joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1948
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4a1979
dec al
je 0x4a19b5
dec al
je 0x4a19f9
dec al
je 0x4a1a64
jmp 0x4a1aee
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a1aee
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a1989
jmp 0x4a1aee
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a1aee
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a19c5
jmp 0x4a1aee
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a1aee
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a1a27
xor ebp, ebp
jmp 0x4a1a38
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a1a41
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a1a09
jmp 0x4a1aee
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a1aee
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a1abc
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0049f400
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a1a78
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x739b58
Capabilities:
Encode data using xor

Disassembly:
call 0x23027e52
pop ds
dec esp
xor ah, al
movsb byte es:[edi], byte [esi]
dec edi
shr bl, 0x6f
sbb byte [eax + ecx*2 - 0x7af0f4b1], bl
mov ch, 0x7f
adc al, 0x98
mov dh, byte [ebx + ecx*4 + 0x508c588d]
mov cl, 0xc
dec esp
push edi
push ebx
loop 0x739af7
outsb dx, byte [esi]
loopne 0x739b40
retf
into
mov cs, word [esi]
bound edi, qword [ebp + 0x50]
call 0x692a7ddf
xor dh, byte [esi]
insb byte es:[edi], dx
xlatb
dec ebx
push es
push 0xfeb6a2e
inc edx
pop es
fmul dword [esi + ebx*2]
or eax, 0xf551421a
add esi, ecx
jnp 0x739af0
test dword [ebp - 0x3b33412e], eax
xchg ebx, eax
stc
ret 0xd233
Function at 0x7c952a
Capabilities:
Get number of processors

Disassembly:
and eax, 0x93f86a95
add byte [edi + 0x676f4c00], 0x67
imul ecx, dword fs:[edi + ebp*8], 0x6f121a02
insd dword es:[edi], dx
js 0x7c95ba
and byte [0x32545337], ch
out 0x77, eax
pop ecx
sub dword gs:[esp + 0x7375e060], eax
cmp dword [ecx], esp
dec eax
mov eax, dword [ecx - 0x6c12b8fd]
mov eax, 0xd4486a0a
popfd
cmp esp, dword [ebx + 0x72]
sub eax, 0x415c9058
test eax, 0x481ccea7
push esp
das
or esi, dword [edx]
add byte [ebx + ebp*2], ch
xor al, 0x35
add al, 0x21
inc esi
sbb eax, 0x1974ad4e
push es
or byte [0xc0028dd], al
and ebx, dword [eax + 0xb129b02]
adc byte [edx + 0x57], dh
daa
scasd eax, dword es:[edi]
sub ah, byte [edx]
sbb dword [esi + 0x49], eax
int 0x84
inc edi
push esp
or al, 0x17
pcmpgtd mm6, qword [ebx + 0x6fb8e64a]
xchg ebx, eax
inc byte [ecx]
xchg byte [eax + edx*4 + 0x1e], dl
pop ecx
sahf
dec esi
les ecx, [esi]
ror dword [esi], 0x30
dec edx
or byte [0x6210c38b], bl
aas
bound edi, qword [edi]
popal
popal
add byte [ecx - 0x6efdac80], ah
jae 0x7c95c6
jne 0x7c95d9
inc eax
mov al, byte [0x18b10187]
or bl, al
inc ecx
sbb eax, 0x288f0061
loopne 0x7c95f0
inc eax
and dword [eax], eax
add byte [ebx], al
xor edx, dword [eax + 0x40]
ret
and ecx, dword [edx]
sub al, byte [esi]
mov ecx, 0xe3337f72
jae 0x7c963f
mov ebx, 0x5b006765
xor ebx, dword [edi - 0x6f]
add dh, bh
mov ebp, 0x5f0062
test dword [ebx + 5], esi
dec ecx
inc edi
lodsb al, byte [esi]
mov edx, 0xb29722
test dword [0x5ea3c10e], eax
add dl, al
push ds
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
jbe 0x7c9627
or edi, 0xffffffa6
je 0x7c9696
outsb dx, byte [esi]
int3
cmp byte [ecx], 0xfa
add byte [ebx], ah
dec esp
sub byte [edx - 0x65], al
sar dl, 0
xor ch, 0
loop 0x7c967f
das
add ch, cl
bound edx, qword [ebx + 0x2c]
sub esp, dword [edi + edi]
and byte [eax], al
or byte [ecx], al
mov eax, 0x92e32c1
inc esi
invalid
invalid
inc ebp
imul esp, dword [edx + 0x51], 0x48445a66
jb 0x7c96f9
popal
invalid
imul edx, dword [ecx + 0x47], 0x46
imul edi, dword [edx + 0x42], 0x442b4f38
aaa
inc edi
push eax
bound eax, qword [edi + 0x74]
jp 0x7c977d
xor eax, dword [edx + 0x48]
pop ecx
cmp edi, edi
invalid
jne 0x7c97d2
dec esp
je 0x7c97f9
cmp byte [eax + 0x52], bh
jo 0x7c97e9
test ebp, ecx
push ss
or byte [ecx + edi], cl
pop edx
invalid
imul eax, dword [ecx + 0x65], 0x55326877
fucompi st(7)
push edi
fsubr st(4)
dec esi
cmp dword [edx + 0x52], ebx
mov ch, 0xf2
invalid
dec ebx
inc ecx
inc edi
xor eax, 0x68315a56
push edi
inc ebp
jo 0x7c982c
ja 0x7c983b
push 0x39437447
inc esi
dec esp
je 0x7c983e
cmp dword [esi + 0x36], eax
dec esp
inc edx
je 0x7c9855
imul eax, dword [edx], 0x59
mov al, 1
cmp dword [edx - 1], ebx
invalid
cmp dword [ebx + 0x74], eax
push 0x7a774164
cmp ecx, ecx
jle 0x7c9879
Function at 0x861cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x5e300d
lea edi, [esi - 0x1e200d]
push edi
or ebp, 0xffffffff
jmp 0x861ce2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x861ce9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x861cd8
mov eax, 1
add ebx, ebx
jne 0x861cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x861cf0
jne 0x861d0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x861cf0
xor ecx, ecx
sub eax, 3
jb 0x861d20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x861d92
mov ebp, eax
add ebx, ebx
jne 0x861d2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x861d38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x861d5c
inc ecx
add ebx, ebx
jne 0x861d48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x861d3d
jne 0x861d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x861d3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x861d7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x861d6d
jmp 0x861cde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x861d7c
add edi, ecx
jmp 0x861cde
pop esi
mov edi, esi
mov ecx, 0x16a2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x861d9a
cmp byte [edi], 0x11
jne 0x861d9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x861d9f
lea edi, [esi + 0x45d000]
mov eax, dword [edi]
or eax, eax
je 0x861e0e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x46915c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4691b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x861dcc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4691bc]
or eax, eax
je 0x861e08
mov dword [ebx], eax
add ebx, 4
jmp 0x861de9
call dword [esi + 0x4691b8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x861e3f
cmp al, 0xef
ja 0x861e32
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x861e14
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x861e21
mov ebp, dword [esi + 0x4691c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x861e73
sub esp, 0xffffff80
jmp 0x40d27e

Function at 0x43b646
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
add ecx, 0xf7b7860
mov ecx, ecx
sub ecx, edx
call fcn.0043b693
add edx, 0xc9b6c40d
or ecx, ecx
xor dword [ebx], edi
push 0x3c31a4b6
pop edx
and edx, ecx
mov edx, 0x4a4f545c
inc ebx
add ecx, 1
and edx, edx
sub ecx, ecx
cmp ebx, eax
jne fcn.0043b646
add edx, 0x9401fb3d
sub ecx, 0x6090300d
ret
Function at 0x100069e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x10073980]
xor eax, esp
mov dword [esp + 0x70], eax
xor eax, eax
push esi
cmp edi, eax
je 0x10006a61
cmp ecx, eax
je 0x10006a61
cmp edx, eax
jle 0x10006a61
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
push ecx
mov eax, edx
lea esi, [esp + 0xc]
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.10006080
add esp, 4
mov eax, esi
call fcn.10006190
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [edi], eax
mov eax, dword [esp + 0x6c]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov eax, 1
mov ecx, dword [esp + 0x74]
pop esi
xor ecx, esp
call fcn.1002d0ef
mov esp, ebp
pop ebp
ret
Function at 0x1000f750
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10060ec8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push 0
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
push eax
mov ecx, esi
mov byte [esi + 4], 0
call fcn.10004b90
mov dword [esp + 0x10], 0
mov ecx, dword [edi]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 4]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 8]
lea ecx, [edi + 0xc]
push ecx
lea edx, [esi + 0x28]
push edx
mov dword [esi + 0x24], eax
call fcn.1000e110
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x48], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x4c], ecx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x50], edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x54], eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x1001d2b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10060ff7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], str.DelfvXFJW
mov dword [edi + 0x58], 0x1006bdf8
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.1001f390
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], 0x1006be80
call fcn.10020530
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], 0x1006be44
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x1008023c]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x10020530
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1005f3fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], 0x1006be00
call fcn.1004d600
push 4
mov dword [esp + 0x20], 0
call fcn.1002eb20
mov edi, eax
add esp, 4
test edi, edi
je 0x100205ae
call fcn.1004d471
mov dword [edi], eax
call fcn.1004d29f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1004d5c1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x100205a3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call int.1004d5e9
jmp 0x100205b0
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x10021900
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1005f37b
mov eax, dword fs:[0]
push eax
mov eax, 0x200c
call fcn.10041780
mov eax, dword [0x10073980]
xor eax, esp
mov dword [esp + 0x2008], eax
push ebx
push esi
push edi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 0x201c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x202c]
mov edi, ecx
test edi, edi
je 0x10021a2c
test eax, eax
je 0x10021a2c
push 0x1006bdc4
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0
call fcn.100300cc
add esp, 0xc
cmp dword [esp + 0x10], 0
je 0x10021a2c
lea ebx, [esp + 0x14]
call fcn.100106f0
xor ebx, ebx
mov dword [esp + 0x2024], ebx
mov eax, dword [eax]
push 0x1006c2c0
push eax
call fcn.1005a9a0
mov esi, eax
mov dword [esp + 0x202c], 0xffffffff
mov eax, dword [esp + 0x1c]
add esp, 8
cmp eax, ebx
je 0x100219c1
push eax
call fcn.1002d1c5
add esp, 4
mov dword [esp + 0x14], ebx
cmp esi, ebx
je 0x10021a2c
push 0x1fff
lea ecx, [esp + 0x1d]
push ebx
push ecx
mov byte [esp + 0x24], bl
call fcn.10030da0
push 0x2000
lea edx, [esp + 0x28]
push edx
push esi
call int.1005a5c0
add esp, 0x18
cmp eax, ebx
jbe 0x10021a19
mov ecx, dword [esp + 0x10]
push ecx
push 1
push eax
lea edx, [esp + 0x24]
push edx
call fcn.100304c8
push 0x2000
lea eax, [esp + 0x2c]
push eax
push esi
call int.1005a5c0
add esp, 0x1c
cmp eax, ebx
ja 0x100219f0
push esi
call int.1005a540
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10030812
add esp, 8
mov ecx, dword [esp + 0x201c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.1002d0ef
add esp, 0x2018
ret
Function at 0x10021a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1005f6a4
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi], 0x1006c310
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, 7
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ebx
mov word [esi + 0x14], cx
xor edx, edx
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov word [esi + 0x30], dx
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], ebx
mov word [esi + 0x4c], cx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x80], eax
mov dword [esi + 0x7c], ebx
mov word [esi + 0x6c], dx
mov byte [esp + 0x14], 4
lea ecx, [esi + 0xa8]
xor eax, eax
push ecx
mov word [esi + 0x84], ax
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov byte [esi + 0xa0], bl
call fcn.10022e50
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x10022cc0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10060441
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0xc], ebx
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x18], ax
mov eax, dword [esp + 0x44]
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
call fcn.1000caf0
mov eax, edi
mov dword [esp + 0x34], 1
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10022d20
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [esp + 0x14]
call fcn.1001a9e0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0xffffffffffffffff
mov word [esi + 4], cx
push ebx
mov ecx, esi
call fcn.1000caf0
mov byte [esp + 0x34], bl
cmp dword [esp + 0x28], 8
mov dword [esp + 0xc], 1
jb 0x10022d75
mov edx, dword [esp + 0x14]
push edx
call fcn.1002d0e4
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x10022e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1005f34d
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
push 4
mov dword [edi], 0x1006c340
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea esi, [edi + 0x10]
call fcn.1002eb20
add esp, 4
cmp eax, ebx
je 0x10022e9b
mov dword [eax], esi
jmp 0x10022e9d
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x1c], ebx
mov ebp, dword [0x10062044]
mov dword [edi + 0x30], 1
call ebp
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call fcn.10017470
call ebp
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x10024bb0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x10060a0b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10073980]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
push 0x2c
call fcn.1002eb20
add esp, 4
test eax, eax
je 0x10024bfe
xor ecx, ecx
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], 0
mov word [eax + 4], cx
mov esi, eax
jmp 0x10024c00
xor esi, esi
mov eax, edi
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10024c10
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.1000df70
xor eax, eax
lea edx, [esp + 0x14]
push edx
push eax
push esi
mov dword [esi + 0x28], 2
lea edi, [esi + 0x1c]
mov dword [edi], eax
push 0x10024aa0
mov dword [edi + 4], eax
push eax
mov dword [edi + 8], eax
push eax
mov dword [esp + 0x2c], eax
call fcn.1002f821
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10024c75
call fcn.10023ab0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
push 0x2710
push ebx
call dword [0x100620b0]
test eax, eax
jne 0x10024c9c
cmp dword [edi], 3
jne 0x10024c9c
mov eax, dword [esp + 0x28]
push 0xc
push edi
push 0x26
push eax
call fcn.100256b0
add esp, 0x10
call fcn.10023ab0
push ebx
call dword [0x1006209c]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x1003e4a3
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xc0068a4d
sbb al, 0xe0
mov ch, dh
push ecx
mov dword [0xbdc3e6ab], eax
or eax, 0xfd60a955
mov dword [0xbe77711f], eax
mov eax, dword [0xf1bc544]
outsb dx, byte [esi]
cli
test eax, 0x1fa3fd60
jno 0x1003e532
mov esi, 0x1bc544a1
movd mm7, edx
xor esi, dword [ecx + ecx*4 - 0x3e]
ja 0x1003e4b4
or dword [ebx], edi
cld
pop edi
sbb dh, byte [ebp + 0x1df54338]
sal dword [ebp + 0x34d2af92], 1
out dx, eax
outsb dx, byte [esi]
or dword [ebp + 0x65], 0xffffff9e
inc ecx
mov al, pe_nt_image_headers32
xchg edi, eax
pop ebp
mov esi, dword [esi]
xlatb
invalid
mov dword [0x4b5bdf7b], eax
shr dword [edi + 0x19421118], 1
in al, 9
cmp dword [ebx], 0xb0e8ce3e
cmp al, 0xc3
out dx, al
das
dec eax
rol byte [esi - 0x6d], 0xff
mov esp, 0x9d5b067b
or dword [ecx + eax], edx
mov al, byte [0x58ae72da]
push esp
mov dword [eax - 0x439c94a8], esi
adc ah, byte [esi]
mov esi, 0xc5e1df0d
mov eax, 0x15352b55
push edx
movsb byte es:[edi], byte [esi]
invalid

Function at 0x1003e808
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov dl, 0x67
sub al, 0xd4
push edi
mov bl, 0x83
shr dword [eax + ebx*8], 1
mov esp, 0x21f03da0
xor dh, bh
pop ebp
xor bl, cl
jle 0x1003e803
and al, 0xc5
sub byte [esi - 0x46be032c], bl
arpl word [edi + 0x14], sp
sub byte [ebx], 0x3d
stosb byte es:[edi], al
pop esi
into
pop esp
add dword [edx], ecx
xchg ebx, eax
jle 0x1003e836
mov dl, 0x68
call 0xf42483fe
jbe 0x1003e803
les ebx, [ebx - 0x38891be0]
jmp 0x1003e845
mov ch, 0xa7
push edi
jno 0x1003e82e
or dword [bp + di + 0x4b3b], ecx
in eax, dx
popfd
scasb al, byte es:[edi]
mov dl, byte [ebx - 0x1a]
dec esp
or al, cl
inc esi
lcall 0xd561, 0xefc02d9f
xlatb
lahf
dec ebp
int3

Function at 0x1003edfc
Capabilities:
Encode data using xor

Disassembly:
cmp bl, bh
mov esi, 0x2f3b488c
cmp ebp, dword [edi]
fmul st(4), st(0)
sub byte [edi], cl
in eax, 0x29
and al, 0x3e
xor esi, dword [eax - 0x11]
xor dword [esi], edx
mov al, 0xd0
push ecx
in eax, dx
pushfd
wait
nop
test dword [eax], edx
jg 0x1003ed80
push edx
nop
out 0xa1, al
mov bl, 0xea
pop ss
or edx, ebx
test byte [edi], ch
shr byte [eax - 0x4e], cl
sbb byte [edi - 0x66], 0xc6
mov ds, word [edx - 0x44]
push esi
pushal
mov cl, 0xc8
stc
imul edx, dword [edx], 0xffffffb2
push ebp
xchg edx, eax
inc esp
or byte [edi], al
int3
jl 0x1003ed85
neg byte [esi + 0x3474c694]
leave
add edi, 0xe401132e
rcr dword [0x7b37446e], 0x47
stosd dword es:[edi], eax
cmp byte [edi], dl
jne 0x1003edb6
adc al, byte [edi]
push ebp
push ds
mov bl, 0xb6
imul ebx, ecx, 0x5b
mov edx, 0xd5cd302
jmp 0x6404ecb1
Function at 0x10040d4a
Capabilities:
Encode data using xor

Disassembly:
call 0x976e8df3
ror byte [edx], 0x81
xchg ecx, eax
aad 0x5b
std
dec ebp
and dword [ebx + 0x43], esp
inc esi
add al, al
and eax, 0xd8009c5c
add al, bl
or eax, 0xdb376861
sbb al, 0x4b
mov ebp, 0x20751528
sub eax, 0xfe8a072
push edi
salc
enter 0x7161, 0xffffffffffffffd1
jno 0x10040d1d
jno 0x10040d1d
sal dword [edx - 0x49], cl
mov cl, 0x1e
lea ebp, [esi + 0x3d]
or bh, al
aaa
xor eax, 0x7b7c2d80
adc al, 0x67
jecxz 0x10040d33
rol dword [edx + 4], cl
ficom dword [eax + ebp*4 + 0x75a099ff]
xchg edx, eax
or eax, 0xe8aefeb3
push esp
salc
mov esi, 0x1654c42f
xor esi, dword [edx]
jb 0x10040d8e
fcmove st(0), st(3)
cmp eax, 0xdb97e72e
aaa
fld qword [ebp + 0x3efbd85e]
clc
invalid
mov byte [0x5bdbee5c], al
push ss
hlt