joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4725b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 7
jb 0x4725b4
pop esi
mov byte [ecx + 0xb], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472630
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x2f
jb 0x472634
pop esi
mov byte [ecx + 0x33], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x4726c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x42
jb 0x4726c4
pop esi
mov byte [ecx + 0x46], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x4726f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 7
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472700
mov byte [edi + 0xb], 0
pop edi
pop esi
pop ebx
ret

Function at 0x472740
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x5d
jb 0x472744
pop esi
mov byte [ecx + 0x61], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x49
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472780
mov byte [edi + 0x4d], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4727a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x45
jb 0x4727a4
pop esi
mov byte [ecx + 0x49], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x4727f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x27
jb 0x4727f4
pop esi
mov byte [ecx + 0x2b], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472820
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x25
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472830
mov byte [edi + 0x29], 0
pop edi
pop esi
pop ebx
ret

Function at 0x472850
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x39
jb 0x472854
pop esi
mov byte [ecx + 0x3d], 0
lea eax, [ecx + 4]
pop ebx
ret
Function at 0x472880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x3b
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472890
mov byte [edi + 0x3f], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4728b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x3d
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x4728c0
mov byte [edi + 0x41], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4728e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x3d
jb 0x4728e4
pop esi
mov byte [ecx + 0x41], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472910
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x48
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472920
mov byte [edi + 0x4c], 0
pop edi
pop esi
pop ebx
ret

Function at 0x472940
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x54
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472950
mov byte [edi + 0x58], 0
pop edi
pop esi
pop ebx
ret

Function at 0x472990
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x1a
jb 0x472994
pop esi
mov byte [ecx + 0x1e], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x4729e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x4f
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x4729f0
mov byte [edi + 0x53], 0
pop edi
pop esi
pop ebx
ret

Function at 0x472a10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x4f
jb 0x472a14
pop esi
mov byte [ecx + 0x53], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472a40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x5a
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472a50
mov byte [edi + 0x5e], 0
pop edi
pop esi
pop ebx
ret
Function at 0x473020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x47304c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x473074
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x47307a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4730e2
jg 0x473091
test esi, esi
je 0x4730e2
test ecx, ecx
jl 0x4730dd
jg 0x47309b
test eax, eax
je 0x4730dd
cmp edi, ecx
jg 0x4730af
jl 0x4730a5
cmp esi, eax
jae 0x4730af
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4730e5
mov ecx, dword [ebp + 8]
jmp 0x4730ef
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x473109
jg 0x4730ef
test esi, esi
je 0x473109
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x473109
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x473120
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x47314c
jl 0x473140
test ecx, ecx
jne 0x47314c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x473165
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x4731b3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x4731b9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x4731b9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x473226
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4731e2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x473214
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x473226
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x4731f0
test edi, edi
je 0x473226
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x473580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x49d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4735b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4735e0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x4735e0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x4736b8
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x473609
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x473615
movsx eax, bl
jmp 0x47364d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x473677
sub eax, 1
je 0x473677
sub eax, 2
jne 0x4736b8
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x473695
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4736b8
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476b4c
mov esp, ebp
pop ebp
ret 4

Function at 0x473820
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 6
jb 0x473824
pop esi
mov byte [ecx + 0xa], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x473890
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0xb
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x4738a0
mov byte [edi + 0xf], 0
pop edi
pop esi
pop ebx
ret
Function at 0x474840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4748fc
cmp byte [esi + 0x3d], 0
je 0x4748fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4748ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4748b1
sub eax, 1
je 0x4748b5
sub eax, 2
jne 0x4748ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4748d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4748ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
Function at 0x476880
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4768de
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4768a0
mov eax, dword [edi]
jmp 0x4769c9
cmp eax, 0x4e0
jb 0x4769c9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x476900
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x476950
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47764b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x47768a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47768a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47768a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x47768a
cmp dword [ecx + 0x74], 0xe
jbe 0x47768a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5c330d56
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5ac6211e
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [str.TULingBiuBiubiu_]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xc], 0x38262140
xor edi, edi
mov word [ebp - 8], 0x3838
movups xmmword [ebp - 0x1c], xmm0
xor ecx, ecx
mov dword [ebp - 4], 0x6d9
nop
movsx eax, byte [ebp + edi - 0x1c]
mov esi, ecx
cdq
idiv dword [ebp - 4]
mov eax, 0xba2e8ba3
add dl, 0x4f
xor byte [ebx + ecx], dl
mul ecx
inc ecx
shr edx, 4
imul eax, edx, 0x16
lea edx, [edi + 1]
xor edi, edi
cmp esi, eax
cmovne edi, edx
cmp ecx, 0x40000
jb 0x100011b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100011f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 2
mov dword [ebp - 0x334], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x338], eax
push ecx
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10001311
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
mov dword [ebp - 0x340], str.ToolsX64.exe
mov dword [ebp - 0x33c], str.StatusCheckerTask.exe
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push 0
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0
call ebx
xor esi, esi
nop dword [eax]
mov eax, dword [ebp + esi*4 - 0x340]
lea ecx, [ebp - 0x108]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100012c0
test dl, dl
je 0x100012bc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100012c0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100012a0
xor eax, eax
jmp 0x100012c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100012d3
inc esi
cmp esi, 2
jl 0x10001290
xor cl, cl
jmp 0x100012d5
mov cl, 1
test cl, cl
lea eax, [edi + 1]
cmove eax, edi
mov edi, eax
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 0x338]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001252
pop esi
cmp edi, 2
pop ebx
setge al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000164b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.1000164b
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x762f3c01
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x79ff5909
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403d23
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403d62
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403d62
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403d62
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403d62
cmp dword [ecx + 0x74], 0xe
jbe 0x403d62
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret