joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407120
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x2c
movzx edx, word [edx]
test dx, dx
je 0x40729e
mov esi, eax
mov eax, edi
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x407140
mov ecx, eax
sub ecx, edi
sar ecx, 1
cmp edi, eax
je 0x40729e
mov eax, edi
xor ebx, ebx
lea esi, [esi]
nop
cmp dx, 0xa
sete dl
add eax, 2
movzx edx, dl
add ebx, edx
movzx edx, word [eax]
test dx, dx
jne 0x407160
cmp word [eax - 2], 0xa
mov dword [ebp - 0x1c], ebx
je 0x407187
add ebx, 1
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
add ecx, dword [esi + 0x204]
mov eax, dword fs:[0x18]
lea edx, [ecx + ebx*4 + 1]
add edx, edx
mov dword [esp + 0xc], edx
mov edx, dword [esi]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov dword [esi], eax
sub esp, 0x10
test ebx, ebx
je 0x40729e
lea esi, [esi]
movzx eax, word [edi]
mov ecx, edi
cmp ax, 0xa
je 0x4071f0
test ax, ax
je 0x4071f0
movzx eax, word [edi + 2]
add edi, 2
cmp ax, 0xa
jne 0x4071db
lea esi, [esi]
sub dword [ebp - 0x1c], 1
test ax, ax
jne 0x4072b0
cmp word [ecx], 0
mov eax, ecx
je 0x4072f0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x407210
sub eax, ecx
mov edx, eax
sar edx, 1
lea ebx, [edx + 4]
mov dword [ebp - 0x20], ebx
mov edx, dword [esi]
mov ebx, dword [esi + 0x204]
mov word [edx + ebx*2], 0x20
mov edx, dword [esi]
mov ebx, dword [esi + 0x204]
mov word [edx + ebx*2 + 2], 0x20
mov edx, dword [esi]
mov ebx, dword [esi + 0x204]
mov word [edx + ebx*2 + 4], 0x20
mov edx, dword [esi]
mov ebx, dword [esi + 0x204]
mov word [edx + ebx*2 + 6], 0x20
mov ebx, dword [esi + 0x204]
mov edx, dword [esi]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
lea edx, [edx + ebx*2 + 8]
mov dword [esp], edx
call sym._memcpy
mov edx, dword [esi]
mov ebx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
add eax, dword [esi + 0x204]
mov dword [esi + 0x204], eax
mov word [edx + eax*2], cx
test ebx, ebx
jne 0x4071d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
mov word [edi], bx
cmp word [ecx], 0
je 0x407300
mov eax, ecx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4072c0
sub eax, ecx
mov edx, eax
lea eax, [eax + 2]
sar edx, 1
lea ebx, [edx + 5]
mov dword [ebp - 0x20], ebx
mov edx, 0xa
add edi, 2
mov word [edi - 2], dx
jmp 0x407225
mov dword [ebp - 0x20], 4
xor eax, eax
jmp 0x407225
mov dword [ebp - 0x20], 5
mov eax, 2
jmp 0x4072d8
Function at 0x4073e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x2c
cmp word [edx], 0
je 0x407470
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4073f8
sub eax, edi
mov ebx, eax
add eax, 2
mov dword [ebp - 0x1c], eax
sar ebx, 1
mov ecx, dword [esi + 0x204]
mov eax, dword fs:[0x18]
add ecx, ebx
lea ecx, [ecx + ecx + 2]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov ecx, dword [esi + 0x204]
mov edx, dword [ebp - 0x1c]
mov dword [esi], eax
sub esp, 0x10
lea eax, [eax + ecx*2]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._memcpy
add dword [esi + 0x204], ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x1c], 2
xor ebx, ebx
jmp 0x40740d
Function at 0x407a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
mov ebx, edx
lea edx, [ebp - 0x22c]
mov eax, ebx
sub esp, 0x24c
mov word [ebp - 0x21c], cx
mov dword [ebp - 0x22c], 0x790074
mov dword [ebp - 0x228], 0x650070
mov dword [ebp - 0x224], 0x650064
mov dword [ebp - 0x220], 0x200066
mov dword [ebp - 0x23c], 0x750070
mov dword [ebp - 0x238], 0x6c0062
mov dword [ebp - 0x234], 0x630069
mov word [ebp - 0x230], di
call dbg.AddToTLDataStrW
mov eax, dword [0x4159ec]
cmp dword [esi], eax
je 0x407b78
mov edx, 0x40f440
mov eax, ebx
lea edi, [ebp - 0x218]
call dbg.AddToTLDataStrW
mov edx, str.uuid
mov eax, ebx
call dbg.AddToTLDataStrW
mov edx, 0x40f444
mov eax, ebx
call dbg.AddToTLDataStrW
mov dword [esp + 8], 0x100
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._StringFromGUID2_12
sub esp, 0xc
cmp word [ebp - 0x218], 0
je 0x407be0
mov eax, edi
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x407b28
sub eax, edi
sar eax, 1
sub eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x218], dx
lea edx, [ebp - 0x216]
mov eax, ebx
call dbg.AddToTLDataStrW
mov edx, 0x40f448
mov eax, ebx
call dbg.AddToTLDataStrW
cmp dword [esi + 0x28], 6
je 0x407bc0
mov edx, 0x40f452
mov eax, ebx
call dbg.AddToTLDataStrW
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4159f0]
cmp dword [esi + 4], eax
jne 0x407ad2
mov eax, dword [0x4159f4]
cmp dword [esi + 8], eax
jne 0x407ad2
mov eax, dword [0x4159f8]
cmp dword [esi + 0xc], eax
jne 0x407ad2
cmp dword [esi + 0x28], 6
jne 0x407b6d
mov edx, 0x40f440
mov eax, ebx
call dbg.AddToTLDataStrW
jmp 0x407bcc
mov edx, 0x40f44c
mov eax, ebx
call dbg.AddToTLDataStrW
lea edx, [ebp - 0x23c]
mov eax, ebx
call dbg.AddToTLDataStrW
jmp 0x407b61
mov eax, 0xffffffff
jmp 0x407b38
Function at 0x40cc50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40ccab
cmp byte [esi + ebx - 1], 0xa
je 0x40cc7f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x416924], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40d200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x416934]
mov esi, dword [ebp + 8]
test edi, edi
je 0x40d3c0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x416934]
movzx eax, al
bt eax, esi
jae 0x40d420
mov ecx, dword [0x416924]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x40d2c6
test byte [0x40e2e8], 8
jne 0x40d360
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x40e2f8], 8
jne 0x40d310
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40d295
cmp esi, 3
jbe 0x40d2d0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x415a9c]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x40d295
mov ecx, dword [0x416934]
test ecx, ecx
je 0x40d400
mov dword [esp], 0x40e2f8
call dword [0x416934]
test al, 8
je 0x40d26c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x40d26c
mov ebx, dword [0x416934]
test ebx, ebx
je 0x40d3e0
mov dword [esp], 0x40e2e8
call dword [0x416934]
test al, 8
je 0x40d259
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x40d25f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x416934
call sym._load_func.part.0
jmp 0x40d220
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x416934
call sym._load_func.part.0
jmp 0x40d36a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x416934
call sym._load_func.part.0
jmp 0x40d31e
mov eax, 0xffffffff
jmp 0x40d2c6
Function at 0x40d590
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x40d650
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40d6be
xor ecx, ecx
xor edx, edx
jmp 0x40d696
cmp al, 0x5c
jne 0x40d718
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x40d6b3
cmp al, 9
je 0x40d69e
cmp al, 0x20
jne 0x40d680
test ecx, ecx
je 0x40d6b3
xor edx, edx
jmp 0x40d68b
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40d6b0
cmp al, 0x20
je 0x40d6b0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x40d6d9
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
jne 0x40d6a2
and edx, 1
jne 0x40d6a2
xor ecx, 1
jmp 0x40d68b
Function at 0x100021f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
cmp dword [esp + 0x6c], 0xf
lea ecx, [esp]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x44
push ecx
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
lea eax, [esp + 0x70]
cmova eax, dword [esp + 0x70]
push 0
push 0
push 0
push eax
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movups xmmword [esp + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x6c]
cmp ecx, 0xf
jbe 0x10002291
mov edx, dword [esp + 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002287
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002297
push ecx
push edx
call fcn.100023e7
add esp, 8
mov al, 1
add esp, 0x54
ret
call fcn.10005700
int3

Function at 0x1000629f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100062de
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100062de
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100062de
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100062de
cmp dword [ecx + 0x74], 0xe
jbe 0x100062de
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100093a0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000943d
push ebx
push esi
call fcn.10009369
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100092fd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100093ea
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000943c
push edi
push eax
call fcn.10007dd0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000940a
call fcn.10007e1e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000943b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100092fd
add esp, 0x20
test eax, eax
jne 0x10009429
push edi
call fcn.10007e1e
jmp 0x10009431
push ebx
call fcn.10007e1e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10009aab
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012998
push 0x10012990
push str.FlsAlloc
push 0x1f
call fcn.1000996a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009adf
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010120]
call esi
jmp 0x10009ae5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10009b29
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100129a8
push 0x100129a0
push str.FlsGetValue
push 0x21
call fcn.1000996a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009b60
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10009b68
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100129b0
push 0x100129a8
push str.FlsSetValue
push 0x22
call fcn.1000996a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009ba2
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10010120]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000fb40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000fb6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000fb6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.1003984e
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.1003984e
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.1003984e
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x10001710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10006bd1
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea ecx, [esi + 0xe]
mov dword [esi + 0xc], eax
mov dword [esi], ecx
mov dword [esp + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
lea edx, [esi + 0x1e]
mov cl, 1
mov dword [esi + 0x10], edx
mov byte [esi + 0x1d], cl
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea edx, [esi + 0x2e]
mov dword [esi + 0x20], edx
mov byte [esi + 0x2d], cl
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea edx, [esi + 0x3e]
mov dword [esi + 0x30], edx
mov byte [esi + 0x3d], cl
push 0x100017d0
push 0x100016e0
mov byte [esp + 0x18], 3
push 0x14
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov byte [esi + 0x48], al
mov byte [esi + 0x49], al
push 0x24
lea eax, [esi + 0x12c]
push eax
call fcn.10005f58
mov byte [esp + 0x10], 4
call section..text
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x10001810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10006b39
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x100017d0
push 0x14
push 0x24
lea eax, [esi + 0x12c]
push eax
mov dword [esp + 0x24], 3
call fcn.1000601c
mov eax, dword [esi + 0x30]
lea edi, [esi + 0x3e]
cmp eax, edi
je 0x1000186d
test eax, eax
je 0x1000186a
push eax
call sub.msvcrt.dll_free
add esp, 4
mov dword [esi + 0x30], edi
mov eax, dword [esi + 0x20]
lea edx, [ebp - 0x75]
push ebp
mov ebp, esp

Function at 0x10006710
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x10006723
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000671f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x10006740
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1000677f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10006775
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10006781
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10006765
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194

Function at 0x427432
Capabilities:
Encode data using xor

Disassembly:
pop ebp
clc
pushal
lea edi, [ebp + 0x42]
mov si, 0x256
cld
mov cl, byte [edi]
xor cl, 0x59
rol cl, 0xc4
xor cl, 0x18
mov byte [edi], cl
inc edi
dec si
jne 0x42743d
jmp 0x427495
fmul st(0)
fdivr dword [esi + 0x7d0c6bc0]
invalid