joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006ef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [edi + 0xec]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100353e8]
sub esi, 1
jne 0x10006f30
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e7c], ebx
jne 0x10006f67
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10018e40
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10032054
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a0f0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000a12f
cmp bl, 0x23
jne 0x1000a111
cmp byte [esi], bl
jne 0x1000a111
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100353e8]
test bl, bl
jne 0x1000a102
mov ecx, dword [0x1003c6c8]
not eax
mov esi, dword [ecx + 0x3e30]
mov edi, dword [ecx + 0x3e38]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000a16e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000a168
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000a16a
mov esi, edx
test esi, esi
jne 0x1000a150
cmp edi, ebx
je 0x1000a17d
cmp dword [edi], eax
jne 0x1000a17d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100176d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5aac], 0
lea esi, [edi + 0x5ab0]
je 0x10017752
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001770c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10019aa0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100043c0
mov edx, dword [esi]
mov ecx, 0x1003c4b1
push dword [edi + 0x5aac]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5ab8]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100043c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017b40
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x1003c6c8]
test bl, bl
je 0x10017b86
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10017b67
cmp byte [esi], bl
jne 0x10017b67
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x100353e8]
test bl, bl
jne 0x10017b58
mov edi, dword [0x1003c6c8]
mov esi, dword [edi + 0x5a54]
xor ecx, ecx
not eax
test esi, esi
jle 0x10017bac
mov edi, dword [edi + 0x5a5c]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x10017bb2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x10017ba0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x10022310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002234a
mov eax, dword [0x1003c6c8]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1002233d
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002237b
mov eax, dword [0x1003c6c8]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002236e
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100223ac
mov eax, dword [0x1003c6c8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002239f
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100223f9
mov eax, dword [0x1003c6c8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x100223ec
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1002242a
mov eax, dword [0x1003c6c8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002241d
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002245b
mov eax, dword [0x1003c6c8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1002244e
dec dword [eax + 0xb4]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10024b90
Function at 0x1002f330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1002f500
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1002f40d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1002f37a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1003c004]
ja 0x1002f37a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1002f34a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1002f39f
jmp 0x1002f40d
cmp dword [ebp - 0x14], 0x10000
jne 0x1002f3f3
cmp dword [ebp - 0x18], 0x10000
jb 0x1002f3f3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002f3d6
mov eax, dword [ebp - 8]
jmp 0x1002f40f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1002f3e6
xor eax, eax
jmp 0x1002f40f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1002f408
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1002f500
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002f34a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1002f420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1002f530
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1002f4f5
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1002f465
mov eax, dword [ebp - 4]
cmp eax, dword [0x1003c004]
ja 0x1002f465
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1002f435
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1002f48a
jmp 0x1002f4f5
cmp dword [ebp - 0x14], 0x10000
jne 0x1002f4de
cmp dword [ebp - 0x18], 0x10000
jb 0x1002f4de
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002f4c1
mov eax, dword [ebp - 8]
jmp 0x1002f4f7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1002f4d1
xor eax, eax
jmp 0x1002f4f7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1002f4f0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1002f530
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002f435
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002f560
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1002f950
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1003c124], 0
jne 0x1002f59d
cmp dword [0x1003c120], 0
je 0x1002f59d
mov eax, dword [0x1003c120]
mov dword [0x1003c124], eax
cmp dword [0x1003c124], 0
je 0x1002f61a
mov ecx, dword [0x1003c124]
cmp dword [ecx + 8], 0
je 0x1002f61a
mov edx, dword [0x1003c124]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1002f61a
mov ecx, dword [0x1003c124]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1002f61a
mov eax, dword [0x1003c124]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1002f5e9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1002f5f0
xor eax, eax
jmp 0x1002f739
mov ecx, dword [0x1003c124]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1002f739
mov edx, dword [0x1003c120]
mov dword [0x1003c124], edx
jmp 0x1002f636
mov eax, dword [0x1003c124]
mov ecx, dword [eax + 4]
mov dword [0x1003c124], ecx
cmp dword [0x1003c124], 0
je 0x1002f676
cmp dword [0x1003c124], 0
je 0x1002f674
mov edx, dword [0x1003c124]
cmp dword [edx + 8], 0
je 0x1002f674
mov eax, dword [0x1003c124]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1002f674
mov edx, dword [0x1003c124]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1002f674
jmp 0x1002f5ce
jmp 0x1002f628
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1002f740
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1002f737
mov eax, dword [ebp - 0x18]
mov dword [0x1003c124], eax
mov ecx, dword [0x1003c124]
mov dword [ecx], 0x52727464
mov edx, dword [0x1003c124]
mov dword [edx + 8], 0
mov eax, dword [0x1003c124]
mov ecx, dword [0x1003c120]
mov dword [eax + 4], ecx
mov edx, dword [0x1003c124]
mov dword [0x1003c120], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1003c124]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1002f707
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1002f727
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1002f6fe
mov eax, dword [0x1003c124]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1002f5ce
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10030480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003c120]
mov dword [ebp - 4], eax
jmp 0x10030499
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100304c0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x100304be
call sub.KERNEL32.dll_GetLastError
jmp 0x100304c2
jmp 0x10030490
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10030960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1003c130], eax
je 0x10030984
mov eax, 0x10dd
jmp 0x10030b2c
cmp dword [0x1003c134], 0
je 0x10030997
mov eax, dword [0x1003c134]
jmp 0x10030b2c
cmp dword [ebp + 0xc], 0
jne 0x100309a7
mov eax, 0x57
jmp 0x10030b2c
cmp dword [ebp + 8], 0
jne 0x100309b7
mov eax, 6
jmp 0x10030b2c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x100309e0
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x1003c134], ecx
mov edx, dword [ebp + 8]
mov dword [0x1003c138], edx
mov eax, dword [ebp - 8]
jmp 0x10030b2c
push 0x18
call fcn.10032956
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10030a3b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x1003c134], ecx
cmp dword [ebp - 4], 0
je 0x10030a2a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.10032299
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x1003c138], ecx
mov eax, dword [ebp - 8]
jmp 0x10030b2c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10030940
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10030940
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x10030a7b
cmp dword [ebp - 0xc], 0x1e
jbe 0x10030a97
mov dword [ebp - 8], 9
cmp dword [0x1003c128], 0
je 0x10030a92
jmp 0x10030a09
jmp 0x10030a00
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x10030abe
mov dword [ebp - 8], 9
cmp dword [0x1003c128], 0
je 0x10030ab9
jmp 0x10030a09
jmp 0x10030a00
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10030ae9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10030a00
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x1003c140]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1003c140], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10030b40
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1003c130], eax
je 0x10030b5d
mov eax, 0x10dd
jmp 0x10030c40
mov eax, dword [0x1003c140]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10030bdc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10030bb8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10030bb8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1002f9e0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10032299
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10030b65
mov dword [0x1003c140], 0
call fcn.100302c0
mov ecx, dword [0x1003c13c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10030c2a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10032299
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10030bf4
mov dword [0x1003c13c], 0
mov dword [0x1003c130], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10031120
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1003c134], 0
je 0x10031139
mov eax, dword [0x1003c134]
jmp 0x100311d8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1003114a
xor eax, eax
jmp 0x100311d8
push 8
call fcn.10032956
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100311a2
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003118b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10032299
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1003c134], eax
mov dword [0x1003c138], 0
mov eax, dword [ebp - 8]
jmp 0x100311d8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x100311ba
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003116a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1003c13c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1003c13c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2d007ded
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2b6745c5
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x19169f8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1916b48
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1916a1e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1916a0a
add dl, dl
jne 0x1916a29
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1916a7c
xor eax, eax
add dl, dl
jne 0x1916a36
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1916b1d
add dl, dl
jne 0x1916a45
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1916a50
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1916a5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1916a66
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1916a72
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1916a15
mov eax, 1
add dl, dl
jne 0x1916a8a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1916a95
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1916a81
sub eax, ebx
mov ebx, 1
jne 0x1916ac8
mov ecx, 1
add dl, dl
jne 0x1916aae
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1916ab9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1916aa5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1916a15
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1916adf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1916aea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1916ad6
cmp eax, 0x7d00
jae 0x1916b0d
cmp eax, 0x500
jb 0x1916b08
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1916a15
cmp eax, 0x7f
ja 0x1916b10
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1916a15
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1916b3e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1916a15
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41dcb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0xffffffff
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [ebp - 0x210]
sub edx, 0x41
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.0041a060
add esp, 8
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0041a180
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x41dd5a
xor eax, eax
jmp 0x41dd6d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.0041db30
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219