joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405634
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push eax
pop ebx
pushal
call fcn.004052d8
call fcn.0040456c
mov dword [ebx + 0x18], eax
popal
pushal
lea eax, [ebx + 0x1c]
call fcn.004030e8
popal
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40574c
pushal
lea edx, [ebx + 0x1c]
mov eax, dword [edx]
call fcn.00404db8
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x4056a9
call fcn.00405c80
mov dword [ebx + 0x20], eax
popal
pushal
push ecx
xchg ecx, eax
mov edx, 0x40569b
call fcn.004048d8
test al, al
pop edx
jne 0x405691
mov edx, 0x4056a7
mov eax, dword [ebx + 0x20]
call fcn.00405cac
jmp 0x4056a9
popal
add esp, 0xfffffec0
xor edx, edx
push edx
push edx
xchg ecx, eax
mov edx, esp
call fcn.00405300
lea eax, [esp + 4]
mov edx, dword [ebx + 0x1c]
pop ecx
push ecx
call fcn.00403258
call fcn.004044a8
pop eax
mov edx, esp
push eax
push edx
push eax
call sub.kernel32.dll_FindFirstFileA
push eax
pop edi
inc eax
mov eax, esp
pushfd
call fcn.00403094
popfd
pop ecx
je 0x405746
mov ecx, dword [esp]
push dword [ebp + 8]
lea edx, [esp + 0x30]
push ebx
pop eax
call fcn.0040536c
test al, al
je 0x405735
mov ecx, dword [ebx + 0x24]
jecxz 0x405717
mov eax, dword [ebx + 0x28]
mov ecx, esp
push 1
mov edx, esp
push edx
push ebx
pop edx
call dword [ebx + 0x24]
pop ecx
jecxz 0x405735
loop 0x405746
mov eax, 0x140
push eax
call fcn.00402448
push eax
xchg edx, eax
mov eax, dword [ebx + 0x18]
call fcn.004045e8
pop edx
pop ecx
mov eax, esp
call fcn.0040254c
push esp
push edi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4056e9
push edi
call sub.kernel32.dll_FindClose
add esp, 0x140
xor eax, eax
xchg dword [ebx + 0x20], eax
call fcn.00404520
pop edi
pop ebx
pop ebp
ret 4

Function at 0x406218
Capabilities:
Capture screenshot

Disassembly:
push ebx
push eax
pop ebx
call fcn.00406144
je 0x40625d
push ebx
pop eax
push edx
call fcn.0040648c
pop edx
cmp eax, edx
je 0x40625d
test edx, edx
push ebx
pop eax
jne 0x40623c
pop ebx
inc edx
jmp fcn.0040647c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x406245
dec edx
push edx
xor edx, edx
call fcn.0040647c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.00405f98
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040627c
ret
Function at 0x406d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x9c], edx
push eax
pop edi
xor eax, eax
push ebp
push 0x406dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x97]
push eax
push 0x97
call sub.kernel32.dll_GetLogicalDriveStringsA
xor ebx, ebx
jmp 0x406dd5
push ebx
pop esi
and esi, 0xff
lea eax, [ebp + esi - 0x97]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x41
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x42
je 0x406dd2
lea eax, [ebp - 0x9c]
mov dl, byte [ebp + esi - 0x97]
call fcn.004031b4
mov edx, dword [ebp - 0x9c]
push edi
pop eax
call fcn.00403214
add bl, 4
xor eax, eax
mov al, bl
cmp byte [ebp + eax - 0x97], 0
jne 0x406d79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e03
lea eax, [ebp - 0x9c]
call fcn.00403094
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push eax
pop esi
mov eax, dword [0x409214]
mov dword [eax], ecx
push edx
pop ebx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x407bd4
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0x407bdd
mov eax, dword [ebp - 4]
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0xa214], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407d8d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa214]
mov edx, 0x4091c0
mov ecx, 3
call fcn.004031f4
mov edx, dword [ebp - 0xa214]
mov eax, dword [ebp - 4]
call fcn.00406fe4
test al, al
je 0x407d6c
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0040258c
add al, 0xbf
sub al, 2
jb 0x407d6c
sub al, 0x19
je 0x407d6c
mov eax, dword [ebp - 4]
call fcn.00407ad0
mov eax, dword [ebp - 4]
call fcn.00407130
test al, al
je 0x407d6c
mov eax, dword [ebp - 4]
call fcn.0040340c
push eax
pop ebx
push ebx
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
test dword [ebp - 8], 1
jbe 0x407c95
push 0
push ebx
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00405b84
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x407d4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040597c
push eax
pop edx
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405974
lea edx, [ebp - 0xa210]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.00405988
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x9d3e]
mov ecx, 4
call fcn.0040254c
lea eax, [ebp - 0xa210]
mov ecx, dword [ebp - 0x10]
mov edx, 0x3e8
call fcn.00407080
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405974
lea edx, [ebp - 0xa210]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.0040598c
mov eax, dword [ebp - 0xc]
call fcn.0040597c
push eax
pop edx
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d51
mov eax, dword [ebp - 0xc]
call fcn.00404520
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d94
lea eax, [ebp - 0xa214]
call fcn.00403094
lea eax, [ebp - 4]
call fcn.00403094
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
push eax
pop esi
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
push ebx
pop eax
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
push ebx
pop eax
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
push ebx
pop eax
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40288e
pop dword [ebp - 0x18]
mov eax, 0x40288e
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x26c48b3a
sub dword [ebp - 0x28], 0xd87245ef
mov dword [ebp - 0x24], 0x468cdb23
sub dword [ebp - 0x24], 0x14598ede
mov dword [ebp - 0x20], 0x74e2ccf4
sub dword [ebp - 0x20], 0x289688c6
mov dword [ebp - 0x1c], 0xb021b1f9
add dword [ebp - 0x1c], 0x4fde4e07
lea eax, [ebp - 0x28]
push eax
mov eax, 0xdfa1fd76
add eax, 0x209e72ee
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x5ff84651
add dword [ebp - 0x28], 0x147a2305
mov dword [ebp - 0x24], 0x217f7eb3
add dword [ebp - 0x24], 0x1fece2c2
mov dword [ebp - 0x20], 0xb91d6f8a
sub dword [ebp - 0x20], 0x55ae031e
mov dword [ebp - 0x1c], 0xbeb16db
add dword [ebp - 0x1c], 0xf414e925
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x8709a408
sub eax, 0x86c93360
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x36f62
push 0
call eax
mov ecx, 0xad083452
sub ecx, 0xad07eadc
xor ebx, ebx
add ebx, eax
mov edx, 0x744f8ccf
add edx, 0x8bf17331
add edx, dword [ebp - 0x18]
mov edi, 0xf2ef8652
add dword [ebp - 0xc], 0x40671ebd
mov esi, dword [edx]
add dword [ebp - 8], edx
add esi, edi
mov dword [ebx], esi
xor dword [ebp - 0x10], ebx
add ebx, 4
add edx, 4
loop 0x4029a7
add eax, 0x7d169857
add eax, 0x82ea8054
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.2581571f
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.2581571f
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.2581571f
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.2581571f
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.2581571f
pop ecx
jmp 0x258071e5
Function at 0x2581571f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x2581572e
pop dword [ebp - 0x38]
mov eax, 0x2581572e
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x7b1ac31f
add dword [ebp - 0x48], 0xd337822c
mov dword [ebp - 0x44], 0xa83360ea
sub dword [ebp - 0x44], 0x760014a5
mov dword [ebp - 0x40], 0x82db0b0
add dword [ebp - 0x40], 0x441e937e
mov dword [ebp - 0x3c], 0x578c48fc
sub dword [ebp - 0x3c], 0x578c48fc
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x2cadc9c8
add dword [ebp - 0x48], 0x47c49f8e
mov dword [ebp - 0x44], 0xdb03cda3
add dword [ebp - 0x44], 0x666893d2
mov dword [ebp - 0x40], 0xb1cabd1
sub dword [ebp - 0x40], 0xa7ad3f65
mov dword [ebp - 0x3c], 0x71ee8f75
sub dword [ebp - 0x3c], 0x71ee8f75
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3beb3
push 0
call eax
mov ecx, 0x4548
mov esi, eax
mov edx, 0x187f5a3
add edx, 0x23faa05d
add edx, dword [ebp - 0x38]
mov edi, 0xa31edbf2
sub edi, 0xd814a456
xor dword [ebp - 0x28], edx
mov ebx, dword [edx]
sub ebx, edi
add dword [ebp - 0xc], 0xf82b26e9
mov dword [esi], ebx
mov dword [ebp - 0x14], 0x7027162
add esi, 0x157f6bfa
add esi, 0xea80940a
add edx, 0xba67e2ca
sub edx, 0xba67e2c6
loop 0x2581583b
add eax, 0x1e45be00
add eax, 0xe1bb49f3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x25800000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1039bc90
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1039bce4
not ecx
bswap ecx
jmp 0x1039bcf3
add esp, 3
js 0x1039bcce
not ecx
bswap ecx
jmp 0x1039bd25
lea esp, [esp + 1]
jmp 0x1039bd0f
inc esi
dec dx
jl 0x1039bd2b
mov ax, sp
mov ah, bh
rdtsc
jmp 0x1039bd38
lea esp, [esp + 1]
jmp 0x1039bd0f
mov ax, sp
jmp 0x1039bd34
mov ah, bh
rdtsc
xor esi, 0x374ef4ec
jmp 0x1039bd77
mov ch, byte [esp]
lea edx, reloc.KERNEL32.dll_GetFileSizeEx
xchg dx, cx
sub esp, 0x1f
jb 0x1039bd61
jae 0x1039ca6e
xchg dword [esp + 0x12], ecx
lea esp, [esp + 3]
jmp 0x1039bd8e
Function at 0x103a04c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esp
mov dword [esp], esp
mov byte [esp + 4], dh
push word [esp + 3]
jb 0x103a0495
jae 0x103a047b

Function at 0x103a7f89
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1038df4b
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1038df65
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1038df54
pop esi
jmp 0x1038df70
ret 4
lea esp, [esp + 2]
mov dword [esp], edx
mov esi, ebx
jmp 0x103a7f5e
pop ebx
mov esi, 0x57b4ef66
mov dh, 7
pushfd
mov byte [esp + 2], bl
jmp 0x103a7f45
push ebx
mov si, sp
lea esi, [edx + esi]
mov ebx, dword [esp]
xchg si, bx
mov dh, byte [esp]
jmp 0x103a7f1d
mov dl, byte [esp + 1]
mov byte [esp], ah
call 0x103a7f89
push ebp
les esi, [edi + 0x5e]
push ebp
dec ecx
mov edi, 0x40e185a
je 0x103a7f7e
mov edx, dword [esp]
mov esi, 0x1d16713b
xchg edx, esi
mov dx, word [esp]
mov esi, dword [esp]
mov dl, dh
jmp 0x103a7f33
mov si, 0xebee
push si
lea esp, [esp + 2]
mov esi, dword [esp + 0xc]
jmp 0x103a8090
je 0x103a7fa4
or al, 0xe9
or al, byte [ecx]
add byte [eax], al
fbld tbyte [esi]
push ecx
push di
mov esi, dword [esp + 7]
lea esp, [esp + 2]
mov edx, dword [esp + 8]
jmp 0x103a7f73
cmp al, 0xe8
lea esp, [esp + 0x10]
jmp 0x1038df3e

Function at 0x103b1b51
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x103b1c70
sub esp, 0x1f
jmp 0x103b1baf
lea esp, [esp + 2]
jmp 0x103b1bcd
mov byte [esp + 0xc], bh
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
call fcn.103b1b99
dec ebp
lds edx, [ebp + 0x3c]
iretd
lea esp, [esp + 2]
sub ecx, edx
jge 0x103b1b7c
sub esp, 0x1f
mov byte [esp + 0xc], bh
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
jmp 0x103b1bbb
and cl, 0xfc
push dx
clc
jo 0x103b1bc9
jno 0x103b1b93
call fcn.103b1cb1
lea esp, [esp + 4]
popal
jmp 0x103b2386
lea esp, [esp + 4]
jmp 0x103b1d8a
je 0x103b1d80
lea edi, [edx + edi]
mov edi, dword [esp]
jmp 0x103b1d04
lea edi, [edx + edi]
mov edi, dword [esp]
lea esp, [esp + 4]
pop esi
popfd
jmp 0x1039c81a
rep movsb byte es:[edi], byte [esi]
pop ecx
bt di, ax
jmp 0x103b1d3c
pushal
mov dword [esp + 0x18], edx
popal
cld
jmp 0x103b1e41

Function at 0x103b1b99
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x103b1c36
mov dword [esp], edx
mov esp, ecx
pushfd
call fcn.103b1be2
mov esi, eax
jmp 0x103b1ca0
pushal
mov dword [esp], ecx
stc
jp 0x103b1c82
jnp 0x103b1c82
sub bh, byte [ecx + 0xfbb4829]
sbb byte [ebx - 0x7d], bh
sub esp, 0
jmp 0x103b1cba
push edx
int 0x5c
scasd eax, dword es:[edi]
jg 0x103b1c87
lea esp, [esp + 4]
popal
jmp 0x103b2386

Function at 0x103b1cb1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x103b1c36
mov dword [esp], edx
mov esp, ecx
pushfd
call fcn.103b1be2
mov esi, eax
jmp 0x103b1ca0
pushal
mov dword [esp], ecx
stc
jp 0x103b1c82
jnp 0x103b1c82
sub bh, byte [ecx + 0xfbb4829]
sbb byte [ebx - 0x7d], bh
sub esp, 0
jmp 0x103b1cba
push edx
int 0x5c
scasd eax, dword es:[edi]
jg 0x103b1c87
lea esp, [esp + 4]
popal
jmp 0x103b2386
Function at 0x10484623
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x104846b2
mov dl, 0x6a
not bh
setle cl
mov si, bx
xchg dx, bx
jmp 0x10484692
rol ecx, cl
lea eax, reloc.KERNEL32.dll_GetFileSizeEx
mov bp, word [esp]
stc
mov di, si
pushfd
jmp 0x10484669
mov bl, byte [esp + 1]
rdtsc
setbe dh
rcr edi, 0x1a
inc ebx
bsf edi, ebx
jmp 0x104846c5
xchg byte [esp + 1], al
mov cl, byte [esp]
neg ecx
neg cl
pop word [esp]
pop dx
jmp 0x1048467f
lea esp, [esp + 1]
pop edx
bsr edx, ebp
sub esp, 0xc
pushal
lea esp, [esp + 8]
jmp 0x1048470b
xchg bl, al
dec eax
setle bh
cpuid
lea esi, reloc.KERNEL32.dll_GetFileSizeEx
xchg dx, ax
jmp 0x10484733
xchg bp, di
pushal
lea esp, [esp + 0x44]
xchg edx, edi
lea esi, [esp + ebp]
xchg bp, bx
jmp 0x104846f5
cmc
bsf cx, bx
lea edx, [esi*4]
add esp, 1
jmp 0x10484746
bswap eax
sub esp, 3
cld
rdtsc
lea edi, [esp + ebx]
lea ebx, reloc.KERNEL32.dll_GetFileSizeEx
jmp 0x1048471d
mov ebx, dword [esp]
mov ebx, dword [esp]
stc
xchg byte [esp], cl
xchg word [esp], di
mov eax, 0xcd2d6d39
jmp 0x10484ee2
mov dh, 0x40
sub esp, 0x11
mov bl, byte [esp + 0xe]
lea edx, [ebx*4]
xchg dword [esp + 5], eax
lea esp, [esp + 0xe]
call fcn.10484d81
push di
mov dword [esp + 2], esi
mov dword [esp + 1], edi
lea esp, [esp + 1]
mov byte [esp + 0xb], ch
jmp 0x10484f3f
pop word [esp + 4]
mov word [esp + 5], dx
push dword [esp + 6]
call fcn.1048534e
insb byte es:[edi], dx
jg 0x10484f85
pop dword [esp + 2]
mov dword [esp + 3], ebx
mov word [esp + 2], di
lea esp, [esp + 1]
push dword [esp + 9]
jmp 0x10484f29
or dword [esi + reloc.KERNEL32.dll_GetFileSizeEx], esp
int 0xce

Function at 0x10484afb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0xe]
pop word [esp + 0xa]
mov ebp, esi
jmp 0x10484b7a
xchg byte [esp + 0xb], dl
bt esi, edx
lea esp, [esp + 7]
pop edi
mov bh, 0x71
std
jmp 0x10484b22
shl ax, cl
bt esi, edi
pop cx
cmc
push word [esp + 4]
mov ecx, eax
jmp 0x10484b38
Function at 0x1000ecef
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000ecfb
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000ed23
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000ed09
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x4010d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010e9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401124
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401120
lea ebx, [ebx]
cmp esi, edx
jae 0x401124
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x401110
cmp esi, edx
jb 0x40112b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408300
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
push edi
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edx, dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x18]
call fcn.004084e0
lea ecx, [esp + 0x20]
call fcn.00401920
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [section..data]
mov ecx, section..data
mov esi, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push esi
push dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
call fcn.0040ca90
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
jne 0x408390
cmp dword [0x43aa3c], 1
jl 0x408389
lea ecx, [esp + 0x10]
call fcn.004084f0
mov esi, 1
jmp 0x4083b2
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00403e40
lea ecx, [esp + 0x38]
call fcn.00404080
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00408430
mov edi, dword [esp + 0x10]
add edi, 0xfffffff0
or edx, 0xffffffff
lea ecx, [edi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4083d0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x20]
call fcn.004026f0
lea ecx, [esp + 0x2c]
call fcn.00402210
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40840b
push eax
call fcn.00416712
add esp, 4
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
cmp byte [esp + 0x18], 0
jne 0x408416
call dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10