joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4778ab
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.004742d5
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x47792d
mov dword [ebp - 0x10], fcn.00473cc8
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x47792d
mov dword [ebp - 0x18], fcn.004776f1
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x47792d
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0xc6ef3720
mov dword [ebp - 0x30], 0x20
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x477992
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x28]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x47792d
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47da20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
push ebx
push edi
push 0x4b2a38
call fcn.0047e650
add esp, 0xc
xor esi, esi
test ebx, ebx
jle 0x47da79
cmp byte [0x4b2b20], 0x20
jne 0x47da4e
call fcn.0047d980
mov eax, dword [0x4b2b20]
and eax, 0xff
mov cl, byte [eax + 0x4b2930]
mov al, byte [esi + edi]
xor al, cl
mov byte [esi + edi], al
mov dl, byte [0x4b2b20]
inc dl
inc esi
cmp esi, ebx
mov byte [0x4b2b20], dl
jl 0x47da40
pop edi
pop esi
pop ebx
ret

Function at 0x47db50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x10]
test ebx, ebx
jle 0x47db9a
cmp byte [0x4b2b20], 0x20
jne 0x47db6f
call fcn.0047d980
mov eax, dword [0x4b2b20]
and eax, 0xff
mov cl, byte [eax + 0x4b2930]
mov al, byte [esi + edi]
xor al, cl
mov byte [esi + edi], al
mov dl, byte [0x4b2b20]
inc dl
inc esi
cmp esi, ebx
mov byte [0x4b2b20], dl
jl 0x47db61
push ebx
push edi
push 0x4b2a38
call fcn.0047e650
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x47e370
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esi]
xor edx, edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
sub edx, 0x61c88647
shr esi, 5
add esi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
add eax, esi
mov esi, eax
shr esi, 5
add esi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x47e3a6
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x47f440
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x114
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x47f4ba
lea eax, [esp + 0x24]
push 0x15
push eax
push 0x451f74
mov dword [esp + 0x20], 0xc8
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x47f4ba
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
cmp ecx, eax
je 0x47f4cc
mov eax, ecx
inc eax
mov dword [esp + 0x10], eax
inc edi
test esi, esi
je 0x47f465
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov edx, dword [esp + 0x130]
mov ecx, dword [0x451f6c]
mov eax, edx
lea edi, [esp + 0x24]
mov dword [eax], ecx
mov cl, byte [0x451f70]
mov byte [eax + 4], cl
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x48f0a0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.004afd90
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x48f0ef
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x48f0ef
mov edx, dword [sym.imp.MSVCRT.dll__iob]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
add edx, 0x40
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vfprintf]
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0xff
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x48f1f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x48f1ae
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x48f1ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x48f1ae
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x48f1ae
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.004afd90
lea ecx, [ebp - 4]
mov edi, esp
push ecx
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x48f1ae
mov edx, dword [ebp - 4]
push 0x45e6c0
push edi
lea eax, [edx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x48f1f3
push 0x45e6e8
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea ecx, [ebp - 4]
push 0
push ecx
push 0
push 1
push 0
push 0
mov esi, eax
push 0
lea eax, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea edx, [ebp - 0x104]
push 0x45e6d8
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af830
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.004af8b3
jae 0x4af83e
xor ecx, ecx
call fcn.004af8b3
jae 0x4af86d
xor eax, eax
call fcn.004af8b3
jae 0x4af87d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.004af8b3
adc al, al
jae 0x4af85f
jne 0x4af8a9
stosb byte es:[edi], al
jmp 0x4af841
call fcn.004af8bf
sub ecx, ebx
jne 0x4af886
call fcn.004af8bd
jmp 0x4af8a5
lodsb al, byte [esi]
shr eax, 1
je 0x4af8cf
adc ecx, ecx
jmp 0x4af8a2
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.004af8bd
cmp eax, 0x7d00
jae 0x4af8a2
cmp ah, 5
jae 0x4af8a3
cmp eax, 0x7f
ja 0x4af8a4
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4af841
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x4afc70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x45d3bc
sub eax, eax
test esi, esi
je 0x4afd50
sub eax, 1
test ecx, ecx
je 0x4afd4e
test esi, 3
je 0x4afcae
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4afc93
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x4afd35
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4afcbc
mov ecx, edx
test ecx, ecx
je 0x4afd4e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4afd3b
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4afdd2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472da0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4b4b5c], 0xffffffff
or dword [0x4b4b60], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4b4b00]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4b4afc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4b4b64], eax
call fcn.004b0231
cmp dword [0x45d7c0], 0
jne 0x4afe55
push 0x4b022e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.004b021c
push 0x401214
push 0x401210
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4b4af8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4b4af4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x40120c
push 0x401208
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004731f8
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x1000a540
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000a704
pushal
mov esi, 0x10009015
lea edi, [esi - 0x8015]
push edi
jmp 0x1000a56a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1000a571
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1000a560
mov eax, 1
add ebx, ebx
jne 0x1000a583
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1000a578
jne 0x1000a594
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000a578
xor ecx, ecx
sub eax, 3
jb 0x1000a5a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000a61a
mov ebp, eax
add ebx, ebx
jne 0x1000a5b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1000a5c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1000a5e4
inc ecx
add ebx, ebx
jne 0x1000a5d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1000a5c5
jne 0x1000a5e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000a5c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1000a604
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1000a5f5
jmp 0x1000a566
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1000a604
add edi, ecx
jmp 0x1000a566
pop esi
mov edi, esi
mov ecx, 0xee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1000a622
cmp byte [edi], 0
jne 0x1000a622
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1000a627
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x1000a696
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1000a654
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa07c]
or eax, eax
je 0x1000a690
mov dword [ebx], eax
add ebx, 4
jmp 0x1000a671
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1000a6c7
cmp al, 0xef
ja 0x1000a6ba
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1000a69c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1000a6a9
mov ebp, dword [esi + 0xa080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1000a6fb
sub esp, 0xffffff80
jmp 0x10001060
Function at 0x1006d7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1006d7af
pop dword [ebp - 0x34]
mov eax, 0x7642fd62
add eax, 0x99c3da4d
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3526df16
sub dword [ebp - 0x44], 0xe6d499cb
mov dword [ebp - 0x40], 0x4581a301
sub dword [ebp - 0x40], 0x134e56bc
mov dword [ebp - 0x3c], 0xdd6f4573
sub dword [ebp - 0x3c], 0x91230145
mov dword [ebp - 0x38], 0xf0c53d60
add dword [ebp - 0x38], 0xf3ac2a0
lea eax, [ebp - 0x44]
push eax
mov eax, 0xa6648633
add eax, 0x69c469f5
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x4ed66178
add dword [ebp - 0x44], 0x259c07de
mov dword [ebp - 0x40], 0xcb028b26
add dword [ebp - 0x40], 0x7669d64f
mov dword [ebp - 0x3c], 0x3c9d3e64
sub dword [ebp - 0x3c], 0xd92dd1f8
mov dword [ebp - 0x38], 0xe4ad7e50
add dword [ebp - 0x38], 0x1b5281b0
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x6785a
push 0
call eax
mov ecx, 0xfe296e1b
sub ecx, 0xfe292bcb
mov esi, eax
mov edi, 0x2250cb17
sub edi, 0x121f1f17
add edi, dword [ebp - 0x34]
mov edx, 0x66f74e34
xor dword [ebp - 0x20], 0xf2198757
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0x8d72611d
sub ebx, edx
xor dword [ebp - 0x18], 0x4a54fd2b
mov dword [esi], ebx
xor dword [ebp - 0x10], 0x270ae9a9
add esi, 4
add edi, 0xfe2c6c5b
sub edi, 0xfe2c6c57
loop 0x1006d8c6
add eax, 0x819a70fc
add eax, 0x7e668b17
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1970b4b1
sub ecx, 0x970b4b1
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10106b50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025faa0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102f8be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x10106b99
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102f254c], 0
jne 0x10106bb0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x10106bfd
mov eax, dword [esi]
test eax, eax
je 0x10106b82
cmp dword [esi + 4], 0
je 0x10106b82
push eax
call fcn.1006d7a0
add esp, 4
push dword [esi + 4]
call fcn.1006d7a0
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x10106bee
push eax
call fcn.1006d7a0
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10106c35
push eax
call fcn.1006d7a0
jmp 0x10106c32
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.1006d7a0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.1006d7a0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.1006d7a0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.1006d7a0
add esp, 4
push 8
call fcn.1006d7a0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10106c70
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1006d7a0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101a1930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102615ee
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102f8be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.101a3000
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.101a2fe0
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1021a3d0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x1021a3e1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1025d420
movss xmm5, dword [0x102d91f4]
movss xmm4, dword [0x102d91fc]
movss xmm6, dword [0x102d91f0]
movss xmm7, dword [0x102d91e8]
movss xmm3, dword [0x102926c8]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x102e4250]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x10306650], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x102d91f8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102d91e0]
add eax, edx
mov dword [esi*4 + 0x10306e50], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x102d91ec]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102d91e4]
add eax, ecx
mov dword [esi*4 + 0x10306a50], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10307250], eax
mulss xmm0, dword [0x102d9204]
mov dword [esi*4 + 0x10307a50], edx
mov dword [esi*4 + 0x10307650], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10307e50], eax
mulss xmm0, dword [0x102d9208]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10308250], eax
mulss xmm0, dword [0x102d920c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1006d7a0
mov dword [esi*4 + 0x10308650], eax
mulss xmm2, dword [0x102d9200]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.1006d7a0
mov dword [esi*4 + 0x10308a50], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1025d450
pop esi
ret
Function at 0x4010e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor eax, eax
push edi
mov word [ebp - 0xc], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push str.NtDeviceIoControlFile
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edi, dword [sym.imp.ntoskrnl.exe_DbgPrint]
push str.6.1_n
call edi
add esp, 4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov esi, eax
test esi, esi
je 0x4011b0
push str.6.2_n
call edi
mov ecx, 0x401200
mov dword [0x4705e4], esi
sub ecx, esi
mov byte [0x40a078], 0xe9
sub ecx, 5
add esp, 4
mov dword [0x40a079], ecx
mov eax, dword [esi]
mov dword [0x4705e8], eax
movzx eax, byte [esi + 4]
mov byte [0x4705ec], al
push eax
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
pop eax
cli
mov eax, dword [ebp - 4]
mov dword [0x4705e0], eax
push str.6.3_n
call edi
mov eax, dword [0x40a078]
add esp, 4
mov dword [esi], eax
movzx eax, byte [0x40a07c]
mov byte [esi + 4], al
lea eax, [esi + 5]
mov dword [0x40a081], eax
sti
push eax
mov eax, dword [0x4705e0]
mov cr0, eax
pop eax
push str.6.4_n
call edi
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401ca0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor eax, eax
xor bl, bl
push edi
mov word [ebp - 0x10], ax
xor esi, esi
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str.IoIsOperationSynchronous
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [ebp - 8], eax
test eax, eax
je 0x401d48
lea ecx, [ecx]
lea ecx, [esi + eax]
lea edx, [ebp - 4]
call fcn.00406300
mov edx, dword [ebp - 4]
mov edi, eax
mov al, byte [edx]
cmp al, 0xc2
jne 0x401d02
cmp byte [edx + 1], 4
jne 0x401d02
cmp byte [edx + 2], 0
je 0x401d31
cmp al, 0xe9
jne 0x401d20
mov al, byte [edx + 5]
cmp al, 0xcc
je 0x401d11
cmp al, 0x90
jne 0x401d20
push ecx
push 2
push ecx
call fcn.00404b30
mov bl, al
test bl, bl
jne 0x401d48
add esi, edi
cmp esi, 0x1000
ja 0x401d2f
mov eax, dword [ebp - 8]
jmp 0x401ce0
xor edx, edx
test bl, bl
jne 0x401d48
test edx, edx
je 0x401d48
sub esp, 0xc
call fcn.00404c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret