joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100087d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x1002af50], eax
mov edx, 1
dec edx
nop
inc edx
mov eax, edx
dec eax
mov ecx, dword [eax*4 + 0x1002af50]
shr ecx, 0x1e
mov eax, edx
dec eax
mov eax, dword [eax*4 + 0x1002af50]
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x1002af50], ecx
cmp edx, 0x26f
jl 0x100087dc
mov dword [0x10023860], 0x270
ret

Function at 0x10008820
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], esi
mov eax, dword [0x1002a010]
cmp eax, dword [0x100237f0]
je 0x10008841
mov dword [0x10023860], 0x271
mov eax, dword [0x10023860]
cmp eax, 0x270
jl 0x10008969
mov eax, dword [0x10023860]
cmp eax, 0x271
jne 0x10008878
mov eax, dword [0x1002a010]
call fcn.100087d0
mov eax, dword [0x1002a010]
not eax
mov dword [0x1002a010], eax
mov dword [0x100237f0], eax
mov edx, 0
dec edx
mov esi, esi
inc edx
mov eax, edx
inc eax
mov eax, dword [eax*4 + 0x1002af50]
and eax, 0x7fffffff
mov ebx, dword [edx*4 + 0x1002af50]
and ebx, 0x80000000
or eax, ebx
mov ecx, eax
mov eax, edx
add eax, 0x18d
mov ebx, ecx
shr ebx, 1
mov esi, dword [eax*4 + 0x1002af50]
xor esi, ebx
mov eax, ecx
and eax, 1
mov eax, dword [eax*4 + 0x10023870]
xor esi, eax
mov dword [edx*4 + 0x1002af50], esi
cmp edx, 0xe2
jl 0x10008880
mov edx, 0xe3
dec edx
inc edx
mov eax, edx
inc eax
mov eax, dword [eax*4 + 0x1002af50]
and eax, 0x7fffffff
mov ebx, dword [edx*4 + 0x1002af50]
and ebx, 0x80000000
or eax, ebx
mov ecx, eax
mov eax, edx
add eax, 0xffffff1d
mov ebx, ecx
shr ebx, 1
mov esi, dword [eax*4 + 0x1002af50]
xor esi, ebx
mov eax, ecx
and eax, 1
mov eax, dword [eax*4 + 0x10023870]
xor esi, eax
mov dword [edx*4 + 0x1002af50], esi
cmp edx, 0x26e
jl 0x100088d8
mov eax, dword [0x1002b90c]
and eax, 0x80000000
mov edx, dword [0x1002af50]
and edx, 0x7fffffff
or eax, edx
mov ecx, eax
shr eax, 1
mov edx, dword [0x1002b580]
xor eax, edx
and ecx, 1
mov edx, dword [ecx*4 + 0x10023870]
xor eax, edx
mov dword [0x1002b90c], eax
mov dword [0x10023860], 0
mov eax, dword [0x10023860]
mov edx, dword [eax*4 + 0x1002af50]
inc dword [0x10023860]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 8
ret
Function at 0x1000c430
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 0
mov dword [0x1002ad40], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.1000c620
mov eax, dword [0x1002ad40]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x110]
inc ecx
lea eax, [ebp - 0x108]
call fcn.10001eb0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x10023300], eax
mov ebx, dword [0x10023300]
jmp 0x1000c5cd
inc ebx
movzx eax, byte [ebx]
dec eax
cmp eax, 0x20
jb 0x1000c4cc
mov al, byte [ebx]
test al, al
je 0x1000c5d7
mov byte [ebp - 0x10c], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x1000c53c
mov al, byte [ebx]
cmp al, 1
jb 0x1000c535
sub al, 0x20
jbe 0x1000c508
sub al, 2
je 0x1000c51a
jmp 0x1000c535
mov al, byte [ebp - 0x10c]
test al, al
je 0x1000c542
inc dword [ebp - 0x110]
jmp 0x1000c53b
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x1000c532
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x1000c53b
inc ebx
jmp 0x1000c53b
inc dword [ebp - 0x110]
inc ebx
mov al, byte [ebx]
test al, al
jne 0x1000c4f8
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x1000c5c7
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.1000c620
mov byte [ebp - 0x10c], 0
mov ebx, edi
mov eax, dword [0x1002ad40]
mov edx, dword [ebp - 0x114]
mov esi, dword [eax + edx*4]
jmp 0x1000c5be
mov al, byte [ebx]
cmp al, 1
jb 0x1000c5b8
sub al, 0x20
jbe 0x1000c58c
sub al, 2
je 0x1000c59d
jmp 0x1000c5b8
mov al, byte [ebp - 0x10c]
test al, al
je 0x1000c5c4
mov al, byte [ebx]
mov byte [esi], al
inc esi
jmp 0x1000c5bd
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x1000c5b5
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x1000c5bd
inc ebx
jmp 0x1000c5bd
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
mov al, byte [ebx]
test al, al
jne 0x1000c57c
mov byte [esi], 0
inc dword [ebp - 0x114]
mov al, byte [ebx]
test al, al
jne 0x1000c4cd
mov ebx, dword [ebp - 0x114]
mov dword [0x1002ad30], ebx
mov edx, ebx
inc edx
shl edx, 2
mov eax, 0x1002ad40
call fcn.1000a2f0
mov eax, dword [0x1002ad40]
mov dword [eax + ebx*4], 0
mov ebx, dword [ebp - 0x120]
mov esi, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x118]
leave
ret

Function at 0x1000de60
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 4
mov dword [esp], ebx
mov dx, 0
dec dx
inc dx
movsx eax, dx
mov ecx, eax
mov bx, 1
dec bx
lea esi, [esi]
inc bx
mov eax, ecx
and eax, 1
je 0x1000de92
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x1000de98
mov eax, ecx
shr eax, 1
mov ecx, eax
cmp bx, 8
jl 0x1000de7c
movsx eax, dx
mov dword [eax*4 + 0x1002db20], ecx
cmp dx, 0xff
jl 0x1000de6c
mov ebx, dword [esp]
add esp, 4
ret
Function at 0x1000dec0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov ebx, eax
mov edi, edx
mov esi, ecx
mov eax, dword [0x1002db24]
test eax, eax
jne 0x1000dee2
call fcn.1000de60
not ebx
mov eax, ebx
mov ebx, esi
mov esi, 1
cmp ebx, esi
jl 0x1000df13
dec esi
mov esi, esi
inc esi
mov dl, al
mov cl, byte [edi]
xor cl, dl
movzx edx, cl
mov ecx, eax
shr ecx, 8
mov edx, dword [edx*4 + 0x1002db20]
xor edx, ecx
mov eax, edx
inc edi
cmp ebx, esi
jg 0x1000def4
mov edx, eax
not edx
mov eax, edx
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret

Function at 0x10016050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x662], 0xfc
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0x4b
mov byte [ebp - 0x65f], 0x66
mov byte [ebp - 0x65e], 0x62
test dword [edx + 0x62fffff9], esp
test dword [edx + 0x62fffff9], esp
mov byte [ebp - 0x65d], 0x73
mov byte [ebp - 0x65c], 0x42
mov byte [ebp - 0x65b], 0x6f
mov byte [ebp - 0x65a], 0x6f
mov byte [ebp - 0x659], 0x6c
mov byte [ebp - 0x658], 0x60
mov byte [ebp - 0x657], 3
lea eax, [ebp - 0x664]
push eax
call fcn.1001550a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100154bf
add esp, 0xc
mov dword [ebp - 0x67c], eax
call fcn.100154fa
jne 0x1001612a
push es
jne 0x10016033
movsd dword es:[edi], dword [esi]
fdiv st(2), st(0)
invalid
test dword [esp + edi*8 - 1], esp
invalid
Function at 0x1001b9e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x58]
mov eax, 1
call fcn.10007b60
call fcn.10009220
push eax
test eax, eax
jne 0x1001bbfe
push dword [sym.ALLOCHOOK.dll_CEInitializationFinished]
call sub.kernel32.dll_ResetEvent
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_GetProcessHeaps
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x1001bbec
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
mov edx, 0x100262a0
lea eax, [ebp - 8]
mov ecx, 1
call fcn.10006c90
mov eax, dword [ebp - 8]
push eax
push dword [ebp - 0xc]
call sub.kernel32.dll_GetProcessHeaps
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x1001bbec
mov ebx, dword [ebp - 0xc]
dec ebx
mov dword [ebp - 0x14], 0
cmp ebx, dword [ebp - 0x14]
jl 0x1001bbec
dec dword [ebp - 0x14]
mov esi, esi
inc dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
push dword [eax + edx*4]
call sub.kernel32.dll_HeapLock
lea ecx, [ebp - 0x6c]
lea edx, [ebp - 0x84]
mov eax, 1
call fcn.10007b60
call fcn.10009220
push eax
test eax, eax
jne 0x1001bbc3
push 0x20
lea eax, [ebp - 0x34]
push eax
call fcn.1000e360
jmp 0x1001bba9
movzx eax, word [ebp - 0x2a]
cmp eax, 4
jne 0x1001bba9
mov eax, dword [0x1002e140]
call fcn.10022600
lea ecx, [ebp - 0x90]
lea edx, [ebp - 0xa8]
mov eax, 1
call fcn.10007b60
call fcn.10009220
push eax
test eax, eax
jne 0x1001bb8d
mov dword [sym.ALLOCHOOK.dll_HookEventData], 2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [edx + eax*4]
mov edx, 0
mov dword [0x1002e0e8], eax
mov dword [0x1002e0ec], edx
mov dword [0x1002e0f0], 0
mov eax, dword [ebp - 0x30]
mov dword [0x1002e0f4], eax
mov dword [0x1002e0f8], 0
mov dword [0x1002e0fc], 0
mov eax, dword [ebp - 0x34]
mov edx, 0
mov dword [0x1002e100], eax
mov dword [0x1002e104], edx
push dword [sym.ALLOCHOOK.dll_HasSetupDataEvent]
call sub.kernel32.dll_SetEvent
push 0x1388
push dword [sym.ALLOCHOOK.dll_CEHasHandledItEvent]
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x1001bb8d
mov eax, str.CeRtlAllocateHeap:timeout_on_CEHasHandledItEvent
push eax
call sub.kernel32.dll_OutputDebugStringA
call fcn.10007e30
mov eax, dword [0x1002e140]
call fcn.10022610
pop eax
test eax, eax
je 0x1001bba9
dec eax
test eax, eax
call fcn.10007fa0
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
push dword [eax + edx*4]
call sub.kernel32.dll_HeapWalk
test eax, eax
jne 0x1001bacc
call fcn.10007e30
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
push dword [eax + edx*4]
call sub.kernel32.dll_HeapUnlock
pop eax
test eax, eax
je 0x1001bbe3
dec eax
test eax, eax
call fcn.10007fa0
cmp ebx, dword [ebp - 0x14]
jg 0x1001ba88
mov dword [ebp - 4], 0xffffffff
push dword [sym.ALLOCHOOK.dll_CEInitializationFinished]
call sub.kernel32.dll_SetEvent
call fcn.10007e30
mov edx, 0x100262a0
lea eax, [ebp - 8]
call fcn.10008600
pop eax
test eax, eax
je 0x1001bc1a
call fcn.10007fa0
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xb0]
leave
ret
Function at 0x1001bc30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [sym.ALLOCHOOK.dll_RtlAllocateHeapOrig]
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001bccf
mov eax, dword [0x1002e140]
call fcn.10022600
mov dword [sym.ALLOCHOOK.dll_HookEventData], 2
mov edx, dword [ebp + 8]
mov eax, 0
mov dword [0x1002e0e8], edx
mov dword [0x1002e0ec], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1002e0f0], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1002e0f4], eax
mov edx, dword [ebp - 4]
mov eax, 0
mov dword [0x1002e100], edx
mov dword [0x1002e104], eax
push dword [sym.ALLOCHOOK.dll_HasSetupDataEvent]
call sub.kernel32.dll_SetEvent
push 0x1388
push dword [sym.ALLOCHOOK.dll_CEHasHandledItEvent]
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x1001bcc5
mov eax, str.CeRtlAllocateHeap:timeout_on_CEHasHandledItEvent
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x1002e140]
call fcn.10022610
mov eax, dword [ebp - 4]
leave
ret 0xc

Function at 0x1001bce0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [sym.ALLOCHOOK.dll_RtlFreeHeapOrig]
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001bd73
mov eax, dword [0x1002e140]
call fcn.10022600
mov dword [sym.ALLOCHOOK.dll_HookEventData], 3
mov eax, dword [ebp + 8]
mov edx, 0
mov dword [0x1002e0e8], eax
mov dword [0x1002e0ec], edx
mov eax, dword [ebp + 0xc]
mov dword [0x1002e0f0], eax
mov eax, dword [ebp + 0x10]
mov edx, 0
mov dword [0x1002e0f8], eax
mov dword [0x1002e0fc], edx
push dword [sym.ALLOCHOOK.dll_HasSetupDataEvent]
call sub.kernel32.dll_SetEvent
push 0x1388
push dword [sym.ALLOCHOOK.dll_CEHasHandledItEvent]
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x1001bd69
mov eax, str.CeRtlFreeHeap:timeout_on_CEHasHandledItEvent
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x1002e140]
call fcn.10022610
mov eax, dword [ebp - 4]
leave
ret 0xc

Function at 0x1001bd80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push dword [ebp + 8]
mov eax, dword [sym.ALLOCHOOK.dll_RtlDestroyHeapOrig]
call eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001bdf2
mov eax, dword [0x1002e140]
call fcn.10022600
mov dword [sym.ALLOCHOOK.dll_HookEventData], 4
mov edx, dword [ebp + 8]
mov eax, 0
mov dword [0x1002e0e8], edx
mov dword [0x1002e0ec], eax
push dword [sym.ALLOCHOOK.dll_HasSetupDataEvent]
call sub.kernel32.dll_SetEvent
push 0x1388
push dword [sym.ALLOCHOOK.dll_CEHasHandledItEvent]
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x1001bde8
mov eax, str.CeRtlDestroyHeap:timeout_on_CEHasHandledItEvent
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x1002e140]
call fcn.10022610
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x1001be00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [sym.ALLOCHOOK.dll_NtAllocateVirtualMemoryOrig]
call eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001bee4
mov eax, dword [0x1002e140]
call fcn.10022600
mov dword [sym.ALLOCHOOK.dll_HookEventData], 0
mov eax, dword [ebp + 8]
mov edx, 0
mov dword [0x1002e0e8], eax
mov dword [0x1002e0ec], edx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001be6f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, 0
mov dword [0x1002e0f0], eax
mov dword [0x1002e0f4], edx
jmp 0x1001be83
mov dword [0x1002e0f0], 0
mov dword [0x1002e0f4], 0
mov eax, dword [ebp + 0x18]
mov dword [0x1002e0f8], eax
mov eax, dword [ebp + 0x1c]
mov dword [0x1002e0fc], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1001bea6
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [0x1002e100], eax
jmp 0x1001beb0
mov dword [0x1002e100], 0
push dword [sym.ALLOCHOOK.dll_HasSetupDataEvent]
call sub.kernel32.dll_SetEvent
push 0x1388
push dword [sym.ALLOCHOOK.dll_CEHasHandledItEvent]
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x1001beda
mov eax, str.Alloc:timeout_on_CEHasHandledItEvent
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x1002e140]
call fcn.10022610
mov eax, dword [ebp - 4]
leave
ret 0x18

Function at 0x1001bef0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [sym.ALLOCHOOK.dll_NtFreeVirtualMemoryOrig]
call eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001bfc6
mov eax, dword [0x1002e140]
call fcn.10022600
mov dword [sym.ALLOCHOOK.dll_HookEventData], 1
mov edx, dword [ebp + 8]
mov eax, 0
mov dword [0x1002e0e8], edx
mov dword [0x1002e0ec], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001bf59
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, 0
mov dword [0x1002e0f0], edx
mov dword [0x1002e0f4], eax
jmp 0x1001bf6d
mov dword [0x1002e0f0], 0
mov dword [0x1002e0f4], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1001bf80
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [0x1002e0f8], eax
jmp 0x1001bf8a
mov dword [0x1002e0f8], 0
mov eax, dword [ebp + 0x14]
mov dword [0x1002e0fc], eax
push dword [sym.ALLOCHOOK.dll_HasSetupDataEvent]
call sub.kernel32.dll_SetEvent
push 0x1388
push dword [sym.ALLOCHOOK.dll_CEHasHandledItEvent]
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x1001bfbc
mov eax, str.Free:timeout_on_CEHasHandledItEvent
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x1002e140]
call fcn.10022610
mov eax, dword [ebp - 4]
leave
ret 0x10
Function at 0x1001f900
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push esi
push edi
mov eax, ebx
mov edx, 0
call fcn.1001f8a0
cmp edx, esi
jne 0x1001f93a
cmp eax, edi
jne 0x1001f93a
push ebx
call sub.kernel32.dll_SetEndOfFile
or eax, eax
setne al
jmp 0x1001f93c
mov al, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
leave
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x592ec0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.Kira2
lea edi, [esi - 0x124000]
push edi
or ebp, 0xffffffff
jmp 0x592ee2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x592ee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x592ed8
mov eax, 1
add ebx, ebx
jne 0x592efb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x592f0c
jne 0x592f2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x592f2b
dec eax
add ebx, ebx
jne 0x592f18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x592ef0
add ebx, ebx
jne 0x592f27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x592f7d
xor ecx, ecx
sub eax, 3
jb 0x592f43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x592fb2
sar eax, 1
mov ebp, eax
jmp 0x592f4e
add ebx, ebx
jne 0x592f4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x592f1c
inc ecx
add ebx, ebx
jne 0x592f5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x592f1c
add ebx, ebx
jne 0x592f69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x592f5e
jne 0x592f7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x592f5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x592f9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x592f8e
jmp 0x592ede
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x592f9c
add edi, ecx
jmp 0x592ede
pop esi
mov edi, esi
mov ecx, 0x39ba
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x592fba
cmp byte [edi], 0x19
jne 0x592fba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x592fbf
lea edi, [esi + 0x18a000]
mov eax, dword [edi]
or eax, eax
je 0x593037
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x194838]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19498c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x592fec
mov ecx, edi
jns 0x59301b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x194994]
or eax, eax
je 0x593031
mov dword [ebx], eax
add ebx, 4
jmp 0x593009
call dword [esi + 0x194990]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x593068
cmp al, 0xef
ja 0x59305b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x59303d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x59304a
mov ebp, dword [esi + 0x194998]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x59309c
sub esp, 0xffffff80
jmp 0x48c3e4
Function at 0x405dd0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
mov eax, dword [0x4fc4d0]
test eax, eax
push ebx
push esi
push edi
push ebp
je 0x405df1
mov edx, dword [eax + 0xc]
pop ebp
pop edi
mov dword [0x4fc4d0], edx
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [0x4fc4cc]
cmp dword [0x4fc4c8], eax
jne 0x405ec4
push 0
mov esi, dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
call esi
add esp, 4
push 8
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x405e4b
mov ebp, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
mov ebx, dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
call ebx
push eax
call ebp
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
jmp 0x405e51
mov ebx, dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push 0
call esi
add esp, 4
push 0xff0
call sub.MFC40.DLL_operator_new
add esp, 4
mov ebp, eax
test ebp, ebp
jne 0x405e8f
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call ebx
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov dword [edi + 4], ebp
mov eax, dword [0x4fc4d4]
mov dword [edi], eax
mov dword [0x4fc4d4], edi
mov ebp, dword [edi + 4]
mov dword [0x4fc4cc], ebp
lea eax, [ebp + 0xff0]
add dword [0x4fc4cc], 0x18
mov dword [0x4fc4c8], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [0x4fc4cc]
pop ebp
add dword [0x4fc4cc], 0x18
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x406ee0
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x5003e0
jmp 0x401020

Function at 0x40ab70
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x500428
jmp 0x401020

Function at 0x40c190
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x40c1db
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret