add esp, 0x10
push eax
pop edi
test eax, eax
je 0x40257a
sub esp, 0xc
mov ebx, dword [fcn.0041d2f0]
push eax
call fcn.0041d320
mov dword [esp], eax
call ebx
mov dword [esp], edi
mov dword [ebp - 0x10], eax
call dword [0x41e00c]
add esp, 0x10
cmp dword [ebp - 0x10], 0
je 0x40257a
mov ebx, dword [ebp - 0x10]
push eax
push eax
push 0x5c
push ebx
call fcn.0041db30
add esp, 0x10
test eax, eax
jne 0x4024db
push eax
push eax
push 0x22
push ebx
call fcn.0041db30
xor esi, esi
add esp, 0x10
or eax, eax
je 0x40253c
cld
xor eax, eax
or ecx, 0xffffffff
push ebx
pop edi
sub esp, 0xc
repne scasb al, byte es:[edi]
not ecx
lea ecx, [ecx + ecx - 1]
push ecx
call dword [0x41e008]
add esp, 0x10
push eax
pop ecx
test eax, eax
je 0x402506
push eax
pop esi
push eax
pop edx
push ebx
pop edi
jmp 0x402531
cmp dword [ebp - 0x10], 0
je 0x40257a
sub esp, 0xc
nop
nop
push 0x1b
pop ebx
push dword [ebp - 0x10]
call dword [0x41e00c]
jmp 0x402575
cmp al, 0x5c
je 0x402527
cmp al, 0x22
jne 0x40252b
mov byte [edx], 0x5c
inc edx
mov al, byte [edi]
inc edi
mov byte [edx], al
inc edx
mov al, byte [edi]
test al, al
jne 0x40251f
mov byte [edx], 0
push ecx
pop ebx
push ebx
push str.__filename__s_
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.00402410
add esp, 0x10
push eax
pop ebx
test esi, esi
je 0x402563
sub esp, 0xc
push esi
call dword [0x41e00c]
add esp, 0x10
cmp dword [ebp - 0x10], 0
je 0x40257f
sub esp, 0xc
push dword [ebp - 0x10]
call dword [0x41e00c]
add esp, 0x10
jmp 0x40257f
push 0x1b
pop ebx
pushal
popal
lea esp, [ebp - 0xc]
push ebx
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403b1d
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push esi
push ebx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x403b40
cmp dword [esi + 0x48], 0
je 0x403b40
push eax
push 2
push 3
push esi
call fcn.00411544
add esp, 0x10
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
or eax, eax
jne 0x403b67
cmp dword [ebx + 4], 0
jne 0x403b67
sub esp, 0xc
push dword [ebx]
call fcn.004112d0
mov dword [esp], ebx
call dword [0x41e00c]
add esp, 0x10
test esi, esi
je 0x403b86
cmp dword [esi + 0x48], 0
je 0x403b86
mov dword [ebp + 0xc], 3
mov dword [ebp + 8], esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp fcn.00411584
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40439b
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push esi
push ebx
push ecx
push ecx
push 0x8710
push 1
call dword [0x41e018]
push eax
pop ebx
add esp, 0x10
push 0x1b
pop eax
pushal
popal
test ebx, ebx
je 0x40448f
sub esp, 0xc
mov dword [ebx + 0x870c], 0xc0dedbad
mov esi, 0x1b
push 0x100
call dword [0x41e008]
add esp, 0x10
mov dword [ebx + 0x52c], eax
or eax, eax
je 0x40445a
sub esp, 0xc
lea eax, [ebx + 0x118]
push eax
call fcn.004041f4
or dword [ebx + 0x440], 0x10
add esp, 0x10
push eax
pop esi
mov dword [ebx + 0x530], 0x100
mov dword [ebx + 0x528], 0
mov dword [ebx + 0x8538], 0xffffffff
mov dword [ebx + 0x853c], 0xffffffff
mov dword [ebx + 0x8648], 0
mov dword [ebx + 0x8654], 0
mov dword [ebx + 0x3c0], 0
mov dword [ebx + 0x3d8], 5
or eax, eax
je 0x404488
mov eax, dword [ebx + 0x52c]
or eax, eax
je 0x404471
sub esp, 0xc
push eax
call dword [0x41e00c]
add esp, 0x10
sub esp, 0xc
push ebx
call fcn.0040412c
mov dword [esp], ebx
call dword [0x41e00c]
add esp, 0x10
jmp 0x40448d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
push esi
pop eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x405369
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, eax
push edx
pop esi
push ecx
pop edi
cmp dword [eax + 0x368], 0
je 0x4053a6
sub esp, 0xc
push dword [ecx]
call dword [0x41e00c]
pop eax
push dword [ebx + 0x368]
call dword [0x41e014]
add esp, 0x10
mov dword [edi], eax
or eax, eax
je 0x405445
cmp dword [ebx + 0x36c], 0
je 0x4053d6
mov eax, dword [ebp + 8]
sub esp, 0xc
push dword [eax]
call dword [0x41e00c]
pop eax
push dword [ebx + 0x36c]
call dword [0x41e014]
mov edx, dword [ebp + 8]
add esp, 0x10
test eax, eax
mov dword [edx], eax
je 0x405445
cmp dword [ebx + 0x370], 0
je 0x405406
mov eax, dword [ebp + 0xc]
sub esp, 0xc
push dword [eax]
call dword [0x41e00c]
pop eax
push dword [ebx + 0x370]
call dword [0x41e014]
mov edx, dword [ebp + 0xc]
add esp, 0x10
test eax, eax
mov dword [edx], eax
je 0x405445
mov byte [esi + 0x1d2], 0
cmp dword [ebx + 0x2c4], 0
je 0x40544c
push dword [ebx + 0x330]
push dword [ebp + 8]
push edi
push dword [esi + 0x98]
call fcn.00418bdc
add esp, 0x10
cmp eax, 0
jg 0x40544c
jne 0x405445
mov byte [esi + 0x1d2], 1
mov byte [esi + 0x1c4], 1
jmp 0x40544c
push 0x1b
pop eax
pushal
popal
jmp 0x40544e
sub eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret