joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020cd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10020ce7
pop dword [ebp - 0x30]
mov eax, 0x10020ce7
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x51950214
sub dword [ebp - 0x40], 0x342bcc9
mov dword [ebp - 0x3c], 0xf691394c
add dword [ebp - 0x3c], 0x3ba212f9
mov dword [ebp - 0x38], 0x7b37051c
add dword [ebp - 0x38], 0xd1153f12
mov dword [ebp - 0x34], 0x9fac072c
add dword [ebp - 0x34], 0x6053f8d4
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x4f3e6606
sub dword [ebp - 0x40], 0xdacbfcb0
mov dword [ebp - 0x3c], 0xef74dd85
add dword [ebp - 0x3c], 0x51f783f0
mov dword [ebp - 0x38], 0xc0960be3
sub dword [ebp - 0x38], 0x5d269f77
mov dword [ebp - 0x34], 0x254bedab
sub dword [ebp - 0x34], 0x254bedab
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x395ec
push 0
call eax
mov ecx, 0xd8312eb9
sub ecx, 0xd830f3d5
mov ebx, eax
mov esi, 0xaa6885a0
add esi, 0x659a3060
add esi, dword [ebp - 0x30]
mov edx, 0xe1b6e669
mov dword [ebp - 0x10], 0x6e3fc82b
mov edi, dword [esi]
xor dword [ebp - 0x2c], edx
sub edi, edx
add dword [ebp - 4], 0xa5c6563e
mov dword [ebx], edi
xor dword [ebp - 0x2c], ebx
add ebx, 0x18c9a47e
add ebx, 0xe7365b86
add esi, 4
loop 0x10020df4
add eax, 0x3adda0d
sub eax, 0x3acfbaa
xor ebx, ebx
add ebx, eax
add eax, 0x17238bbb
sub eax, 0x17238bb6
mov ecx, 0x83d968ab
add ecx, 0x8c269755
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x10023fab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100037dc]
jne 0x100243f1
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100289d8], eax
mov dword [0x100289d4], ecx
mov dword [0x100289d0], edx
mov dword [0x100289cc], ebx
mov dword [0x100289c8], esi
mov dword [0x100289c4], edi
mov word [0x100289f0], ss
mov word [0x100289e4], cs
mov word [0x100289c0], ds
mov word [0x100289bc], es
mov word [0x100289b8], fs
mov word [0x100289b4], gs
pushfd
pop dword [0x100289e8]
mov eax, dword [ebp]
mov dword [0x100289dc], eax
mov eax, dword [ebp + 4]
mov dword [0x100289e0], eax
lea eax, [ebp + 8]
mov dword [0x100289ec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10028928], 0x10001
mov eax, dword [0x100289e0]
mov dword [0x100288dc], eax
mov dword [0x100288d0], 0xc0000409
mov dword [0x100288d4], 1
mov eax, dword [0x100037dc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10028734]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10028920], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100037e4
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10028920], 0
jne 0x100244dd
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4097ac
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
jmp 0x409855
cmp dword [esi + 0x10], 0x1000
jne 0x409841
test byte [esi + 0x15], 1
jne 0x409841
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409800
cmp eax, 2
je 0x409800
cmp eax, 0x10
je 0x409800
cmp eax, 0x20
jne 0x409815
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409815
mov bl, 1
xor ebp, ebp
jmp 0x409826
mov eax, dword [esi]
add eax, ebp
call fcn.004097a4
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409819
test bl, bl
je 0x409841
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097d8
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x83de50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e4000]
push edi
or ebp, 0xffffffff
jmp 0x83de72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x83de79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83de68
mov eax, 1
add ebx, ebx
jne 0x83de8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x83de9c
jne 0x83debb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83debb
dec eax
add ebx, ebx
jne 0x83dea8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x83de80
add ebx, ebx
jne 0x83deb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x83df0d
xor ecx, ecx
sub eax, 3
jb 0x83ded3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x83df42
sar eax, 1
mov ebp, eax
jmp 0x83dede
add ebx, ebx
jne 0x83dede
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83deac
inc ecx
add ebx, ebx
jne 0x83deec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83deac
add ebx, ebx
jne 0x83def9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x83deee
jne 0x83df0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x83deee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x83df2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x83df1e
jmp 0x83de6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x83df2c
add edi, ecx
jmp 0x83de6e
pop esi
mov edi, esi
mov ecx, 0xf945
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x83df4a
cmp byte [edi], 0x22
jne 0x83df4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x83df4f
lea edi, [esi + 0x425000]
mov eax, dword [edi]
or eax, eax
je 0x83dfc7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x442a04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x442aec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x83df7c
mov ecx, edi
jns 0x83dfab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x442af4]
or eax, eax
je 0x83dfc1
mov dword [ebx], eax
add ebx, 4
jmp 0x83df99
call dword [esi + 0x442af0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x83dff8
cmp al, 0xef
ja 0x83dfeb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x83dfcd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x83dfda
mov ebp, dword [esi + 0x442af8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x83e02c
sub esp, 0xffffff80
jmp 0x5cf06c
Function at 0x4066a3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4066fb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4066fb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4066ed
cmp esi, ecx
jae 0x4066fb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x4066db
cmp esi, ecx
jae 0x4066fb
cmp word [esi], 0
je 0x4066fb
mov eax, esi
jmp 0x4066fd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x409b2f
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x284
mov eax, dword [0x429480]
xor eax, esp
mov dword [esp + 0x280], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
push edi
push 0x250
mov dword [ebx + 4], eax
lea eax, [esp + 0x14]
push 0
push eax
mov byte [ebx], 0
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea edx, [ebx + 8]
mov ecx, 0x94
lea esi, [esp + 0x1c]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x409b92
mov eax, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov ecx, dword [ebx + 4]
mov dword [ecx + 0x18], eax
mov eax, dword [ebx + 4]
cmp dword [eax + 0x18], 0xffffffff
jne 0x409bbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x409bd6
mov byte [ebx], 1
mov ecx, dword [esp + 0x28c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421bc0
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea ecx, [esp + 0x26c]
call fcn.00409a9b
push 0x42835c
lea eax, [esp + 0x268]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x41cdc1
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x41cf16
mov edx, 0x10000000
cmp eax, 0x7c
je 0x41cf16
cmp eax, 0x29
jne 0x41cdfc
cmp dword [esi + 0x10], 0
jne 0x41cf16
test dword [esi + 0x50], edx
je 0x41cf1c
cmp eax, 0x2e
jne 0x41ce17
push 5
lea ecx, [esi + 0x24]
call fcn.0041cffa
mov ecx, esi
call fcn.0041cd96
jmp 0x41cf00
cmp eax, 0x5c
jne 0x41ce6c
mov ecx, esi
call fcn.0041cd96
test byte [esi + 0x50], 0x80
je 0x41ce60
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x41ce48
push 4
lea ecx, [esi + 0x24]
call fcn.0041cffa
mov ecx, esi
call fcn.0041cd96
jmp 0x41cf07
cmp eax, 0x42
jne 0x41ce60
push 4
lea ecx, [esi + 0x24]
call fcn.0041cffa
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x41ce3c
mov ecx, esi
call fcn.0041d379
jmp 0x41cf00
cmp eax, 0x5b
jne 0x41ce8c
mov ecx, esi
call fcn.0041cd96
mov ecx, esi
call fcn.0041d32b
cmp dword [esi + 0x4c], 0x5d
je 0x41ce0b
push 4
jmp 0x41cf1e
cmp eax, 0x28
jne 0x41cea9
mov ecx, esi
call fcn.0041cd96
mov ecx, esi
call fcn.0041d45c
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x41cf1c
jmp 0x41cef5
cmp eax, 0x5e
jne 0x41ceb2
push 2
jmp 0x41ce34
cmp eax, 0x24
jne 0x41cebe
push 3
jmp 0x41ce34
cmp eax, 0x2a
je 0x41cf12
cmp eax, 0x2b
je 0x41cf12
cmp eax, 0x3f
je 0x41cf12
cmp eax, 0x7b
je 0x41cf12
cmp eax, 0x7d
jne 0x41cedc
test dword [esi + 0x50], edx
je 0x41cf0e
cmp eax, 0x5d
jne 0x41cee6
test dword [esi + 0x50], edx
je 0x41ce85
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041d629
mov bl, 1
mov ecx, esi
call fcn.0041cd96
test bl, bl
je 0x41cf07
mov ecx, esi
call fcn.0041d54d
mov cl, 1
jmp 0x41cdca
push 6
jmp 0x41cf1e
push 0xa
jmp 0x41cf1e
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.0041c8cb
int3

Function at 0x421e2c
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x421e69
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x421e62
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x421e6e
add edx, 0x28
cmp edx, esi
jne 0x421e53
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x421e6b
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404d5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x404d6c
pop dword [ebp - 0x40]
mov eax, 0x404d6c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x82657b16
sub dword [ebp - 0x50], 0x341335cb
mov dword [ebp - 0x4c], 0x19b33938
add dword [ebp - 0x4c], 0x1880130d
mov dword [ebp - 0x48], 0xf12f0587
sub dword [ebp - 0x48], 0xa4e2c159
mov dword [ebp - 0x44], 0x7670484e
add dword [ebp - 0x44], 0x898fb7b2
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x737aba44
add dword [ebp - 0x50], 0xf7af12
mov dword [ebp - 0x4c], 0xad261cd4
sub dword [ebp - 0x4c], 0x6bb9bb5f
mov dword [ebp - 0x48], 0x69ec3a5f
sub dword [ebp - 0x48], 0x67ccdf3
mov dword [ebp - 0x44], 0x5ddab4f3
sub dword [ebp - 0x44], 0x5ddab4f3
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xf63b5210
add eax, 0xa057e38
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3918b
push 0
call eax
mov ecx, 0x4695
xor ebx, ebx
add ebx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x40]
mov edx, 0x2e6f4a90
sub edx, 0x20b3f599
add dword [ebp - 0x20], ecx
mov esi, dword [edi]
sub dword [ebp - 4], 0x9c798881
sub esi, edx
add dword [ebp - 0x30], edi
mov dword [ebx], esi
xor dword [ebp - 0x24], eax
add ebx, 0xc55b1005
add ebx, 0x3aa4efff
add edi, 0x88645ea8
add edi, 0x779ba15c
loop 0x404e7a
add eax, 0x7c8b3963
add eax, 0x8375d3c4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4179b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4179c3
pop dword [ebp - 0x48]
mov eax, 0x4179c3
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3f8f9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x4f36
xor edi, edi
add edi, eax
mov esi, 0xddd29d21
sub esi, 0xdd8f4921
add esi, dword [ebp - 0x48]
mov ebx, 0xd7f3f68b
add ebx, 0x1bf59a92
sub dword [ebp - 0x1c], ecx
mov edx, dword [esi]
add edx, ebx
add dword [ebp - 0x20], 0x1a624edf
mov dword [edi], edx
xor dword [ebp - 0x40], 0x133ace08
add edi, 0x3506d123
sub edi, 0x3506d11f
add esi, 0x9730366d
add esi, 0x68cfc997
loop 0x417a14
add eax, 0x12fab
mov ebx, eax
add eax, 0x620c4e84
add eax, 0x9df3b181
mov ecx, 0xe01f14d6
sub ecx, 0xdfdf14d6
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10009d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10009d5f
pop dword [ebp - 0x44]
mov eax, 0x7d1aad7e
sub eax, 0x6d1a101f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xf6fedf50
add dword [ebp - 0x54], 0x575365fb
mov dword [ebp - 0x50], 0x352a4d4
sub dword [ebp - 0x50], 0xd11f588f
mov dword [ebp - 0x4c], 0xc0581dd
sub dword [ebp - 0x4c], 0xbfb93daf
mov dword [ebp - 0x48], 0x585e8dd7
add dword [ebp - 0x48], 0xa7a17229
lea eax, [ebp - 0x54]
push eax
mov eax, 0xf2d886a1
sub eax, 0xe2d7b621
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3da70a7d
add dword [ebp - 0x54], 0x36cb5ed9
mov dword [ebp - 0x50], 0xb37ecc2f
add dword [ebp - 0x50], 0x8ded9546
mov dword [ebp - 0x4c], 0x20204b24
add dword [ebp - 0x4c], 0x434f2148
mov dword [ebp - 0x48], 0x9747b1c0
add dword [ebp - 0x48], 0x68b84e40
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xfffcc5aa
sub eax, 0xeffbf532
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3f3aa
push 0
call eax
mov ecx, 0xa78cac64
add ecx, 0x5873b783
xor ebx, ebx
add ebx, eax
mov edi, 0x589830cf
sub edi, 0x48967ccf
add edi, dword [ebp - 0x44]
mov edx, 0x3637ede4
xor dword [ebp - 0x24], esi
mov esi, dword [edi]
sub dword [ebp - 4], eax
sub esi, edx
mov dword [ebx], esi
add dword [ebp - 0x1c], ebx
add ebx, 4
add edi, 0xcd94e7c5
sub edi, 0xcd94e7c1
loop 0x10009e7d
add eax, 0x1826f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100109c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100109cf
pop dword [ebp - 0x20]
mov eax, 0x31b37ea
add eax, 0xce5d1e5
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x3c56c6a
sub dword [ebp - 0x30], 0xb573271f
mov dword [ebp - 0x2c], 0x9dcc8b74
add dword [ebp - 0x2c], 0x9466c0d1
mov dword [ebp - 0x28], 0xcc07ec11
add dword [ebp - 0x28], 0x8044581d
mov dword [ebp - 0x24], 0x3e6654da
sub dword [ebp - 0x24], 0x3e6654da
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x2f7df589
add dword [ebp - 0x30], 0x44f473cd
mov dword [ebp - 0x2c], 0x7e2c9e5d
add dword [ebp - 0x2c], 0xc33fc318
mov dword [ebp - 0x28], 0x2578f554
add dword [ebp - 0x28], 0x3df67718
mov dword [ebp - 0x24], 0xe5cce987
sub dword [ebp - 0x24], 0xe5cce987
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x72378288
add eax, 0x9dca0db0
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x356cb
push 0
call eax
mov ecx, 0x4350
xor edi, edi
add edi, eax
mov ebx, 0xc9a1e8b1
sub ebx, 0xb99fc0b1
add ebx, dword [ebp - 0x20]
mov esi, 0xaa3272e
add esi, 0x27434d0a
sub dword [ebp - 4], ecx
mov edx, dword [ebx]
add dword [ebp - 4], 0xc5039ffd
xor edx, esi
xor dword [ebp - 0x14], esi
mov dword [edi], edx
sub dword [ebp - 0x1c], edx
add edi, 4
add ebx, 0x725e88eb
add ebx, 0x8da17719
loop 0x10010ae8
add eax, 0x10013
mov ebx, eax
add eax, 5
mov ecx, 0xdfeac72a
add ecx, 0x301538d6
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx