joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001044
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x10014efc
sub byte [esi - 0x1a3], 0xd8
pop esi
jmp 0x1000107d
jmp 0x100010a4
xor eax, eax
jmp 0x10001414
call fcn.100010ab
test eax, eax
jne 0x10001422
ret
push ebp
push eax
mov eax, 0x10015143
add dword [eax - 0x3c], 0x25b5642c
xor byte [eax - 0x365], 0xf5
pop eax
push ebx
mov ebx, eax
call fcn.1000121c
sub esp, 4
push esi
pop dword [0x10014db5]
mov dword [esp], 0x35485406
add dword [esp], 0x343216f8
push eax
jmp loc.10021000

Function at 0x1000121c
Capabilities:
Access peb ldr_data

Disassembly:
push esi
jmp 0x1000123c
xor eax, eax
mov eax, dword fs:[eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x1000125f
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push edx
push ecx
mov ecx, 0x10014e79
xor dword [ecx - 0x121], 0x1638db40
pop ecx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
push dword [ebx + 0x7c]
push 0x9c830a79
pop dword [0x10014f30]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
add dword [esp], ebx
push edi
mov edi, 0x10015138
xor dword [edi - 0x326], 0x411f6b3b
mov byte [edi - 0x258], 0x58
pop edi
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
jmp 0x100012f4
jmp 0x1000132b
jmp 0x10001351
add edx, ecx
mov dword [ebp - 4], edx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x10001358
mov dword [0x10014d6c], edi
cmp eax, dword [ebp + 0xc]
je 0x10001380
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x100012b7
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
push edi
mov edi, 0x10014d8f
and byte [edi + 0xfc], 0xef
mov word [edi + 0x185], 0x3fc
pop edi
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
pop ecx
cmp eax, ebx
jbe 0x100013fb
cmp eax, ecx
jae 0x100013fb
push edi
mov edi, 0x10014e35
sbb word [edi + 0xbf], 0x63e8
and word [edi + 0x31f], 0x6a01
pop edi
push dword [ebp - 4]
push dword [ebp + 8]
sub esp, 4
mov dword [esp], 0xeb8ed3f6
add dword [esp], 0x343216f8
push dword [ebp + 8]
call fcn.1000125f
call eax
sub dword [0x10014ed7], edi
pop edi
pop esi
push ecx
mov ecx, 0x10015162
sub dword [ecx - 0x2bf], 0x15bc800
pop ecx
pop edx
pop ebx
leave
ret 8

Function at 0x40a174
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edx
push ecx
push pe_nt_image_headers32
push 0x3000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ecx
pop edx
leave
ret 4
Function at 0x41a141
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x41a150
pop dword [ebp - 8]
mov eax, 0x40bb6676
sub eax, 0x4079c526
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x41490
push 0
mov eax, 0x776cdfd9
sub eax, 0x772a8dc1
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x5b1b5ad7
add ecx, 0xa4e4fb2f
mov edi, eax
mov ebx, 0x435400
add ebx, dword [ebp - 8]
mov esi, 0x5329719e
add esi, 0xd8c5d8e4
sub dword [ebp - 4], ebx
mov edx, dword [ebx]
sub dword [ebp - 4], eax
xor edx, esi
sub dword [ebp - 4], 0xd1432965
mov dword [edi], edx
xor dword [ebp - 4], 0xfd57cca0
add edi, 4
add ebx, 4
loop 0x41a1a9
add eax, 0xf6be0084
sub eax, 0xf6bcb599
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x42b7cfed
add ecx, 0xbd883013
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404a42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x404a51
pop dword [ebp - 0x10]
mov eax, 0xe04a2c87
sub eax, 0xe009e236
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xb60f72
add dword [ebp - 0x20], 0x4d9c35d9
mov dword [ebp - 0x1c], 0x889df691
add dword [ebp - 0x1c], 0xa99555b4
mov dword [ebp - 0x18], 0xaff03849
add dword [ebp - 0x18], 0x9c5c0be5
mov dword [ebp - 0x14], 0x58992d97
sub dword [ebp - 0x14], 0x58992d97
lea eax, [ebp - 0x20]
push eax
mov eax, 0x51c1dd96
sub eax, 0x51810d4a
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xf055667e
add dword [ebp - 0x20], 0x841d02d8
mov dword [ebp - 0x1c], 0x267bdc08
sub dword [ebp - 0x1c], 0xe50f7a93
mov dword [ebp - 0x18], 0x698b9bb1
sub dword [ebp - 0x18], 0x61c2f45
mov dword [ebp - 0x14], 0xf9e186a0
sub dword [ebp - 0x14], 0xf9e186a0
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xee24111
add eax, 0xf15e8f37
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35d7a
push 0
call eax
mov ecx, 0x8cf0faa8
add ecx, 0x730f3ed5
mov esi, eax
mov edi, 0x6741c3ef
sub edi, 0x670013ef
add edi, dword [ebp - 0x10]
mov edx, 0xfd5178e9
sub edx, 0xdb7e6096
mov dword [ebp - 4], 0xcfbbcb56
mov ebx, dword [edi]
sub dword [ebp - 4], 0x2eba777f
sub ebx, edx
xor dword [ebp - 4], 0xfc72db17
mov dword [esi], ebx
sub dword [ebp - 0xc], edi
add esi, 0xc8533050
sub esi, 0xc853304c
add edi, 4
loop 0x404b73
add eax, 0x88b9e5f1
add eax, 0x7746f2d6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x85b3efa7
sub ecx, 0x8573efa7
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4172b3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4172f2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4172f2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4172f2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4172f2
cmp dword [ecx + 0x74], 0xe
jbe 0x4172f2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x429590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4295bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4295bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1001d10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac0
push ebx
push esi
push edi
push 0x1e
pop ecx
mov esi, 0x1001c50
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
cmp dword [ebp + 0x10], edi
push 0x7a
mov dword [ebp - 0x1c], 0x80000002
mov dword [ebp - 0x18], 0x80000001
pop ebx
jbe 0x1001e45
mov eax, dword [ebp + 0xc]
mov word [eax], di
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
cmp word [eax], di
jne 0x1001e45
lea eax, [ebp - 0x10]
push eax
push 1
push edi
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 4]
push dword [ebp + eax*4 - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x1001e38
xor esi, esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2a0]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 8], 0x410
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
inc esi
cmp ebx, edi
jne 0x1001e2f
cmp dword [ebp - 8], 2
jbe 0x1001e23
cmp dword [ebp - 0xc], 1
je 0x1001dd2
cmp dword [ebp - 0xc], 2
jne 0x1001e23
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001e23
push 0x208
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x6b0]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
je 0x1001e23
add eax, 2
cmp eax, dword [ebp + 0x10]
jae 0x1001e23
lea eax, [ebp - 0xac0]
push eax
push 0x1001c40
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp + 0xc]
cmp word [eax], di
je 0x1001d86
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jb 0x1001d53
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x1001f7d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0xe
pop ecx
xor esi, esi
xor eax, eax
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
push esi
rep stosd dword es:[edi], eax
call sub.IMM32.dll_ImmDisableIME
push dword [ebp + 8]
jmp loc.01004000
Function at 0x1007b75
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1007b84
pop dword [ebp - 0x28]
mov eax, 0x5eb29bcd
add eax, 0xa24ddfb7
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe11eb757
add dword [ebp - 0x38], 0x6d338df4
mov dword [ebp - 0x34], 0x7769d956
sub dword [ebp - 0x34], 0x45368d11
mov dword [ebp - 0x30], 0x51396312
add dword [ebp - 0x30], 0xfb12e11c
mov dword [ebp - 0x2c], 0xc2ee2f01
add dword [ebp - 0x2c], 0x3d11d0ff
lea eax, [ebp - 0x38]
push eax
mov eax, 0x70da78b1
sub eax, 0x6fda675d
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x11ea111b
add dword [ebp - 0x38], 0x6288583b
mov dword [ebp - 0x34], 0x5000625b
add dword [ebp - 0x34], 0xf16bff1a
mov dword [ebp - 0x30], 0x3d47a360
add dword [ebp - 0x30], 0x2627c90c
mov dword [ebp - 0x2c], 0x94443e5b
sub dword [ebp - 0x2c], 0x94443e5b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3696e
push 0
call eax
mov ecx, 0xd5819fe6
sub ecx, 0xd5815a9e
mov ebx, eax
mov edi, 0x1049000
add edi, dword [ebp - 0x28]
mov edx, 0xd4cff829
xor dword [ebp - 4], ebx
mov esi, dword [edi]
sub dword [ebp - 0xc], 0xa1358199
add esi, edx
xor dword [ebp - 4], 0xaaa6f32c
mov dword [ebx], esi
xor dword [ebp - 4], 0xc830ce7e
add ebx, 0xedaa8cbf
sub ebx, 0xedaa8cbb
add edi, 4
loop 0x1007c95
add eax, 0x107f3
xor ebx, ebx
add ebx, eax
add eax, 0x9e302678
sub eax, 0x9e302673
mov ecx, 0x1a6f4762
add ecx, 0xe690b89e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x2a837aa7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x2a837ab6
pop dword [ebp - 0x3c]
mov eax, 0x294228ea
add eax, 0x14151cc
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x806e32fe
add dword [ebp - 0x4c], 0xcde4124d
mov dword [ebp - 0x48], 0xd58caac
sub dword [ebp - 0x48], 0xdb257e67
mov dword [ebp - 0x44], 0x83814405
add dword [ebp - 0x44], 0xc8cb0029
mov dword [ebp - 0x40], 0xf8731b22
add dword [ebp - 0x40], 0x78ce4de
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x3f280964
add eax, 0xeb5d17e0
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x2fd3c13c
sub dword [ebp - 0x4c], 0xbb6157e6
mov dword [ebp - 0x48], 0xe09a556b
add dword [ebp - 0x48], 0x60d20c0a
mov dword [ebp - 0x44], 0xea55ff07
add dword [ebp - 0x44], 0x79196d65
mov dword [ebp - 0x40], 0xb33bcf8a
add dword [ebp - 0x40], 0x4cc43076
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xa38c8ff9
add eax, 0x86f89143
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x48268
push 0
call eax
mov ecx, 0x79fcb318
sub ecx, 0x79fc733e
mov edi, eax
mov edx, 0x2fb35c0d
add edx, 0xfad48df3
add edx, dword [ebp - 0x3c]
mov esi, 0x395a633c
add esi, 0x8af11f0
mov ebx, dword [edx]
sub dword [ebp - 0x38], edi
sub ebx, esi
sub dword [ebp - 0x38], 0xf2e37b2d
mov dword [edi], ebx
xor dword [ebp - 4], edi
add edi, 0xca7895be
add edi, 0x35876a46
add edx, 0x39ac82a4
add edx, 0xc6537d60
loop 0x2a837bd8
add eax, 0xf23b
xor ebx, ebx
add ebx, eax
add eax, 0xee935647
sub eax, 0xee935642
mov ecx, 0xb1d3d859
add ecx, 0x78ac27a7
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.25814905
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.25814905
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.25814905
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.25814905
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.25814905
pop ecx
jmp 0x258071e5
Function at 0x25814905
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x25814914
pop dword [ebp - 0x38]
mov eax, 0x25814914
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xc846203d
add dword [ebp - 0x48], 0x860c250e
mov dword [ebp - 0x44], 0x7de9830c
add dword [ebp - 0x44], 0xb449c939
mov dword [ebp - 0x40], 0xbf2e9bc4
sub dword [ebp - 0x40], 0x72e25796
mov dword [ebp - 0x3c], 0xf62fcd00
add dword [ebp - 0x3c], 0x9d03300
lea eax, [ebp - 0x48]
push eax
mov eax, 0xe450c6b0
sub eax, 0xbecef66c
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x62e7514f
add dword [ebp - 0x48], 0x118b1807
mov dword [ebp - 0x44], 0x9ea12bf9
add dword [ebp - 0x44], 0xa2cb357c
mov dword [ebp - 0x40], 0x1cccc74e
add dword [ebp - 0x40], 0x46a2a51e
mov dword [ebp - 0x3c], 0xeb33a7fd
add dword [ebp - 0x3c], 0x14cc5803
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xb25f4819
sub eax, 0x8cdd7799
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x4100b
push 0
call eax
mov ecx, 0x9b6625db
add ecx, 0x649a33f3
mov esi, eax
mov edx, 0x25829600
add edx, dword [ebp - 0x38]
mov edi, 0xbb3d0d32
sub edi, 0x876c40
mov ebx, dword [edx]
xor dword [ebp - 4], esi
sub ebx, edi
sub dword [ebp - 4], eax
mov dword [esi], ebx
add dword [ebp - 0x1c], 0xb0dcadd5
add esi, 4
add edx, 0x512d2886
sub edx, 0x512d2882
loop 0x25814a2b
add eax, 0x15a0b
mov ebx, eax
add eax, 0xc127c198
add eax, 0x3ed83e6d
mov ecx, 0xf6aa0599
add ecx, 0x2ed5fa67
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x40bcc0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40bc9c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40bcba
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40bd18
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40bcff
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40bd08
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40bd12
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40bcf4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40bc7e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40bd65
dec eax
je 0x40bd5c
sub eax, 3
je 0x40bd53
mov dword [ebp - 4], 0x40
jmp 0x40bd82
mov dword [ebp - 4], 4
jmp 0x40bd68
mov dword [ebp - 4], 0x20
jmp 0x40bd68
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40bdb4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40bd34
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040b5c5
mov ecx, 0xff46041a
jne 0x40bdbf
push 1
push esi
call edi
mov eax, esi
jmp 0x40bdc0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40b720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40b72f
pop dword [ebp - 0x40]
mov eax, 0xf4e6b5ac
add eax, 0xb5a0183
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3aa9e
push 0
mov eax, 0x867ee845
add eax, 0x79c1f8db
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xea74961
add ecx, 0xf15903f0
xor esi, esi
add esi, eax
mov edi, 0x8b56cdb1
sub edi, 0x8b1555b1
add edi, dword [ebp - 0x40]
mov edx, 0x76503ad4
sub edx, 0xe9bbc365
mov ebx, dword [edi]
add dword [ebp - 0x34], edx
add ebx, edx
xor dword [ebp - 0x20], 0x5a9c74da
mov dword [esi], ebx
add dword [ebp - 0x34], 0xec8884c2
add esi, 0x7d20784d
sub esi, 0x7d207849
add edi, 0x9d12b352
sub edi, 0x9d12b34e
loop 0x40b790
add eax, 0x12817
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x407ddd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], ecx
jbe 0x407e3d
push 0x40
pop eax
xor edx, edx
mov dword [ebp - 0x10], ecx
div dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
xor edx, edx
inc eax
call fcn.004a7e40
and eax, dword [ebp - 0xc]
and edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
call fcn.004a7e40
mov ecx, dword [ebp - 8]
xor edi, eax
mov eax, dword [ebp - 4]
xor esi, edx
dec eax
inc ecx
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
cmp ecx, dword [ebp + 0x10]
jb 0x407e0b
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x419790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
or ecx, 0xffffffff
cmp dword [ebp + 8], esi
jbe 0x4197b9
movzx eax, byte [esi + edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b1fd8]
inc esi
cmp esi, dword [ebp + 8]
jb 0x4197a0
not ecx
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x432e71
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.00432e30
mov esi, eax
call fcn.00432e30
mov ebx, eax
cmp ebx, esi
je 0x432e83
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
call fcn.00432e30
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x432e96
push 0
pop ecx
rdtsc
mov edi, eax
mov esi, 0x6b46
sub esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
sbb ecx, dword [ebp - 8]
add edi, esi
push 0
adc edx, ecx
sub eax, ebx
imul eax, eax, 0xd68b
push eax
push edx
push edi
call fcn.004a7bf0
push 0
push 0xf4240
push edx
push eax
call fcn.004a4a30
pop edi
pop esi
mov dword [0x4f1bd0], eax
xor eax, eax
mov dword [0x4f1bd4], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452a3c
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
push esi
push edi
movzx edi, word [ecx + 6]
xor ecx, ecx
movzx eax, ax
add edx, eax
test edi, edi
je 0x452a73
mov esi, dword [ebp + 8]
cmp esi, dword [edx + 0xc]
jb 0x452a6b
mov eax, dword [edx + 0x10]
add eax, dword [edx + 0xc]
cmp esi, eax
jb 0x452a7b
add edx, 0x28
inc ecx
cmp ecx, edi
jb 0x452a5c
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
mov eax, edx
jmp 0x452a75