joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484db0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
push 0
push 0x30d40
lea ecx, [ebp - 0x14]
call fcn.0043a740
mov eax, dword [ebp + 0x10]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
inc eax
mov dword [ebp + 0x10], eax
nop word [eax + eax]
push dword [0x4cb9cc]
mov esi, dword [ebp - 0x10]
push dword [0x4cb9c8]
mov edi, dword [ebp - 0x14]
push esi
push edi
call fcn.00436fa0
push 0
push 0xf4240
push esi
push edi
mov dword [ebp - 0x34], eax
call fcn.00436fa0
imul eax, eax, 0xf4240
lea ecx, [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 0x30], edi
call fcn.0043a730
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x484eae
call ebx
cmp eax, 0x2714
jne 0x484eae
lea ecx, [ebp - 0x24]
call fcn.0043a730
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
sbb eax, dword [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0043a740
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jg 0x484e9a
jl 0x484e8c
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jae 0x484e9a
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00441f10
jmp 0x484ea6
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.0043a740
lea ecx, [ebp - 0x24]
call fcn.00437810
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00437810
test esi, esi
jns 0x484ece
call ebx
cmp eax, 0x2714
je 0x484df0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x488a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b9370
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [esi + 8], ecx
test ecx, ecx
je 0x488ac5
mov eax, dword [esi + 0x10]
pop esi
test eax, eax
je 0x488ab5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x488af5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.cannot_create_thread
lea ecx, [ebp - 0x24]
call fcn.0040c140
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x68]
call fcn.00438730
push 0x4f9ef8
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.cannot_set_thread_priority
lea ecx, [ebp - 0x3c]
call fcn.0040c140
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x94]
call fcn.00438730
push 0x4f9ef8
lea eax, [ebp - 0x94]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x48a880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bdefd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
cmp dword [ebp + 0x14], 0
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
je 0x48a8cc
lea ecx, [edi + 0x50]
mov dword [edi], 0x4e887c
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 8]
mov ecx, esi
mov dword [ebp + 0x14], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.Poco::MemoryIOS.0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x40], ecx
mov dword [esi + 0x38], edx
mov dword [esi], vtable.Poco::BasicMemoryStreamBuf_char__struct_std::char_traits_char__.0
mov dword [eax], edx
mov eax, dword [esi + 0x1c]
mov dword [eax], edx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x40]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48b680
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
shr edi, 2
test edi, edi
je 0x48b6ba
push ebx
mov ebx, dword [esp + 0x10]
mov edx, dword [ebx + esi*4]
rol edx, 0x10
mov ecx, edx
mov eax, edx
shr ecx, 8
shl eax, 8
xor ecx, eax
shl edx, 8
and ecx, 0xff00ff
xor ecx, edx
mov dword [ebx + esi*4], ecx
inc esi
cmp esi, edi
jl 0x48b694
pop ebx
pop edi
pop esi
ret

Function at 0x48b7c0
Capabilities:
Hash data using sha1

Disassembly:
push 0x40
lea eax, [ecx + 0x20]
mov dword [ecx + 4], 0x67452301
push 0
push eax
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x60], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
ret
Function at 0x48d4b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be0e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x38], 0xffffffff
mov byte [ebx + 0x3c], 0
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [ebx + 0x10]
mov dword [eax], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edi, 0x50dbc0
mov esi, dword [ebp + 0xc]
mov dword [ebx + 0x40], esi
and esi, 1
mov dword [ebx], vtable.Poco::Base64DecoderBuf.0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov eax, dword [ecx]
mov dword [ebp - 4], 0
mov dword [ebp + 0xc], 0x50ddc8
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, 0x50ddc8
mov dword [ebx + 0x50], eax
mov eax, 0x50dcc8
cmove eax, edi
mov dword [ebx + 0x54], eax
call fcn.00451eb0
test esi, esi
je 0x48d5b3
cmp byte [0x50dcc1], 0
jne 0x48d5f1
or eax, 0xffffffff
mov ecx, 0x40
mov edi, 0x50dcc8
rep stosd dword es:[edi], eax
xor ecx, ecx
nop word [eax + eax]
movzx eax, byte [ecx + 0x4e8aa0]
mov byte [eax + 0x50dcc8], cl
inc ecx
cmp ecx, 0x40
jb 0x48d590
mov byte [0x50dd05], 0
mov byte [0x50dcc1], 1
jmp 0x48d5f1
cmp byte [0x50dcc0], 0
jne 0x48d5f1
or eax, 0xffffffff
mov ecx, 0x40
rep stosd dword es:[edi], eax
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 0x50dbc0], al
inc eax
cmp eax, 0x40
jb 0x48d5d0
mov byte [0x50dbfd], 0
mov byte [0x50dcc0], 1
lea ecx, [ebp + 0xc]
call fcn.00451430
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x48f260
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
pop esi
ret
Function at 0x48fb90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b96b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x1000
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedBidirectionalStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0
call fcn.004369a1
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
call fcn.004369a1
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [esi + 0x44], eax
add ecx, 4
mov eax, dword [esi + 0xc]
mov dword [esi + 0x48], 3
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::FileStreamBuf.0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x490111
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x490171
mov ecx, dword [esi + 0x48]
test cl, 1
je 0x490171
test cl, 2
je 0x490133
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
mov eax, dword [esi + 0x68]
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x490161
lea eax, [esi + 0x50]
push eax
call fcn.00452380
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
pop ecx
ret 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc
Function at 0x490453
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x4904fc
mov ecx, dword [esi + 0x48]
test cl, 2
je 0x4904fc
test cl, 8
je 0x4904bc
push 2
lea ecx, [esp + 0x10]
xorps xmm0, xmm0
push ecx
push 0
push eax
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x4904af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4904ab
lea eax, [esi + 0x50]
push eax
call fcn.00452380
add esp, 4
mov eax, dword [esp + 8]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x68]
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4904ea
lea eax, [esi + 0x50]
push eax
call fcn.00452380
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
add esp, 0xc
ret 0xc
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc

Function at 0x4913d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b96b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.004369a1
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::RandomBuf.0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x710c66
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x7109ec
mov esi, 0x461f13b6
inc esi
call fcn.00710caf
inc esi
push esi
mov ebx, dword [esp]
add esp, 4
xor dword [edx], ecx
add ebx, 0xd979d760
add ebx, ebx
and esi, ebx
inc edx
add esi, 0x971e9ed9
add esi, 1
cmp edx, eax
jne fcn.00710c66
inc esi
push 0xdf8973be
pop ebx
sub esi, ebx
ret
Function at 0x10009d6d
Capabilities:
Query environment variable

Disassembly:
push 0x218
mov eax, 0x1000cfa9
call fcn.1000c02f
xor esi, esi
cmp dword [0x1000f134], esi
je 0x10009d9a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10009e6f
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0x200
mov dword [ebp - 4], esi
mov ebx, dword [ebp + 0x10]
add ebx, ebx
push ebx
lea ecx, [ebp - 0x224]
call fcn.10009642
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x10009df0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], esi
je 0x10009dec
push dword [ebp - 0x224]
call fcn.10004f2a
pop ecx
mov dword [ebp - 0x224], esi
xor eax, eax
jmp 0x10009e6f
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.10009504
test eax, eax
jge 0x10009e09
xor edi, edi
jmp 0x10009e46
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [ebp + 0x10], esi
mov edi, eax
je 0x10009e46
cmp edi, ebx
ja 0x10009e46
cmp edi, esi
je 0x10009e3c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 0x14]
push esi
push esi
call fcn.1000937e
mov edi, eax
dec edi
jmp 0x10009e46
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x10009e46
mov word [eax], si
push dword [ebp - 0x10]
call fcn.10004f2a
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], esi
je 0x10009e6d
push dword [ebp - 0x224]
call fcn.10004f2a
pop ecx
mov dword [ebp - 0x224], esi
mov eax, edi
call fcn.1000c107
ret 0xc
Function at 0x1000c004
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1000dec0
call fcn.1000c190
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1000f98c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1000bda7
cmp eax, esi
jne 0x1000bd9a
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1000bdaa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000bd81
xor esi, esi
inc esi
mov eax, dword [0x1000f988]
cmp eax, esi
jne 0x1000bdbd
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x1000bdec
mov eax, dword [0x1000f988]
test eax, eax
jne 0x1000bde6
mov dword [0x1000f988], esi
push 0x100012ac
push 0x100012a0
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x1000bdec
jmp 0x1000bf14
mov dword [0x1000f644], esi
mov eax, dword [0x1000f988]
cmp eax, esi
jne 0x1000be10
push 0x1000129c
push 0x1000128c
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x1000f988], 2
test ebx, ebx
jne 0x1000be1c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1000f998], 0
je 0x1000be40
push 0x1000f998
call fcn.1000c500
pop ecx
test eax, eax
je 0x1000be40
push 0
push 2
push 0
call dword [0x1000f998]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1000be9c
test al, al
je 0x1000be5a
cmp dword [ebp - 0x1c], 0
jne 0x1000be9c
mov al, byte [esi]
test al, al
je 0x1000be6a
cmp al, 0x20
ja 0x1000be6a
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1000be5a
test byte [ebp - 0x3c], 1
je 0x1000be76
movzx eax, word [ebp - 0x38]
jmp 0x1000be79
push 0xa
pop eax
push eax
push esi
push 0
push 0x10000000
call main
mov dword [0x1000f640], eax
cmp dword [0x1000f634], 0
jne 0x1000bef0
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x1000beab
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x1000bebe
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1000be47
cmp dword [0x1000f644], 0
jne 0x1000beff
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1000f640]
jmp 0x1000bf20
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.1000c1d5
ret
call fcn.1017e000
jmp 0x1000bd47

Function at 0x1000c020
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f15c]
jne 0x1000c02a
repz ret
jmp fcn.1000c685
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x729c02b9
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42e1d0
nop
mov ecx, 0x76772554
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001390
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x100013c3
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x100013ab
neg eax
shr eax, 0x1f
pop edi
pop esi
ret

Function at 0x1000f5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x1000f69b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x1000f636
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.1000f200
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1000f604
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x1000f754
call fcn.1000f648
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x1000f6f3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.1000f200
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1000f6ac
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x1000f754
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.1000f200
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1000f74f
jmp 0x1000f754
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret