joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b30b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x411796], 0
jne 0x40b344
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x40b328
shr eax, 1
xor eax, 0xedb88320
jmp 0x40b32a
shr eax, 1
dec edx
jne 0x40b31b
mov dword [ecx*4 + 0x411ed8], eax
inc ecx
cmp ecx, 0x100
jb 0x40b316
mov byte [0x411796], 1
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x40b370
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x411ed8]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x40b34f
not eax
ret 8

Function at 0x40b375
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov cl, byte [eax + 0x100]
push edi
mov byte [ebp - 1], cl
mov cl, byte [eax + 0x101]
xor edi, edi
mov byte [ebp - 2], cl
cmp dword [ebp + 0xc], edi
jbe 0x40b3d1
push ebx
push esi
add byte [ebp - 1], 5
movzx ecx, byte [ebp - 1]
lea esi, [ecx + eax]
mov dl, byte [esi]
add byte [ebp - 2], dl
movzx ecx, byte [ebp - 2]
add ecx, eax
mov bl, byte [ecx]
mov byte [esi], bl
mov byte [ecx], dl
movzx esi, byte [esi]
mov ecx, dword [ebp + 8]
movzx edx, dl
add esi, edx
and esi, 0xff
mov dl, byte [esi + eax]
add ecx, edi
xor byte [ecx], dl
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x40b395
pop esi
pop ebx
mov cl, byte [ebp - 1]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 2]
mov byte [eax + 0x101], cl
pop edi
leave
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1ada1d3b
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0xd110c54
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x40de38
nop
mov ecx, 0x1f9b4c95
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x4304d8
nop
mov ecx, 0x4d5a371a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x93f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x93f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x93f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93f06a
add dl, dl
jne 0x93f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93f0dc
xor eax, eax
add dl, dl
jne 0x93f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93f17d
add dl, dl
jne 0x93f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x93f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x93f075
mov eax, 1
add dl, dl
jne 0x93f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93f0e1
sub eax, ebx
mov ebx, 1
jne 0x93f128
mov ecx, 1
add dl, dl
jne 0x93f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x93f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93f136
cmp eax, 0x7d00
jae 0x93f16d
cmp eax, 0x500
jb 0x93f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93f075
cmp eax, 0x7f
ja 0x93f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x93f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x93f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x28d37721
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x3570103d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x408d51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408d8f
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408d96
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c6a8
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x408f64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43a424], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x408fa1
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408f7e
mov dword [ecx*4 + 0x43a420], eax
inc ecx
cmp ecx, 0x100
jne 0x408f77
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408fc4
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a420]
jmp 0x408fab
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x29840a5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x29840a69
pop dword [ebp - 0x40]
mov eax, 0xe3713ed9
sub eax, 0xb9ed3470
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb8d6f021
add dword [ebp - 0x50], 0x957b552a
mov dword [ebp - 0x4c], 0x32668046
sub dword [ebp - 0x4c], 0x333401
mov dword [ebp - 0x48], 0x7169bcd3
sub dword [ebp - 0x48], 0x251d78a5
mov dword [ebp - 0x44], 0xd6c6dc6b
add dword [ebp - 0x44], 0x29392395
lea eax, [ebp - 0x50]
push eax
mov eax, 0x14308fa9
add eax, 0x1554f117
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x554508a3
sub dword [ebp - 0x50], 0xe0d29f4d
mov dword [ebp - 0x4c], 0xd58a852e
add dword [ebp - 0x4c], 0x6be1dc47
mov dword [ebp - 0x48], 0xfa6fe891
add dword [ebp - 0x48], 0x68ff83db
mov dword [ebp - 0x44], 0xe977fa42
sub dword [ebp - 0x44], 0xe977fa42
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe8c5f225
sub eax, 0xbf40716d
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4a247
push 0
call eax
mov ecx, 0xda454dcb
add ecx, 0x25bb027f
xor edi, edi
add edi, eax
mov ebx, 0x29897400
add ebx, dword [ebp - 0x40]
mov edx, 0xf637af8b
add edx, 0x75fea029
mov esi, dword [ebx]
add dword [ebp - 0x30], 0x2a855c7d
sub esi, edx
xor dword [ebp - 8], eax
mov dword [edi], esi
mov dword [ebp - 0x2c], 0xe54a47c3
add edi, 0xa7564ee
add edi, 0xf58a9b16
add ebx, 0xfa349836
sub ebx, 0xfa349832
loop 0x29840b87
add eax, 0x133fb
xor ebx, ebx
add ebx, eax
add eax, 0xc50e0a80
sub eax, 0xc50e0a7b
mov ecx, 0x61c1273
sub ecx, 0xdc9c1273
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, reloc.msvcrt.dll_srand
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x10009276
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94c
mov eax, dword [0x10046040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100119dd
test eax, eax
js 0x10009504
push 0x104
lea eax, [ebp - 0x13c]
push eax
push dword [0x1004603c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov edi, 0x100012dc
push edi
lea eax, [ebp - 0x34]
push 0x2d
push eax
call fcn.1001a3d3
add esp, 0xc
xor ebx, ebx
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001354
push 2
push 0x10003584
mov byte [ebp - 0x2f], 0x5c
call fcn.1001a3d3
test eax, eax
je 0x100092f3
mov eax, 0x80040201
jmp 0x10009504
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x1000136c
push 3
push 0x10003234
call fcn.1001a3d3
test eax, eax
jne 0x100092e9
push 1
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001388
push 4
mov esi, 0x10003304
push esi
call fcn.1001a3d3
test eax, eax
jne 0x100092e9
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 5
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009357
mov byte [ebp - 0x93c], al
lea eax, [ebp - 0x93c]
push eax
push 0
push 0
push 0x100013a4
call fcn.1001a3d3
test eax, eax
jne 0x100092e9
lea eax, [ebp - 0x2e]
push eax
push esi
call fcn.1001a3d3
lea eax, [ebp - 0x2e]
push eax
push edi
push 0
push 0x100013a4
call fcn.1001a3d3
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013c0
push 6
push 0x10003434
call fcn.1001a3d3
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013dc
push 7
push 0x10003444
call fcn.1001a3d3
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013fc
push 9
push 0x10003454
call fcn.1001a3d3
test eax, eax
jne 0x100092e9
push 0x10001424
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x944], eax
mov dword [ebp - 0x94c], eax
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
lea eax, [ebp - 0x940]
push eax
push 1
push 0
push 0x10001434
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009502
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x944]
push eax
push 0
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
mov eax, dword [ebp - 0x944]
inc eax
add eax, esi
mov dword [ebp - 0x944], eax
call fcn.10009f0e
mov esi, esp
test esi, esi
je 0x10009502
lea eax, [ebp - 0x94c]
push eax
push esi
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
push dword [ebp - 0x940]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10001424
push dword [ebp - 0x944]
push esi
call fcn.1001a3d3
push 0x10001450
lea eax, [ebp - 0x13c]
push 0x106
push eax
call fcn.1001a3d3
add esp, 0xc
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 1
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009502
mov eax, 0xc7ce0017
jmp 0x10009504
xor eax, eax
lea esp, [ebp - 0x958]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009f00
leave
ret
Function at 0x10009bb9
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10042958
call fcn.1000aecb
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10009c47
call fcn.1000ae99
test eax, eax
jne 0x10009bdd
xor eax, eax
jmp 0x10009d13
call fcn.1000a293
test eax, eax
jne 0x10009bed
call fcn.1000aeb7
jmp 0x10009bd6
call fcn.1000ae4d
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10049d38], eax
call fcn.1001a3d3
mov dword [0x10048aa4], eax
call fcn.1001a3d3
test eax, eax
jns 0x10009c17
call fcn.10009f6a
jmp 0x10009be6
call fcn.1001a3d3
test eax, eax
js 0x10009c40
call fcn.1000aa85
test eax, eax
js 0x10009c40
push 0
call fcn.1001a3d3
pop ecx
test eax, eax
jne 0x10009c40
inc dword [0x10048aa0]
jmp 0x10009d10
call fcn.1000aa32
jmp 0x10009c10
xor edi, edi
cmp eax, edi
jne 0x10009ca6
cmp dword [0x10048aa0], edi
jle 0x10009bd6
dec dword [0x10048aa0]
mov dword [ebp - 4], edi
cmp dword [0x10048ad8], edi
jne 0x10009c6b
call fcn.1000a7c0
cmp dword [ebp + 0x10], edi
jne 0x10009c7f
call fcn.1000aa32
call fcn.10009f6a
call fcn.1000aeb7
mov dword [ebp - 4], 0xfffffffe
call fcn.10009c92
jmp 0x10009d10
cmp eax, 2
jne 0x10009d04
call fcn.10009f36
push 0x214
push 1
call fcn.1001a3d3
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x10009bd6
push esi
push dword [0x10046048]
push dword [0x10048ab8]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10009cf8
push edi
push esi
call fcn.10009fad
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x10009d10
push esi
call fcn.1001a3d3
pop ecx
jmp 0x10009bd6
cmp eax, 3
jne 0x10009d10
push edi
call fcn.1001a3d3
pop ecx
xor eax, eax
inc eax
call fcn.1000af10
ret 0xc

Function at 0x10009f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046040]
jne 0x1000b4a0
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10048cf8], eax
mov dword [0x10048cf4], ecx
mov dword [0x10048cf0], edx
mov dword [0x10048cec], ebx
mov dword [0x10048ce8], esi
mov dword [0x10048ce4], edi
mov word [0x10048d10], ss
mov word [0x10048d04], cs
mov word [0x10048ce0], ds
mov word [0x10048cdc], es
mov word [0x10048cd8], fs
mov word [0x10048cd4], gs
pushfd
pop dword [0x10048d08]
mov eax, dword [ebp]
mov dword [0x10048cfc], eax
mov eax, dword [ebp + 4]
mov dword [0x10048d00], eax
lea eax, [ebp + 8]
mov dword [0x10048d0c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10048c48], 0x10001
mov eax, dword [0x10048d00]
mov dword [0x10048bfc], eax
mov dword [0x10048bf0], 0xc0000409
mov dword [0x10048bf4], 1
mov eax, dword [0x10046040]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10046044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10048c40], eax
push 1
call fcn.1000ce11
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001564
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10048c40], 0
jne 0x1000b58c
push 1
call fcn.1000ce11
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1001100d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100418d8
call fcn.10037358
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1001106e
call fcn.1000e3e2
mov esi, eax
jmp 0x10011146
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1001108c
call fcn.1000e3e2
jmp 0x1001113d
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x10011082
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100110bf
mov esi, 0x8007000e
jmp 0x1001113f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1001a3d3
mov dword [ebp - 4], 1
jmp 0x100110f3
cmp dword [ebp - 0x418], 0
je 0x100110b5
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10011082
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1001a3d3
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001115f
lea ecx, [ebp - 0x418]
call fcn.10011269
mov eax, esi
call fcn.100373b1
ret 0x10
Function at 0x1001a3d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001a3e2
pop dword [ebp - 0x10]
mov eax, 0xc7d90ab8
sub eax, 0xb7d766d6
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xa540140b
add dword [ebp - 0x20], 0xa9123140
mov dword [ebp - 0x1c], 0xf25cef1d
sub dword [ebp - 0x1c], 0xc029a2d8
mov dword [ebp - 0x18], 0xcb0aeead
sub dword [ebp - 0x18], 0x7ebeaa7f
mov dword [ebp - 0x14], 0xae4798bb
sub dword [ebp - 0x14], 0xae4798bb
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x993ff3c5
sub dword [ebp - 0x20], 0x24cd8a6f
mov dword [ebp - 0x1c], 0xe30eecb4
add dword [ebp - 0x1c], 0x5e5d74c1
mov dword [ebp - 0x18], 0xcf726541
add dword [ebp - 0x18], 0x93fd072b
mov dword [ebp - 0x14], 0x16f2f676
add dword [ebp - 0x14], 0xe90d098a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xf04b1527
sub eax, 0xe04b0527
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x4290b
push 0
call eax
mov ecx, 0x4236
mov ebx, eax
mov esi, 0x10051800
add esi, dword [ebp - 0x10]
mov edi, 0xdf2693b8
sub edi, 0x21c028e2
add dword [ebp - 0xc], 0xa3b56745
mov edx, dword [esi]
xor dword [ebp - 0xc], edi
sub edx, edi
add dword [ebp - 0xc], 0xcb957199
mov dword [ebx], edx
mov dword [ebp - 4], 0x7abb10d1
add ebx, 0x58607713
add ebx, 0xa79f88f1
add esi, 4
loop 0x1001a4f3
add eax, 0xe8bee2b4
sub eax, 0xe8bde709
xor ebx, ebx
add ebx, eax
add eax, 0x6bbeccfd
sub eax, 0x6bbeccf8
mov ecx, 0xd5e472db
add ecx, 0x3a1b8d25
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00416cb0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x4010d9
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4010a5
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40107e
cmp word [esp + 0x118], 4
jb 0x4010d9
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004148cc
add esp, 0x120
ret
cmp eax, 2
jae 0x401088
cmp eax, 1
jne 0x4010d9
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004148cc
add esp, 0x120
ret
cmp eax, 6
jne 0x4010d9
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4010cf
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004148cc
add esp, 0x120
ret
cmp eax, 1
jne 0x4010d9
mov esi, 5
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004148cc
add esp, 0x120
ret