joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fa40
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1002a0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.10007f6d
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1000714c
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10004ac0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010b53
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10010b92
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010b92
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010b92
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10010b92
cmp dword [ecx + 0x74], 0xe
jbe 0x10010b92
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10014d31
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100234dc
push 0x100234d4
push str.FlsAlloc
push 0x1f
call fcn.10014bb9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014d65
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002017c]
call esi
jmp 0x10014d6b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10014daf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100234ec
push 0x100234e4
push str.FlsGetValue
push 0x21
call fcn.10014bb9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014de6
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002017c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10014dee
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100234f4
push 0x100234ec
push str.FlsSetValue
push 0x22
call fcn.10014bb9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014e28
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002017c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100158b8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10009030
mov eax, dword [0x1002a0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10011722
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100158fa
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10015a56
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1001f460
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1002bb28]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100166b9
mov ecx, dword [esi*4 + 0x1002bb28]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10015a4f
cmp eax, dword [ecx + edi + 0x24]
jne 0x10015a4f
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10015a4f
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100166b9
add esp, 0x14
test edx, edx
jl 0x10015a4f
jg 0x100159c5
test eax, eax
jb 0x10015a4f
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10015a4f
jl 0x100159df
cmp dword [ebp - 0x1008], eax
ja 0x10015a4f
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100159fd
test ebx, ebx
je 0x10015a36
cmp ecx, edi
jae 0x10015a36
mov al, byte [ecx]
cmp al, 0xd
jne 0x10015a17
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10015a23
cmp byte [ecx + 1], 0xa
jne 0x10015a23
inc ecx
jmp 0x10015a23
movzx eax, al
movsx eax, byte [eax + 0x1002a368]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100159fd
cmp edx, ebx
jne 0x100159fd
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10015a54
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10007f5a
leave
ret
Function at 0x10015b51
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1002bb28]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10015b91
cmp byte [ebx], 0xa
jne 0x10015b91
or byte [edi + eax + 0x28], 4
jmp 0x10015b96
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10015c95
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10015c78
inc eax
cmp dl, 0xd
je 0x10015bc2
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10015be8
cmp eax, ecx
jae 0x10015bf6
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10015baa
jmp 0x10015c95
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10015c73
cmp dword [ebp - 0x10], 0
je 0x10015c73
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1002bb28]
test byte [eax + edi + 0x28], 0x48
je 0x10015c4d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10015c38
mov byte [esi], dl
jmp 0x10015c49
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1002bb28]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10015c95
cmp byte [ebp - 1], 0xa
jne 0x10015c5c
cmp esi, ebx
jne 0x10015c5c
mov byte [esi], 0xa
jmp 0x10015c94
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100166d7
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10015c95
mov byte [esi], 0xd
jmp 0x10015c94
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1002bb28]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10015c92
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10015c95
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10015c9e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1002bb28]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10015ce4
cmp word [ebx], dx
jne 0x10015ce4
or byte [eax + edi + 0x28], 4
jmp 0x10015ce9
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10015e4c
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10015e2c
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10015d2a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10015d60
cmp eax, edx
jae 0x10015d6e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10015d05
jmp 0x10015e4c
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10015e27
cmp dword [ebp - 0x18], 0
je 0x10015e27
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1002bb28]
test byte [eax + edi + 0x28], 0x48
je 0x10015dfd
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10015dc1
mov word [esi], cx
jmp 0x10015df8
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1002bb28]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1002bb28]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1002bb28]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10015e4c
pop eax
cmp word [ebp - 4], ax
jne 0x10015e0d
cmp esi, ebx
jne 0x10015e0d
mov word [esi], ax
jmp 0x10015e49
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100166d7
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10015e4c
push 0xd
pop eax
jmp 0x10015e08
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1002bb28]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10015e46
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10015e4c
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10019c46
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10019ce3
push ebx
push esi
call fcn.10019c0f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10018a4a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10019c90
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019ce2
push edi
push eax
call fcn.10016a62
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10019cb0
call fcn.100144d3
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019ce1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10018a4a
add esp, 0x20
test eax, eax
jne 0x10019ccf
push edi
call fcn.100144d3
jmp 0x10019cd7
push ebx
call fcn.100144d3
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001c2bb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10011d0b
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c32a
cmp esi, dword [ebp - 4]
je 0x1001c325
cmp dword [ebp + 0xc], 0
je 0x1001c325
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001c302
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1001be0d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1001c32c
xor eax, eax
inc eax
jmp 0x1001c32c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1001c391
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002a0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10011d0b
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10011d0b
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1001c408
cmp word [ecx], dx
je 0x1001c408
mov eax, dword [0x10023b54]
push edi
dec eax
push eax
push 0x10023a40
call fcn.1001c330
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1001c47b
cmp word [eax], dx
je 0x1001c47b
mov eax, dword [edi]
test eax, eax
je 0x1001c42c
cmp word [eax], dx
je 0x1001c42c
lea eax, [ebp - 0x10]
push eax
call fcn.1001bd13
jmp 0x1001c435
lea eax, [ebp - 0x10]
push eax
call fcn.1001bdae
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1001c4a5
mov eax, dword [0x10023a3c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10023730
call fcn.1001c330
add esp, 0xc
test al, al
je 0x1001c4a5
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1001c470
cmp word [eax], di
je 0x1001c470
lea eax, [ebp - 0x10]
push eax
call fcn.1001bd13
pop ecx
jmp 0x1001c4a7
lea eax, [ebp - 0x10]
push eax
call fcn.1001bdae
jmp 0x1001c46d
mov eax, dword [edi]
test eax, eax
je 0x1001c492
cmp word [eax], dx
je 0x1001c492
lea eax, [ebp - 0x10]
push eax
call fcn.1001bcc8
pop ecx
jmp 0x1001c4a5
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1001c570
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1001c1b5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1001c570
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1001c570
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1001c570
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1001c4fd
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10014f2e
test ebx, ebx
je 0x1001c56b
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10014f2e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c570
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c570
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1001daba
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1001c572
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007f5a
leave
ret
Function at 0x1001dfe1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1001df5d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1001e150
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1001e150
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1001e105
jg 0x1001e03d
test eax, eax
je 0x1001e0fb
push 1
push 0x1000
call fcn.100148b7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1001e060
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001e0f2
push 0x8000
push ebx
call fcn.1001de8e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1001e089
jg 0x1001e084
cmp ecx, 0x1000
jb 0x1001e089
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100142b7
add esp, 0x10
cmp eax, 0xffffffff
je 0x1001e0ce
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1001e084
jl 0x1001e0b5
test ecx, ecx
jne 0x1001e076
push dword [ebp - 0xc]
push ebx
call fcn.1001de8e
push esi
call fcn.100144d3
add esp, 0xc
xor ebx, ebx
jmp 0x1001e15e
cmp byte [edi + 0x24], 0
je 0x1001e0e5
cmp dword [edi + 0x20], 5
jne 0x1001e0e5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1001e0f0
mov ebx, dword [edi + 0x18]
jmp 0x1001e0f2
xor ebx, ebx
push esi
call fcn.100144d3
pop ecx
jmp 0x1001e15e
test ecx, ecx
jg 0x1001e0c7
jl 0x1001e105
test eax, eax
jae 0x1001e0c7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100166d7
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1001e125
cmp byte [edi + 0x1c], 0
je 0x1001e0c7
jmp 0x1001e156
push ebx
call fcn.1001a233
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1001e0c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001e15e
cmp byte [edi + 0x1c], 0
je 0x1001e15b
mov ebx, dword [edi + 0x18]
jmp 0x1001e15e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100166d7
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001f420
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001f44d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001f44d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405890
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x16680
call fcn.00406960
push ebx
mov ebx, dword [esp + 0x16690]
push esi
push edi
mov edi, dword [esp + 0x1669c]
xor esi, esi
xor ecx, ecx
mov eax, ecx
mov byte [esp + ecx + 0x14], cl
cdq
idiv edi
inc ecx
cmp ecx, 0xb33a
mov al, byte [edx + ebx]
mov byte [esp + ecx + 0xb34f], al
jl 0x4058af
xor ecx, ecx
xor edx, edx
xor eax, eax
mov dl, byte [esp + ecx + 0xb350]
mov al, byte [esp + ecx + 0x14]
add esi, edx
add eax, esi
mov esi, 0xb33a
cdq
idiv esi
inc ecx
cmp ecx, 0xb33a
mov esi, edx
mov dl, byte [esp + ecx + 0x13]
mov al, byte [esp + esi + 0x14]
mov byte [esp + esi + 0x14], dl
mov byte [esp + ecx + 0x13], al
jl 0x4058cd
mov eax, dword [esp + 0x16694]
xor edi, edi
test eax, eax
jle 0x40598a
mov esi, dword [esp + 0x166a0]
push ebp
mov ebp, dword [esp + 0x16694]
mov dword [esp + 0x10], eax
sub ebp, esi
lea eax, [ecx + 1]
mov ecx, 0xb33a
cdq
idiv ecx
xor eax, eax
mov ebx, 0xb33a
mov ecx, edx
mov al, byte [esp + ecx + 0x18]
add eax, edi
mov edi, 0xb33a
cdq
idiv edi
mov edi, edx
mov dl, byte [esp + ecx + 0x18]
mov al, byte [esp + edi + 0x18]
mov byte [esp + edi + 0x18], dl
mov byte [esp + 0x14], al
mov byte [esp + ecx + 0x18], al
mov edx, dword [esp + 0x14]
xor eax, eax
mov al, byte [esp + edi + 0x18]
and edx, 0xff
add eax, edx
cdq
idiv ebx
mov bl, byte [esi + ebp]
mov al, byte [esp + edx + 0x18]
xor al, bl
mov byte [esi], al
mov eax, dword [esp + 0x10]
inc esi
dec eax
mov dword [esp + 0x10], eax
jne 0x405925
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x16680
ret
Function at 0x521d11
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esp
push 4
call fcn.00409350
add esp, 8
push 0x300033
call fcn.00521f18
push 0x300034
call fcn.00521f18
mov edx, dword [esp + 8]
push 0x300035
call fcn.00521f18
mov ecx, dword [esp + 0xc]
push 0x300036
call fcn.00521f18
mov eax, dword [esp + 4]
push 0x300037
call fcn.00521f18
push ebx
push 0x300038
call fcn.00521f18
push esi
push 0x300039
call fcn.00521f18
push edi
push 0x30003a
call fcn.00521f18
lea edi, [0x4ca1f4]
push 0x30003b
call fcn.00521f18
not eax
push 0x30003c
call fcn.00521f18
sub ecx, 4
jb 0x521e69
push 0x30003f
call fcn.00521f18
mov ebx, dword [edx]
push 0x300040
call fcn.00521f18
xor ebx, eax
push 0x300041
call fcn.00521f18
movzx esi, bl
push 0x300042
call fcn.00521f18
mov eax, dword [edi + esi*4 + 0xc00]
push 0x300043
call fcn.00521f18
shr ebx, 8
push 0x300044
call fcn.00521f18
movzx esi, bl
push 0x300045
call fcn.00521f18
xor eax, dword [edi + esi*4 + 0x800]
push 0x300046
call fcn.00521f18
shr ebx, 8
push 0x300047
call fcn.00521f18
movzx esi, bl
push 0x300048
call fcn.00521f18
xor eax, dword [edi + esi*4 + 0x400]
push 0x300049
call fcn.00521f18
shr ebx, 8
push 0x30004a
call fcn.00521f18
xor eax, dword [edi + ebx*4]
push 0x30004b
call fcn.00521f18
add edx, 4
push 0x30004c
call fcn.00521f18
sub ecx, 4
jae 0x521da3
push 0x30004f
call fcn.00521f18
add ecx, 4
je 0x521ec7
push 0x300052
call fcn.00521f18
movzx ebx, byte [edx]
push 0x300053
call fcn.00521f18
xor bl, al
push 0x300054
call fcn.00521f18
shr eax, 8
push 0x300055
call fcn.00521f18
xor eax, dword [edi + ebx*4]
push 0x300056
call fcn.00521f18
add edx, 1
push 0x300057
call fcn.00521f18
sub ecx, 1
jne 0x521e78
push 0x30005a
call fcn.00521f18
pop edi
push 0x30005b
call fcn.00521f18
pop esi
push 0x30005c
call fcn.00521f18
pop ebx
push 0x30005d
call fcn.00521f18
not eax
push 0x30005e
call fcn.00521f18
jmp 0x521f0c
push edx
push eax
call fcn.00409480
pop eax
pop edx
ret 0xc

Function at 0x521f18
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushfd
push esp
push dword [esp + 0x2c]
call fcn.00408810
add esp, 8
or eax, eax
je 0x521f30
jmp 0x4f05b2
popfd
popal
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x43005ffd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x12ec2e87
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219