joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6d24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4d6dbe.0
jmp dword [ecx*4 + 0x4d6d57]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4d6d89
sub dl, 8
je 0x4d6d98
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d69d0
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6a28
jmp case.0x4d6dbe.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4d6dbe.0
movzx ecx, byte [ecx + 0x4d6dc5]
jmp dword [ecx*4 + 0x4d6dd6]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6ad4
jmp case.0x4d6dbe.0
cmp dl, 3
jne 0x4d6e03
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6b28
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6ae4
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6b6c
jmp case.0x4d6dbe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4d6e2e
sub dl, 8
je 0x4d6e3a
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6b98
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6c04
jmp case.0x4d6dbe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4d6e59
sub dl, 8
je 0x4d6e65
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6cc0
jmp case.0x4d6dbe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d6ce8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4d6f09
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004d5edc
test eax, eax
je 0x4d6f09
mov eax, ebx
call fcn.004d6f14
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4d6ea2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d6f14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4d6f45
dec al
je 0x4d6f80
dec al
je 0x4d6fc5
dec al
je 0x4d702e
jmp 0x4d70b8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d70b8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d6f55
jmp 0x4d70b8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d70b8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d6f90
jmp 0x4d70b8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d70b8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d6ff4
xor ebp, ebp
jmp 0x4d7004
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d700d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d6fd5
jmp 0x4d70b8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d70b8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d7087
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d43f0
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d7042
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dae38
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4dae40
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
xor eax, eax
push ebp
push 0x4db04e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x22
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x418178]
call fcn.0041cfa0
mov dword [ebp - 0x10], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0xffff
lea eax, [ebp - 0x1c]
mov ecx, 0x4db064
mov edx, dword [ebp - 0xc]
call fcn.00404f44
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x418178]
call fcn.0041cfa0
mov esi, eax
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.004dad90
push 0
push 0
mov eax, esi
call fcn.0041cb0c
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, 1
call fcn.0040534c
lea eax, [ebp - 4]
call fcn.0040511c
mov edx, eax
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
sub al, 0x64
je 0x4daef6
dec al
je 0x4dafef
dec al
je 0x4daf43
jmp 0x4daff1
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
movzx edx, byte [ebp - 0x11]
dec edx
lea eax, [ebp - 8]
call fcn.0040534c
lea eax, [ebp - 8]
call fcn.0040511c
mov edx, eax
movzx ecx, byte [ebp - 0x11]
dec ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
call fcn.0041caec
add eax, 1
adc edx, 0
push edx
push eax
mov eax, esi
call fcn.0041cb0c
jmp 0x4daff1
lea edx, [ebp - 0x11]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
movzx edx, byte [ebp - 0x11]
dec edx
lea eax, [ebp - 8]
call fcn.0040534c
lea eax, [ebp - 8]
call fcn.0040511c
mov edx, eax
movzx ecx, byte [ebp - 0x11]
dec ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
call fcn.0041caec
add eax, 1
adc edx, 0
push edx
push eax
mov eax, esi
call fcn.0041cb0c
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00409f9c
mov ecx, dword [ebp - 0x24]
mov edx, dword [0x4f4a18]
mov edx, dword [edx]
lea eax, [ebp - 0x20]
call fcn.00404f44
mov eax, dword [ebp - 0x20]
call fcn.004dfb10
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x418178]
call fcn.0041cfa0
mov edi, eax
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
mov edx, esi
mov eax, edi
call fcn.0041cd88
mov eax, edi
call fcn.00403d28
jmp 0x4daff1
mov bl, 1
test bl, bl
je 0x4daeb8
mov eax, esi
call fcn.00403d28
lea eax, [ebp - 0x28]
mov ecx, 0x4db064
mov edx, dword [ebp - 0xc]
call fcn.00404f44
mov eax, dword [ebp - 0x28]
call fcn.004050bc
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 0x10]
call fcn.00403d28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db055
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404c50
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c50
ret
Function at 0x4db0bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4db13f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, edi
call fcn.0040910c
cmp byte [edi], 0x2e
je 0x4db129
cmp byte [edi + 1], 0x3a
je 0x4db129
mov byte [ebp - 5], 0
mov si, 0xfffc
mov ebx, 0x4f46dc
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
call fcn.00405054
jne 0x4db10e
mov byte [ebp - 5], 1
jmp 0x4db116
sub ebx, 4
inc si
jne 0x4db0fc
cmp byte [ebp - 5], 0
jne 0x4db129
mov eax, edi
call fcn.004050bc
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db146
lea eax, [ebp - 4]
call fcn.00404c2c
ret
Function at 0x4db864
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, dword [0x4f482c]
mov eax, dword [0x4f4b08]
mov eax, dword [eax]
mov eax, dword [eax + 0xd4]
call fcn.004df5f4
xor eax, eax
call fcn.004dff7c
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
call fcn.004dff4c
mov byte [esp], 1
mov dl, 1
mov eax, dword [0x4e3304]
call fcn.004e42b0
mov ebx, eax
mov eax, 0x4dba1c
call fcn.004050bc
push eax
call sub.kernel32.dll_DeleteFileA
mov edx, 0x4dba1c
mov eax, ebx
call fcn.004e3358
mov eax, ebx
call fcn.004e3724
mov eax, 8
call fcn.00402f24
mov dword [esp + 8], eax
lea edx, [esp + 8]
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
call fcn.004bd4f4
mov dl, 1
mov eax, dword [0x41827c]
call fcn.00403cf8
mov dword [esp + 4], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
test eax, eax
jle 0x4db964
mov esi, eax
dec esi
test esi, esi
jb 0x4db964
inc esi
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
mov edx, dword [esp + 8]
call fcn.004bd504
test eax, eax
je 0x4db961
mov eax, dword [esp + 8]
mov ebp, dword [eax + 4]
cmp byte [ebp + 0x21], 0
jne 0x4db961
lea ecx, [esp + 4]
mov edx, ebp
mov eax, dword [edi]
call fcn.004e4204
test al, al
jne 0x4db961
mov eax, dword [esp + 8]
mov eax, dword [eax + 4]
mov edx, dword [eax + 8]
mov ecx, dword [esp + 4]
mov eax, ebx
call fcn.004e3e18
mov eax, dword [esp + 4]
call fcn.0041d28c
mov eax, dword [0x4f4b30]
mov eax, dword [eax]
inc eax
call fcn.004dff7c
dec esi
jne 0x4db906
mov eax, dword [esp + 4]
call fcn.00403d28
mov eax, ebx
call fcn.004e39f4
mov eax, ebx
call fcn.00403d28
mov edx, 8
mov eax, dword [esp + 8]
call fcn.00402f40
mov eax, edi
call fcn.0040f7b4
mov eax, dword [0x4f4b08]
mov eax, dword [eax]
mov ebx, dword [eax + 0x28]
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
call fcn.004050bc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [0x4f4b08]
mov eax, dword [eax]
mov ebx, dword [eax + 0x28]
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
call fcn.004050bc
push eax
mov eax, 0x4dba1c
call fcn.004050bc
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov dl, 1
mov eax, dword [0x4e3304]
call fcn.004e42b0
mov dword [edi], eax
mov eax, dword [0x4f4b08]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
mov eax, dword [edi]
call fcn.004e3358
mov eax, dword [edi]
call fcn.004e3724
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dfca8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050ac
xor eax, eax
push ebp
push 0x4dfd57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403624
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403624
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004050bc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4dfd2f
test bl, bl
je 0x4dfd2f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfd5e
lea eax, [ebp - 4]
call fcn.00404c2c
ret
Function at 0x189a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0189a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x189a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x189a06a
add dl, dl
jne 0x189a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x189a0dc
xor eax, eax
add dl, dl
jne 0x189a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x189a17d
add dl, dl
jne 0x189a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x189a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x189a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x189a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x189a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x189a075
mov eax, 1
add dl, dl
jne 0x189a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x189a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x189a0e1
sub eax, ebx
mov ebx, 1
jne 0x189a128
mov ecx, 1
add dl, dl
jne 0x189a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x189a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x189a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x189a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x189a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x189a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x189a136
cmp eax, 0x7d00
jae 0x189a16d
cmp eax, 0x500
jb 0x189a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x189a075
cmp eax, 0x7f
ja 0x189a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x189a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x189a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x189a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40288e
pop dword [ebp - 0x30]
mov eax, 0x7975a6e6
add eax, 0x86ca81a8
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xec6501ed
add dword [ebp - 0x40], 0x61ed435e
mov dword [ebp - 0x3c], 0x65c0b81a
sub dword [ebp - 0x3c], 0x338d6bd5
mov dword [ebp - 0x38], 0xcc17c198
sub dword [ebp - 0x38], 0x7fcb7d6a
mov dword [ebp - 0x34], 0x7ac3a12e
sub dword [ebp - 0x34], 0x7ac3a12e
lea eax, [ebp - 0x40]
push eax
mov eax, 0xd07eb8d2
add eax, 0x2fc1b792
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xc196d162
add dword [ebp - 0x40], 0xb2db97f4
mov dword [ebp - 0x3c], 0x6fb8a35a
sub dword [ebp - 0x3c], 0x2e4c41e5
mov dword [ebp - 0x38], 0xb2303035
sub dword [ebp - 0x38], 0x4ec0c3c9
mov dword [ebp - 0x34], 0x2416dc5e
sub dword [ebp - 0x34], 0x2416dc5e
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x708f8bea
sub eax, 0x704f1b42
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39086
push 0
call eax
mov ecx, 0x51bf
xor edx, edx
add edx, eax
mov esi, str.7njO
add esi, dword [ebp - 0x30]
mov ebx, 0x86e576ce
mov edi, dword [esi]
sub dword [ebp - 0x28], 0x3a1a3d57
xor edi, ebx
xor dword [ebp - 0x14], ebx
mov dword [edx], edi
add dword [ebp - 4], 0x6688f47f
add edx, 0xce8ffb8a
add edx, 0x3170047a
add esi, 4
loop 0x4029a0
add eax, 0xb815f7c6
sub eax, 0xb814bdf7
xor ebx, ebx
add ebx, eax
add eax, 0x181d068f
add eax, 0xe7e2f976
mov ecx, 0x2617860c
sub ecx, 0x25d7860c
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x101417c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101813cc
call fcn.1006fb85
mov eax, dword [0x1017e908]
mov dword [ebp - 8], eax
jmp 0x101417f7
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10141810
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x1014180e
mov eax, dword [ebp - 8]
jmp 0x10141893
jmp 0x101417ef
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1006f2f2
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10141890
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
cmp eax, 0xfe0
jbe 0x10141853
mov eax, dword [ebp - 8]
mov ecx, dword [0x1017e908]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [0x1017e908], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret
Function at 0x10143360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10177884]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10181554
call fcn.1006fb85
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1017e8f0]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x101433cd
mov eax, dword [ebp - 0x30]
sub eax, 5
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [ebp - 0x24], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1006f2f2
test eax, eax
jne 0x101433f8
mov eax, 0xa
jmp 0x101434fa
cmp dword [ebp + 0xc], 0
je 0x10143445
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x30]
add eax, 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [eax + 1], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10143443
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x48]
mov byte [eax + 1], 0xf9
jmp 0x10143481
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1014346c
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.1006fa36
add esp, 0xc
jmp 0x10143481
push 5
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.1006fa36
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1006f2f2
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1006f2f2
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1006f2f2
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1014352c]
call fcn.1006efb4
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006eb4f
add esp, 0x10c
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret