joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a3010
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10101a81
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 4], 1
cmp dword [ebp - 0x68], esi
jbe 0x100a30f6
nop dword [eax]
push 0x1c
lea eax, [ebp - 0x50]
mov dword [ebp - 0x38], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x50], xmm0
movq qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100a3099
add esi, dword [ebp - 0x70]
jmp 0x100a30e9
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x50]
lea eax, [ecx + edx]
cmp eax, dword [ebp + 0x18]
jb 0x100a30e7
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp + 0x14]
jb 0x100a30e7
test eax, 0x100
jne 0x100a30e7
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x10], edi
je 0x100a30ce
mov dword [edi], edx
mov dword [edi + 4], ecx
add edi, 8
mov dword [ebp - 0x30], edi
jmp 0x100a30e4
lea eax, [ebp - 0x28]
push eax
push edi
lea ecx, [ebp - 0x34]
call fcn.100a23e0
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
add esi, ecx
cmp esi, dword [ebp - 0x68]
jb 0x100a3070
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x18], esi
jmp 0x100a30f8
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebp - 0x30]
mov edx, esi
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x100a3197
mov ecx, dword [edx]
mov esi, dword [ebp + 0x18]
cmp ecx, esi
mov edx, dword [edx + 4]
cmova esi, ecx
cmp esi, dword [ebp + 0x1c]
jae 0x100a3187
lea eax, [edx + ecx]
mov dword [ebp - 0x24], eax
nop word [eax + eax]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push eax
push 0
push esi
call fcn.100a2f10
mov esi, eax
add esp, 0x18
mov ecx, esi
test esi, esi
je 0x100a3184
mov eax, dword [edi + 4]
mov dword [ebp - 0x20], esi
inc esi
cmp dword [edi + 8], eax
je 0x100a3170
mov dword [eax], ecx
add dword [edi + 4], 4
jmp 0x100a317c
lea ecx, [ebp - 0x20]
push ecx
push eax
mov ecx, edi
call fcn.1000b990
mov eax, dword [ebp - 0x24]
cmp esi, dword [ebp + 0x1c]
jb 0x100a3140
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
add edx, 8
mov dword [ebp - 0x14], edx
cmp edx, eax
jne 0x100a3122
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x100a31c7
mov ecx, dword [ebp - 0x10]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x100a31bd
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a31da
push ecx
push esi
call fcn.100d26ef
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100dd9c9
int3
Function at 0x100a31e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp cx, word [eax]
jne 0x100a3263
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x100a3263
mov ecx, dword [ecx + eax + 0x88]
test ecx, ecx
je 0x100a3263
add eax, ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
push ecx
push eax
call fcn.100a5630
add esp, 0xc
test eax, eax
je 0x100a3263
mov edx, dword [ebp + 8]
mov ecx, edx
push esi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a3232
sub ecx, esi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
mov eax, dword [ebp - 8]
push edx
add eax, 0xfffffffc
push eax
push dword [ebp - 4]
call fcn.100a5680
add esp, 0x10
pop esi
test eax, eax
je 0x100a3263
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x100a3340
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [ebx]
jne 0x100a338e
mov ecx, dword [ebx + 0x3c]
cmp dword [ecx + ebx], 0x4550
jne 0x100a338e
mov eax, dword [ecx + ebx + 0xd8]
mov ecx, dword [ecx + ebx + 0xdc]
add eax, ebx
add ecx, eax
cmp eax, ecx
jae 0x100a338e
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x100a339f
add eax, 4
cmp eax, ecx
jb 0x100a3383
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0xc], ax
je 0x100a340a
push esi
push edi
mov edi, dword [ebp + 0x10]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x100a33f5
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x100a33d6
cmp dl, 0x11
jne 0x100a33ef
inc eax
cmp eax, 6
jl 0x100a33c5
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x100a33c3
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push ebx
push 6
push eax
call fcn.100a3e00
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop ebx
call fcn.100d2719
mov esp, ebp
pop ebp
ret
Function at 0x100a34d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x100a351d
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100a351d
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100a351d
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x100a352d
add eax, 4
cmp eax, ecx
jb 0x100a3512
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp + 0x1c]
test cl, cl
je 0x100a353d
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x100a3543
mov word [ebp - 0xc], 0x15ff
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
je 0x100a35aa
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x100a3595
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x100a3576
cmp dl, 0x11
jne 0x100a358f
inc eax
cmp eax, 6
jl 0x100a3565
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x100a3563
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push 6
push eax
call fcn.100a3e00
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret

Function at 0x100a35d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, 0x5a4d
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
cmp ax, word [edx]
jne 0x100a362b
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100a362b
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100a362b
mov edx, dword [ebp + 0xc]
nop dword [eax]
cmp dword [eax], edx
je 0x100a3650
add eax, 4
cmp eax, ecx
jb 0x100a3620
mov dword [esi], 0
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp + 0x20]
test cl, cl
je 0x100a3660
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x100a3666
mov word [ebp - 0xc], 0x15ff
push dword [ebp + 0x18]
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 6
push eax
push esi
call fcn.100a3010
mov ecx, dword [ebp - 4]
add esp, 0x18
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100d2719
mov esp, ebp
pop ebp
ret
Function at 0x100a3ee0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.100a3e30
add esp, 0x18
test eax, eax
je 0x100a3f09
inc eax
cmp byte [eax], 0xcc
je 0x100a3f03
pop ebp
ret

Function at 0x100a4110
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.100a4050
add esp, 0x18
test eax, eax
je 0x100a4139
inc eax
cmp byte [eax], 0xcc
je 0x100a4133
pop ebp
ret

Function at 0x100be2f5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100f3822
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f34e2
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x4044ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x474fc0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042381e
add esp, 0x10
leave
ret 0x10
in al, dx
push 0x10
push 1
push eax
call fcn.0040451f
push 0x99f2
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.0044bf8c
push dword [esi]
and dword [esi + 8], 0
mov ecx, esi
call fcn.00404982
mov dword [esi + 4], eax
xor eax, eax
jmp fcn.00404240

Function at 0x413200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edx, dword [esi]
mov edi, ecx
sub esp, 0x10
mov eax, dword [edi + 0xf4]
mov dword [esp + 0x50], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x5c], edi
mov eax, dword [eax + edx*4]
mov dword [esp + 0x34], 3
and al, 0x34
add eax, dword [eax]
add byte [eax], al
Function at 0x425f74
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4b6c70
call fcn.00426ac0
call fcn.00427eeb
movzx esi, ax
push 2
add ch, al
jle 0x425de5
add byte [eax], al
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x425e2b
xor ebx, ebx
jmp 0x425e5e
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x425e27
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x425e27
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x425e5e
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00429ca7
test eax, eax
jne 0x425e72
push 0x1c
call fcn.00425f4d
pop ecx
call fcn.00427b47
test eax, eax
jne 0x425e83
push 0x10
call fcn.00425f4d
pop ecx
call fcn.00427cb4
and dword [ebp - 4], 0
call fcn.0042acb3
test eax, eax
jns 0x425e9d
push 0x1b
call fcn.00425f4d
pop ecx
call dword [0x48d35c]
mov dword [0x4c22b8], eax
call fcn.00432e7d
mov dword [0x4c0150], eax
call fcn.00432a7b
test eax, eax
jns 0x425ec3
push 8
call fcn.0042115b
pop ecx
call fcn.00432cb4
test eax, eax
jns 0x425ed4
push 9
call fcn.0042115b
pop ecx
push 1
call fcn.00421195
pop ecx
test eax, eax
je 0x425ee7
push eax
call fcn.0042115b
pop ecx
call fcn.00432ed8
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x425f09
push esi
call fcn.004213f1
call fcn.00421186
jmp 0x425f3e
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00426b05
ret
call fcn.00432de3
jmp 0x425dfd

Function at 0x46ab00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [edi + esi - 0x7f]
in al, dx
enter 1, 0
invalid
Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x42b010]
push edi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x2ab0345
nop
push eax
nop
call 0x77f1296e
mov ebx, eax
push 0x4349e8
mov dword [ebp - 4], ebx
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
mov byte [ebx + edi], 0
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x404b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x6ff643d3
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x4349e8
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404b06
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
push 0x4349e8
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x2ab034a
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x406f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x6ff59910
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x406fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x406fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x406f91
mov ecx, dword [ebx]
push edi
push pe_nt_image_headers32
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x6ff59910
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0x406fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x406fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0x406fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.006390f4]
push eax
call dword [fcn.00639088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x406f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00407590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x421fd0
Capabilities:
Get steam token

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x42b0dc]
push esi
push edi
push 0x434ff8
call ebx
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
movzx edi, dx
push 0x434ff8
mov dword [ebp - 4], edi
xor esi, esi
call ebx
add esp, 8
test eax, eax
je 0x4220d7
mov edi, dword [ebp + 8]
nop
mov al, byte [esi + 0x434ff8]
mov cl, byte [esi + 0x434ff9]
add esi, 3
cmp al, 0x3f
je 0x4220af
cmp cl, 0x3f
je 0x4220af
lea edx, [eax - 0x30]
mov dword [ebp - 0xc], 0
cmp dl, 9
ja 0x422047
cbw
sub ax, 0x30
jmp 0x422065
lea edx, [eax - 0x61]
cmp dl, 0x19
ja 0x422057
cbw
sub ax, 0x57
jmp 0x422065
lea edx, [eax - 0x41]
cmp dl, 0x19
ja 0x422069
cbw
sub ax, 0x37
mov word [ebp - 0xc], ax
lea edx, [ecx - 0x30]
cmp dl, 9
ja 0x42207b
movsx ax, cl
sub ax, 0x30
jmp 0x42209d
lea edx, [ecx - 0x61]
cmp dl, 0x19
ja 0x42208d
movsx ax, cl
sub ax, 0x57
jmp 0x42209d
lea edx, [ecx - 0x41]
cmp dl, 0x19
ja 0x4220a1
movsx ax, cl
sub ax, 0x37
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0xa]
mov word [edi], ax
jmp 0x4220b7
mov ecx, 0x100
mov word [edi], cx
push 0x434ff8
add edi, 2
call ebx
add esp, 4
cmp esi, eax
jb 0x422010
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ax, di
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
cmp byte [0x42cfec], al
je 0x423e8d
inc eax
cmp byte [eax + 0x42cfec], 0
jne 0x423e83
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
inc eax
call fcn.00402930
mov dword [esi], eax
test eax, eax
je 0x423eab
push 0x42cfec
push eax
call dword [fcn.00639134]
mov esi, dword [0x638aa4]
xor eax, eax
cmp byte [esi], al
je 0x423ebe
inc eax
cmp byte [esi + eax], 0
jne 0x423eb7
inc eax
call fcn.00402930
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x423ed5
push esi
push ebx
call dword [fcn.00639134]
lea eax, [ebp - 0x24]
push eax
call dword [0x639044]
mov eax, dword [ebp - 0x16]
xor edi, edi
lea esi, [eax + eax*4]
mov word [0x638ec0], si
cmp dword [ebp + 0xc], edi
jle 0x423f49
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
mov edi, edi
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x638ec4], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x423f00
mov word [0x638ec0], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x423fc1
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x423f91
cmp dword [ecx], 0
je 0x423f91
cmp dword [0x6391c4], ecx
jne 0x423f7b
mov dword [0x6391c4], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x423f91
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x423fc1
cmp dword [ecx], 0
je 0x423fc1
cmp dword [0x6391c4], eax
jne 0x423fab
mov dword [0x6391c4], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x423fc1
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7d1696
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [esp]
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
jmp 0x7d16a4
sub ebp, 4
xchg dword [esp], ebp
jmp 0x7d16c2
push esi
mov esi, 0x660eee4e
add edx, esi
pop esi
add eax, edx
mov edx, dword [esp]
jmp fcn.007d17d9
pop esp
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
jmp 0x7d172d
pop esp
mov dword [esp], ecx
push esp
mov ecx, dword [esp]
add esp, 4
add ecx, 4
push edx
mov edx, 4
add ecx, edx
mov edx, dword [esp]
add esp, 4
xchg dword [esp], ecx
mov esp, dword [esp]
push ecx
mov ecx, 0x340
push ebp
mov dword [esp], 0x3df2500
jmp 0x7d170e
mov dword [esp], edx
push edi
mov edi, 0x5cd85e88
mov edx, 0x120743e2
xor edx, edi
pop edi
shl edx, 1
sub edx, 0x7ebbde3d
jmp 0x7d180c
push eax
jmp 0x7d1744
push ecx
push 0x7ffa4429
mov ecx, dword [esp]
jmp 0x7d176e
add esp, 4
jmp 0x7d17bb
add esp, 4
inc ecx
jmp 0x7d179a
sub ecx, 0x52b5e9
mov eax, ecx
pop ecx
neg eax
inc eax
shl eax, 6
shr eax, 2
sub eax, 0x5871bfc
sub ecx, eax
mov eax, dword [esp]
jmp 0x7d1752
xor ecx, dword [esp]
jmp 0x7d17d1
xor dword [esp], ecx
jmp 0x7d17fe
xor ecx, dword [esp]
jmp 0x7d16d3
shr edx, 4
jmp 0x7d16af
Function at 0x401460
Capabilities:
Execute command

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
call sym.___main
mov eax, esp
mov ebx, eax
mov dword [ebp - 0xc], 0x5c
mov dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
shl eax, 2
lea edx, [eax + 3]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00402110
sub esp, eax
lea eax, [esp + 0xc]
add eax, 3
shr eax, 2
shl eax, 2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.conversione
mov dword [esp], str.pause
call sym._system
mov eax, 0
mov esp, ebx
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401bd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401c1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c14
test esi, esi
je 0x401c14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401bf0
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e00
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f28
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401e8e
cmp eax, 4
jne 0x401eb0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401e9e
cmp edx, 4
je 0x401e9e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e00
Function at 0x40a84c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
push eax
aas
xor al, 0x4d
dec esi
xor al, byte [edi + 0x4b]
inc esi
cmp byte [ebx - 0x7ca6fb3c], al
mov ebp, 0xffffeaf4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2a8], 0
jmp 0x40ab0f
Function at 0x40aefb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edx
push ecx
add esp, 4
sub edx, 0xd76e
or edx, 0xc8bc
and edx, 0x184ef
pop edx
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x40af8d