joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454ea0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x454eb7
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x454ee9
mov dword [esi + 8], ebx
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov dword [esi + 8], edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.004226d0
mov ebx, dword [esp + 0x18]
mov ecx, edi
push ebx
call fcn.00422fc0
mov ecx, edi
call fcn.00422700
test eax, eax
jne 0x454f17
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
lea edx, [esp + 0x14]
push 0
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x454f3f
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x14]
add ecx, ebx
cmp eax, ebx
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebx
sete al
pop ecx
ret 0xc

Function at 0x454f60
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x454f77
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x454fa9
mov dword [esi + 8], ebx
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov dword [esi + 8], edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.004226d0
mov ebx, dword [esp + 0x18]
mov ecx, edi
push ebx
call fcn.00422fc0
mov ecx, edi
call fcn.00422700
test eax, eax
jne 0x454fd7
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
lea edx, [esp + 0x14]
push 0
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x454fff
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004227f0
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 8]
add eax, edx
pop edi
mov dword [esi + 8], eax
pop esi
mov al, 1
pop ebx
pop ecx
ret 0xc
Function at 0x456110
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x456195
cmp eax, 0x40
jbe 0x45613c
lea eax, [esi + 0x40]
push eax
push esi
call fcn.0045ccb0
add esp, 8
mov dword [esi + 0x9c], 0x14
mov edx, dword [esi + 0x9c]
mov ecx, 0x40
push edi
sub ecx, edx
lea edi, [edx + esi]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, esi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x36363636
dec ecx
mov dword [eax - 4], edx
jne 0x456164
lea edi, [esi + 0x40]
push edi
call fcn.0045cbe0
push edi
push 0x40
push esi
call fcn.0045cc20
add esp, 0x10
mov dword [esi + 0x9c], 0xffffffff
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4561af
add esi, 0x40
push esi
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.0045cc20
add esp, 0xc
pop esi
ret

Function at 0x4561c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x28]
cmp dword [edi + 0x9c], 0xffffffff
je 0x4561df
push edi
push 0
push 0
call fcn.00456110
add esp, 0xc
lea esi, [edi + 0x40]
lea eax, [esp + 8]
push esi
push eax
call fcn.0045ccb0
add esp, 8
mov eax, edi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edx
jne 0x4561f7
push esi
call fcn.0045cbe0
push esi
push 0x40
push edi
call fcn.0045cc20
push esi
lea ecx, [esp + 0x1c]
push 0x14
push ecx
call fcn.0045cc20
lea edx, [esp + 0x24]
push esi
push edx
call fcn.0045ccb0
mov ecx, dword [esp + 0x48]
add esp, 0x24
test ecx, ecx
jbe 0x456250
mov edi, dword [esp + 0x20]
mov eax, ecx
lea esi, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4570d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
push esi
lea eax, [esp + 0x38]
push edi
push eax
call fcn.00456060
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x40]
push ecx
push edx
push eax
call fcn.00456070
mov edx, dword [esp + 0x23c]
mov eax, dword [esp + 0x238]
mov ecx, 0x28
lea esi, [esp + 0x4c]
lea edi, [esp + 0x18c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18c]
push ecx
push edx
push eax
call fcn.00456110
mov ecx, dword [esp + 0x254]
add esp, 0x1c
dec ecx
mov eax, 0xcccccccd
mul ecx
shr edx, 4
inc edx
mov dword [esp + 0x10], edx
je 0x45725c
push ebx
push ebp
mov dword [esp + 0x10], 0
mov ebx, 1
lea ebp, [esp + 0x1c]
xor edx, edx
mov ecx, 0x28
mov dword [esp + 0x1c], edx
lea esi, [esp + 0x184]
lea edi, [esp + 0xe4]
mov dword [esp + 0x20], edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], edx
mov ecx, ebx
mov dword [esp + 0x28], edx
mov eax, ebx
shr ecx, 0x10
mov dword [esp + 0x2c], edx
mov byte [esp + 0x31], cl
mov ecx, dword [esp + 0x238]
mov edx, ebx
shr eax, 0x18
shr edx, 8
mov byte [esp + 0x30], al
mov byte [esp + 0x32], dl
test ecx, ecx
mov byte [esp + 0x33], bl
mov eax, 4
jbe 0x457219
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x30]
push ecx
push eax
push edx
call fcn.00456110
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x3c]
push eax
push 0x14
push ecx
call fcn.004561c0
add esp, 0x18
xor eax, eax
mov dl, byte [esp + eax + 0x30]
mov cl, byte [esp + eax + 0x1c]
xor cl, dl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x14
jb 0x4571e8
mov ecx, 0x28
lea esi, [esp + 0x44]
lea edi, [esp + 0xe4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
dec ecx
mov dword [esp + 0x14], ecx
jne 0x4571bc
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [esp + 0x240]
jae 0x45723c
mov esi, dword [esp + 0x23c]
mov dl, byte [eax + ebp]
inc ecx
mov byte [eax + esi], dl
inc eax
cmp ecx, 0x14
jb 0x45721f
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc ebx
add esi, 0x14
sub ebp, 0x14
mov dword [esp + 0x10], esi
lea eax, [ebx - 1]
cmp eax, ecx
jb 0x45715e
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x214
ret

Function at 0x4572b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
je 0x4572db
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x457e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46ef28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push edi
lea ecx, [esp + 4]
call fcn.00422840
mov edx, dword [esp + 0x2c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], 0
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.00423270
mov eax, dword [esp + 0x30]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.00457ee0
add esp, 8
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.00422f50
mov ecx, dword [esp + 0x1c]
pop edi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x458460
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
sub esp, 0xc8
mov byte [eax], 0
mov byte [ecx], 0
push esi
mov esi, dword [esp + 0xe8]
push edi
mov ecx, esi
call fcn.00416380
mov edi, dword [esp + 0xf0]
mov edx, dword [esp + 0xd4]
push edx
mov dword [edi], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4584f7
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
je 0x4584b0
mov edx, dword [ecx]
mov dword [edi], edx
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
mov eax, dword [eax]
mov cl, byte [eax + 3]
mov dl, byte [eax + 2]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 1]
mov dl, byte [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push str._d._d._d._d
push eax
call fcn.0045d7c4
add esp, 0x18
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00417e70
pop edi
mov al, 1
pop esi
add esp, 0xc8
ret 0x28
pop edi
xor al, al
pop esi
add esp, 0xc8
ret 0x28

Function at 0x459e70
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
mov eax, dword [esp + 0x18]
test ebx, ebx
jne 0x459e85
mov eax, dword [esp + 0x1c]
xor edi, eax
mov ebp, 4
mov ecx, edi
shr ecx, 0x18
mov byte [esp + 0x10], cl
mov al, cl
mov edx, dword [esp + 0x10]
and al, 0x80
and edx, 0xff
neg al
sbb eax, eax
mov esi, edx
and eax, 0x14d
and esi, 0x7f
and eax, 0xff
and cl, 1
shl esi, 1
xor esi, eax
mov eax, edx
neg cl
sbb ecx, ecx
and ecx, 0xa6
shr eax, 1
xor ecx, eax
xor ecx, esi
mov eax, ecx
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, ecx
xor eax, edi
shl eax, 8
xor eax, edx
dec ebp
mov edi, eax
jne 0x459e8c
inc ebx
cmp ebx, 2
jl 0x459e79
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x459f00
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x4995e8
mov dl, byte [edi + 0x493a60]
mov al, dl
mov cl, dl
and al, 2
mov bl, dl
neg al
sbb al, al
and cl, 1
and eax, 0xb4
mov byte [esp + 0xd], cl
neg cl
sbb cl, cl
and ecx, 0x5a
shr bl, 2
xor bl, cl
mov byte [esp + 0xe], cl
xor bl, al
mov cl, dl
xor bl, dl
shr cl, 1
mov byte [esp + 0x10], bl
mov bl, byte [esp + 0xd]
xor cl, dl
shr cl, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor cl, bl
mov bl, byte [esp + 0xe]
xor cl, bl
mov bl, byte [edi + 0x493b60]
xor cl, al
mov al, bl
and al, 2
xor cl, dl
neg al
sbb al, al
and eax, 0xb4
mov byte [esp + 0xd], al
mov al, bl
and al, 1
mov byte [esp + 0xe], al
neg al
sbb al, al
and eax, 0x5a
shr bl, 2
mov byte [esp + 0xf], al
xor bl, al
mov al, byte [esp + 0xd]
xor bl, al
mov al, byte [edi + 0x493b60]
xor bl, al
mov byte [esp + 0x13], al
mov byte [esp + 0x11], bl
mov bl, byte [esp + 0x13]
shr al, 1
xor al, bl
mov bl, byte [esp + 0xe]
shr al, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor al, bl
mov bl, byte [esp + 0xf]
xor al, bl
mov bl, byte [esp + 0xd]
xor al, bl
mov bl, byte [edi + 0x493b60]
xor al, bl
mov byte [esp + 0x14], bl
mov bl, byte [esp + 0x11]
mov byte [esp + 0x16], al
mov byte [esp + 0x15], bl
mov byte [esp + 0x17], al
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x14], cl
mov dword [esi - 0x400], ebx
mov bl, byte [esp + 0x10]
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], dl
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x15], al
mov dword [esi], ebx
mov bl, byte [esp + 0x11]
mov byte [esp + 0x14], bl
mov bl, byte [edi + 0x493b60]
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x15], dl
mov dword [esi + 0x400], eax
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], al
add esi, 4
mov ecx, dword [esp + 0x14]
inc edi
mov dword [esi + 0x7fc], ecx
cmp esi, 0x4999e8
jl 0x459f0d
pop edi
pop esi
mov dword [0x493c60], 0
pop ebx
add esp, 0xc
ret
Function at 0x45cbe0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x5ad41bf0
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x68c55b6d
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100056d6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005715
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10005715
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10005715
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10005715
cmp dword [ecx + 0x74], 0xe
jbe 0x10005715
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100077a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100077cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100077cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10007ac0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a58
push 0x10010a50
push str.FlsAlloc
push 0x1f
call fcn.10007da3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007af4
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10007afa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007b3e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a68
push 0x10010a60
push str.FlsGetValue
push 0x21
call fcn.10007da3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007b75
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10007b7d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a70
push 0x10010a68
push str.FlsSetValue
push 0x22
call fcn.10007da3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007bb7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000a6cf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000a76c
push ebx
push esi
call fcn.1000a76f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000a5d3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000a719
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a76b
push edi
push eax
call fcn.1000a846
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000a739
call fcn.10009070
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a76a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000a5d3
add esp, 0x20
test eax, eax
jne 0x1000a758
push edi
call fcn.10009070
jmp 0x1000a760
push ebx
call fcn.10009070
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x11b9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x11b91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x11b907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11b906a
add dl, dl
jne 0x11b9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11b90dc
xor eax, eax
add dl, dl
jne 0x11b9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11b917d
add dl, dl
jne 0x11b90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11b90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11b9075
mov eax, 1
add dl, dl
jne 0x11b90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11b90e1
sub eax, ebx
mov ebx, 1
jne 0x11b9128
mov ecx, 1
add dl, dl
jne 0x11b910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11b9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11b9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11b9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11b913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11b914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11b9136
cmp eax, 0x7d00
jae 0x11b916d
cmp eax, 0x500
jb 0x11b9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11b9075
cmp eax, 0x7f
ja 0x11b9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11b9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x11b919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11b9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x568adc
Capabilities:
Encode data using xor

Disassembly:
invalid
mov ah, 0xf5
outsb dx, byte [esi]
in eax, dx
sahf
pop esi
xchg edx, eax
dec edi
and byte [edi - 0x32], cl
and ebp, dword [eax + 0x30]
or byte [edx], dl
xchg edi, ecx
and ah, bh
loope 0x568a6e
xor ebp, dword [ebx - 0x6f6e939b]
jns 0x568aca
push ss
mov ebp, 0xd9274435
xchg dword [ecx + ebx], edx
xor eax, 0x87d92744
adc al, 0x19
mov ecx, 0x7a54e877
daa
mov fs, word [ecx + 0x30]
jne 0x568aeb
cmp eax, 0x138a12ea
fld qword [ecx]
sbb ebp, esp
dec ebx
sub dword [edx - 0x1365ab06], esp
xor byte [edi + ecx - 0x7b], dh
xchg ebp, eax
invalid
Function at 0x60e6e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xfb000]
push edi
or ebp, 0xffffffff
jmp 0x60e702
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x60e709
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60e6f8
mov eax, 1
add ebx, ebx
jne 0x60e71b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x60e710
jne 0x60e72c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x60e710
xor ecx, ecx
sub eax, 3
jb 0x60e740
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x60e7b2
mov ebp, eax
add ebx, ebx
jne 0x60e74b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x60e758
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x60e77c
inc ecx
add ebx, ebx
jne 0x60e768
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x60e75d
jne 0x60e779
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x60e75d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x60e79c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x60e78d
jmp 0x60e6fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x60e79c
add edi, ecx
jmp 0x60e6fe
pop esi
mov edi, esi
mov ecx, 0x4cf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x60e7ba
cmp byte [edi], 7
jne 0x60e7ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x60e7bf
lea edi, [esi + 0x20c000]
mov eax, dword [edi]
or eax, eax
je 0x60e82e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2180cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x218108]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x60e7ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21810c]
or eax, eax
je 0x60e828
mov dword [ebx], eax
add ebx, 4
jmp 0x60e809
call dword [esi + 0x21811c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x60e85f
cmp al, 0xef
ja 0x60e852
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x60e834
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x60e841
mov ebp, dword [esi + 0x218110]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x60e893
sub esp, 0xffffff80
jmp 0x402aa9
Function at 0x10001170
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov byte [ebp - 1], 0
mov dword [ebp - 0x130], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100011d8
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x100011d8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.100011f0
add esp, 8
test eax, eax
jne 0x100011d6
mov byte [ebp - 1], 1
jmp 0x100011a7
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret