joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100396d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100398a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100397ad
mov edx, dword [ebp - 4]
cmp edx, dword [0x10054004]
jb 0x1003971a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10054008]
ja 0x1003971a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100396ea
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1003973f
jmp 0x100397ad
cmp dword [ebp - 0x14], 0x10000
jne 0x10039793
cmp dword [ebp - 0x18], 0x10000
jb 0x10039793
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10039776
mov eax, dword [ebp - 8]
jmp 0x100397af
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10039786
xor eax, eax
jmp 0x100397af
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100397a8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100398a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100396ea
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100397c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100398d0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10039895
mov edx, dword [ebp - 4]
cmp edx, dword [0x10054004]
jb 0x10039805
mov eax, dword [ebp - 4]
cmp eax, dword [0x10054008]
ja 0x10039805
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100397d5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1003982a
jmp 0x10039895
cmp dword [ebp - 0x14], 0x10000
jne 0x1003987e
cmp dword [ebp - 0x18], 0x10000
jb 0x1003987e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10039861
mov eax, dword [ebp - 8]
jmp 0x10039897
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10039871
xor eax, eax
jmp 0x10039897
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10039890
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.100398d0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100397d5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10039900
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10039cf0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100570c8], 0
jne 0x1003993d
cmp dword [0x100570c4], 0
je 0x1003993d
mov eax, dword [0x100570c4]
mov dword [0x100570c8], eax
cmp dword [0x100570c8], 0
je 0x100399ba
mov ecx, dword [0x100570c8]
cmp dword [ecx + 8], 0
je 0x100399ba
mov edx, dword [0x100570c8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x100399ba
mov ecx, dword [0x100570c8]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100399ba
mov eax, dword [0x100570c8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10039989
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10039990
xor eax, eax
jmp 0x10039ad9
mov ecx, dword [0x100570c8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10039ad9
mov edx, dword [0x100570c4]
mov dword [0x100570c8], edx
jmp 0x100399d6
mov eax, dword [0x100570c8]
mov ecx, dword [eax + 4]
mov dword [0x100570c8], ecx
cmp dword [0x100570c8], 0
je 0x10039a16
cmp dword [0x100570c8], 0
je 0x10039a14
mov edx, dword [0x100570c8]
cmp dword [edx + 8], 0
je 0x10039a14
mov eax, dword [0x100570c8]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10039a14
mov edx, dword [0x100570c8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10039a14
jmp 0x1003996e
jmp 0x100399c8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10039ae0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10039ad7
mov eax, dword [ebp - 0x18]
mov dword [0x100570c8], eax
mov ecx, dword [0x100570c8]
mov dword [ecx], 0x52727464
mov edx, dword [0x100570c8]
mov dword [edx + 8], 0
mov eax, dword [0x100570c8]
mov ecx, dword [0x100570c4]
mov dword [eax + 4], ecx
mov edx, dword [0x100570c8]
mov dword [0x100570c4], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100570c8]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10039aa7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10039ac7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10039a9e
mov eax, dword [0x100570c8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1003996e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003a820
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100570c4]
mov dword [ebp - 4], eax
jmp 0x1003a839
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1003a860
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1003a85e
call sub.KERNEL32.dll_GetLastError
jmp 0x1003a862
jmp 0x1003a830
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003ad00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100570d4], eax
je 0x1003ad24
mov eax, 0x10dd
jmp 0x1003aecc
cmp dword [0x100570d8], 0
je 0x1003ad37
mov eax, dword [0x100570d8]
jmp 0x1003aecc
cmp dword [ebp + 0xc], 0
jne 0x1003ad47
mov eax, 0x57
jmp 0x1003aecc
cmp dword [ebp + 8], 0
jne 0x1003ad57
mov eax, 6
jmp 0x1003aecc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1003ad80
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x100570d8], ecx
mov edx, dword [ebp + 8]
mov dword [0x100570dc], edx
mov eax, dword [ebp - 8]
jmp 0x1003aecc
push 0x18
call fcn.1003c3e2
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003addb
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x100570d8], ecx
cmp dword [ebp - 4], 0
je 0x1003adca
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1003c435
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x100570dc], ecx
mov eax, dword [ebp - 8]
jmp 0x1003aecc
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1003ace0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1003ace0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1003ae1b
cmp dword [ebp - 0xc], 0x1e
jbe 0x1003ae37
mov dword [ebp - 8], 9
cmp dword [0x100570cc], 0
je 0x1003ae32
jmp 0x1003ada9
jmp 0x1003ada0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1003ae5e
mov dword [ebp - 8], 9
cmp dword [0x100570cc], 0
je 0x1003ae59
jmp 0x1003ada9
jmp 0x1003ada0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1003ae89
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003ada0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x100570e4]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100570e4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1003aee0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100570d4], eax
je 0x1003aefd
mov eax, 0x10dd
jmp 0x1003afe0
mov eax, dword [0x100570e4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003af7c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1003af58
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1003af58
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10039d80
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1003c435
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1003af05
mov dword [0x100570e4], 0
call fcn.1003a660
mov ecx, dword [0x100570e0]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1003afca
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1003c435
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1003af94
mov dword [0x100570e0], 0
mov dword [0x100570d4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003b4c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100570d8], 0
je 0x1003b4d9
mov eax, dword [0x100570d8]
jmp 0x1003b578
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1003b4ea
xor eax, eax
jmp 0x1003b578
push 8
call fcn.1003c3e2
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003b542
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003b52b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1003c435
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100570d8], eax
mov dword [0x100570dc], 0
mov eax, dword [ebp - 8]
jmp 0x1003b578
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1003b55a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003b50a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100570e0]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100570e0], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x485810c9
Capabilities:
Encode data using xor

Disassembly:
pop ebx
mov ecx, 0x49e
xor byte [ecx + ebx], 0x83
loop 0x485810cf

Function at 0x48581741
Capabilities:
Create thread
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea eax, [ebp - 1]
push eax
xor esi, esi
push esi
xor ebx, ebx
inc ebx
push ebx
push 0x11
call edi
lea eax, [ebp - 1]
push eax
push esi
push ebx
push 0x12
call edi
lea eax, [ebp - 1]
push eax
push esi
push ebx
push 0x13
call edi
lea eax, [ebp - 1]
push eax
push esi
push ebx
push 9
call edi
push ebx
call dword [sym.imp.ntdll.dll_NtInitializeRegistry]
test eax, eax
jl 0x485818a9
push esi
push 0x2c
lea eax, [ebp - 0x64]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x485818a9
mov edi, dword [sym.imp.ntdll.dll_NtCreateEvent]
push esi
push ebx
push esi
mov ebx, 0x1f0003
push ebx
push 0x48582848
call edi
test eax, eax
jl 0x485818a9
push esi
push 1
push esi
push ebx
push 0x48582034
call edi
test eax, eax
mov edi, dword [sym.imp.ntdll.dll_NtClose]
jl 0x485818a1
push 0x485810e0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
push esi
push 0x20
push 1
push 1
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x1f01ff
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0x40
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
jl 0x48581899
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 0x4858165c
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_RtlCreateUserThread]
test eax, eax
jl 0x48581894
lea eax, [ebp - 0x68]
push eax
push fcn.48581741
call dword [sym.imp.ntdll.dll_RtlPcToFileHeader]
cmp dword [ebp - 0x68], esi
je 0x48581894
mov eax, dword [0x48582848]
push esi
push esi
mov dword [ebp - 0x70], eax
mov eax, dword [0x48582034]
push 0x3c
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x70]
push eax
push 0x228000
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push dword [ebp - 8]
mov dword [ebp - 0x38], 0x48582040
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push dword [ebp - 0xc]
call edi
push dword [ebp - 8]
call edi
push dword [0x48582034]
call edi
push dword [0x48582848]
call edi
push esi
push esi
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x10dba058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10dba1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10dba07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10dba06a
add dl, dl
jne 0x10dba089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10dba0dc
xor eax, eax
add dl, dl
jne 0x10dba096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10dba17d
add dl, dl
jne 0x10dba0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dba0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dba0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dba0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10dba0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10dba075
mov eax, 1
add dl, dl
jne 0x10dba0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dba0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10dba0e1
sub eax, ebx
mov ebx, 1
jne 0x10dba128
mov ecx, 1
add dl, dl
jne 0x10dba10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10dba119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10dba105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10dba075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10dba13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10dba14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10dba136
cmp eax, 0x7d00
jae 0x10dba16d
cmp eax, 0x500
jb 0x10dba168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10dba075
cmp eax, 0x7f
ja 0x10dba170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10dba075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10dba19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10dba075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404179
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x4256a2
call fcn.004089ba
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
xor bl, bl
push 0
push eax
call fcn.00409df0
xor eax, eax
mov dword [ebp - 0x64], esi
lea edi, [ebp - 0x20]
mov dword [ebp - 0x38], 1
stosd dword es:[edi], eax
lea ecx, [ebp - 0x10]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00401dd6
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push 0x426454
push eax
call fcn.00403308
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x4041da
push 0xa
pop eax
jmp 0x4041dc
xor eax, eax
mov esi, dword [ebp - 0x10]
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404225
cmp dword [ebp + 0x10], 0
je 0x404223
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x18], 0
je 0x404223
push dword [ebp + 0x18]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
cmp dword [ebp - 0x20], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40423a
push dword [ebp - 0x20]
call edi
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x1c], 0
je 0x404249
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
lea ecx, [esi - 0x10]
call fcn.00403ee7
mov al, bl
call fcn.00408997
ret

Function at 0x404535
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40458f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40458f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40457f
cmp esi, ecx
jae 0x40458f
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40456d
cmp esi, ecx
jae 0x40458f
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
jmp 0x404591
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4073b2
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, byte [esp + 4]
mov edx, dword [esp + 8]
push esi
push edi
shl ecx, 4
add ecx, dword [esp + 0x14]
push 4
pop edi
push 4
pop esi
mov al, byte [ecx]
xor byte [edx], al
inc ecx
inc edx
sub esi, 1
jne 0x4073ca
sub edi, 1
jne 0x4073c7
pop edi
pop esi
ret
Function at 0x40743b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x2c
push ebx
push esi
push edi
push 4
lea esi, [eax + 2]
pop edi
mov al, byte [esi - 2]
mov byte [ebp - 0xd], al
mov al, byte [esi - 1]
mov byte [ebp - 9], al
mov al, byte [esi]
mov byte [ebp - 5], al
mov al, byte [esi + 1]
mov byte [ebp - 0x11], al
push dword [ebp - 0x11]
call fcn.004076ba
push eax
mov dword [ebp - 0x2c], eax
call fcn.004076ba
push dword [ebp - 5]
mov byte [ebp - 0x1c], al
call fcn.004076ba
push eax
mov dword [ebp - 0x28], eax
call fcn.004076ba
push dword [ebp - 9]
mov bl, al
call fcn.004076ba
push eax
mov dword [ebp - 0x24], eax
call fcn.004076ba
push dword [ebp - 0xd]
mov byte [ebp - 0x18], al
call fcn.004076ba
push eax
mov dword [ebp - 0x20], eax
call fcn.004076ba
mov dl, al
push edx
call fcn.004076ba
push dword [ebp - 0x18]
mov byte [ebp - 1], al
call fcn.004076ba
xor byte [ebp - 1], al
push ebx
call fcn.004076ba
push dword [ebp - 0x1c]
xor byte [ebp - 1], al
call fcn.004076ba
mov ah, byte [ebp - 1]
add esp, 0x30
mov ch, byte [ebp - 0x11]
xor ah, al
mov cl, ah
xor ah, byte [ebp - 0x18]
xor ah, byte [ebp - 0x1c]
xor cl, dl
mov edx, dword [ebp - 0x24]
xor cl, bl
mov ebx, dword [ebp - 0x20]
mov al, cl
xor al, bl
xor al, dl
xor al, ch
xor al, byte [ebp - 5]
xor al, byte [ebp - 9]
mov byte [esi - 2], al
mov al, ah
xor al, dl
xor ah, bl
mov edx, dword [ebp - 0x28]
xor al, dl
xor al, ch
xor cl, dl
xor al, byte [ebp - 5]
xor al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x2c]
xor cl, dl
xor cl, ch
mov byte [esi - 1], al
mov al, byte [ebp - 9]
xor ah, dl
xor ah, byte [ebp - 5]
xor cl, al
xor cl, byte [ebp - 0xd]
xor ah, al
mov byte [esi], cl
xor ah, byte [ebp - 0xd]
lea esi, [esi + 4]
mov byte [esi - 3], ah
sub edi, 1
jne 0x40744d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4075c3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
push 4
pop ebx
lea edx, [esi + 3]
mov ebp, ebx
lea ecx, [edi + 1]
sub esi, edi
mov al, byte [edx - 3]
mov byte [ecx - 1], al
mov al, byte [esi + ecx]
mov byte [ecx], al
mov al, byte [edx - 1]
mov byte [ecx + 1], al
mov al, byte [edx]
add edx, ebx
mov byte [ecx + 2], al
add ecx, ebx
sub ebp, 1
jne 0x4075dd
lea edx, [edi + 0xd]
mov ah, byte [edx]
mov al, byte [edx - 1]
mov cl, byte [edx + 2]
mov byte [esp + 0x10], al
mov al, ah
mov ah, byte [edx + 1]
mov byte [esp + 0x12], al
mov byte [esp + 0x13], ah
mov byte [esp + 0x11], cl
test bl, 3
jne 0x407664
movzx ecx, al
movzx eax, ah
mov al, byte [eax + str.cw]
mov byte [esp + 0x12], al
movzx eax, byte [esp + 0x11]
mov al, byte [eax + str.cw]
mov byte [esp + 0x13], al
movzx eax, byte [esp + 0x10]
mov al, byte [eax + str.cw]
mov byte [esp + 0x11], al
mov eax, ebx
shr eax, 2
mov al, byte [eax + 0x426a08]
xor al, byte [ecx + str.cw]
mov byte [esp + 0x10], al
mov al, byte [edx - 0xd]
xor al, byte [esp + 0x10]
mov byte [edx + 3], al
mov ah, byte [edx - 0xc]
xor ah, byte [esp + 0x12]
mov byte [edx + 4], ah
mov al, byte [edx - 0xb]
xor al, byte [esp + 0x13]
mov byte [edx + 5], al
mov al, byte [edx - 0xa]
xor al, byte [esp + 0x11]
inc ebx
mov byte [edx + 6], al
add edx, 4
cmp ebx, 0x2c
jb 0x407601
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40769f
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
sub edx, ecx
push esi
push 0x10
pop esi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x4076ad
pop esi
ret

Function at 0x40920c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40924b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40924b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40924b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40924b
cmp dword [ecx + 0x74], 0xe
jbe 0x40924b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4177d7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42a7a8
push 0x42a7a0
push str.FlsAlloc
push 0x1f
call fcn.004176be
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41780b
push dword [ebp + 8]
mov ecx, esi
call dword [0x42619c]
call esi
jmp 0x417811
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x417855
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42a7b8
push 0x42a7b0
push str.FlsGetValue
push 0x21
call fcn.004176be
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41788c
push dword [ebp + 8]
mov ecx, esi
call dword [0x42619c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]