joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407310
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x40c260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.004074f0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x40c260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00401eb0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4091e0], eax
mov esi, dword [0x4091e0]
jmp 0x4074b0
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x4073a0
cmp byte [esi], 0
je 0x4074b9
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x407415
mov al, byte [esi]
cmp al, 1
jb 0x40740b
sub al, 0x20
jbe 0x4073dc
sub al, 2
je 0x4073ef
jmp 0x40740b
mov al, byte [ebp - 0x10c]
test al, al
je 0x40741a
add dword [ebp - 0x110], 1
jmp 0x407412
cmp byte [esi + 1], 0x22
je 0x407406
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x407412
add esi, 1
jmp 0x407412
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x4073cc
test dword [ebp - 0x114], 0xffffffff
je 0x4074a9
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.004074f0
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x40c260]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x4074a1
mov al, byte [esi]
cmp al, 1
jb 0x407497
sub al, 0x20
jbe 0x407468
sub al, 2
je 0x40747b
jmp 0x407497
mov al, byte [ebp - 0x10c]
test al, al
je 0x4074a6
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x40749e
cmp byte [esi + 1], 0x22
je 0x407492
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40749e
add esi, 1
jmp 0x40749e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x407458
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x4073a3
mov ebx, dword [ebp - 0x114]
mov dword [0x40c250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x40c260
call fcn.00405a00
mov eax, dword [0x40c260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x61cae7
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
jmp 0x61c578
ror bh, 3
jmp 0x61c5ec
neg esi
neg bx
js 0x61c584
xchg edx, eax
xchg ebx, eax
mov bh, bl
inc ah
jmp 0x61c5b4
lea edx, [ebx + esi]
clc
lea eax, [ecx - 0xf7]
jmp 0x61c562
xchg edx, eax
jmp 0x61c58c
xchg ebx, eax
mov bh, bl
inc ah
jmp 0x61c5b4
lea esp, [esp]
xchg byte [esp + 1], bh
not ax
jmp 0x61c55a
sub esi, 0x43f09dfe
setns dl
rdtsc
sub esp, 0xf
jmp 0x61c623
pop word [esp + 8]
push dword [esp + 0xb]
not ebx
lea esp, [esp + 1]
jmp 0x61c646
pushfd
lea esp, [esp]
xchg byte [esp + 1], bh
not ax
ror bh, 3
lea ebx, [eax*4]
neg bx
jnp 0x61c544
rdtsc
lea edx, [ebx + esi]
clc
lea eax, [ecx - 0xf7]
jmp 0x61c562
not ebx
lea esp, [esp + 1]
jmp 0x61c646
jge 0x61c5c8
pop word [esp + 8]
push dword [esp + 0xb]
jmp 0x61c60d
push esp
mov dx, cx
jmp 0x61c688
lea esp, [esp + 0x10]
xor esi, 0x723afc57
not dl
mov bx, si
stc
jmp 0x61c725
mov ecx, esi
add al, 0x1a
jg 0x61c5de
pushfd
jmp 0x61c5a8
mov eax, 0x376a87e9
mov bh, byte [esp]
jmp 0x61c6b2
lea esp, [esp + 4]
add esi, 0x6a2a185f
mov bl, 0x15
mov bx, word [esp]
mov al, 0x15
jmp 0x61c672
pushal
jmp 0x61c6dd
add esi, 0x6727686
ror dx, 7
jo 0x61c69c
pushal
mov bl, cl
stc
jmp 0x61c6e0
not bl
mov eax, edx
jmp 0x61c6fa
mov bl, cl
stc
add esi, dword [edi]
jmp 0x61c6c4
jae 0x61c630
push esp
mov dx, cx
jmp 0x61c688
sub esp, 0xbc
mov ebp, esp
cpuid
lea ebx, reloc.WINMM.dll_midiStreamOut
rdtsc
jmp 0x61c662
lea esp, [esp + 4]
dec dl
sub esp, 0x1b
ja 0x61c91e
mov dword [esp + 0xc], eax
stc
jmp 0x61c924
jmp 0x61c905
mov dword [esp + 0xc], eax
jmp 0x61c95d
mov ebx, ecx
jmp 0x61c960
stc
mov ebx, ecx
call fcn.0061c942
not bx
lea edx, [edi + 0x34]
rcr bh, cl
jmp 0x61c973
dec esi
push eax
bswap ebx
lea ebx, [ebp + ebp]
sub esp, 0x16
jmp 0x61c98c
jnp 0x61c9a2
dec bl
pop dword [esp + 1]
jmp 0x61c9e3
dec bl
pop dword [esp + 1]
pop bx
mov word [esp + 2], bp
jmp 0x61c9cd
lea esp, [esp + 0x10]
xor al, 0x94
dec bx
jle 0x61ca94
jg 0x61ca2b
mov ds, word [bx + di]
js 0x61ca3d
mov dl, 0x66
pop ebx
pop bx
mov word [esp + 2], bp
jmp 0x61c9cd
lea edx, reloc.WINMM.dll_midiStreamOut
lea edx, [esi*4]
mov ebx, ecx
clc
jmp 0x61ca4e
neg bh
mov bh, ch
jmp 0x61caa3
mov bl, 0x1d
mov edx, ebp
jmp 0x61ca38
xchg dx, bx
bsr edx, edi
jmp 0x61ca56
lea edx, [ebp*4]
mov edx, ebx
mov ebx, edx
jmp 0x61ca02
dec al
bsf edx, ebx
jge 0x61ca11
xchg dx, bx
jmp 0x61ca6c
jbe 0x61ca0b
mov bl, 0x1d
mov edx, ebp
jmp 0x61ca0f
add al, 0xd7
mov edx, dword [esp]
mov edx, dword [esp]
stc
jb 0x61ca71
mov dl, byte [esp]
xchg edx, ebx
jmp 0x61ca73
bsr edx, edi
jmp 0x61ca56
jmp 0x61cac2
bts edx, edx
bsf bx, bp
rol edx, cl
call fcn.0061caac
int3
lea edx, [ebp*4]
mov edx, ebx
mov ebx, edx
neg bh
mov bh, ch
neg al
mov ebx, edi
jmp 0x61c9ec
mov dl, byte [esp]
xchg edx, ebx
bts edx, edx
bsf bx, bp
rol edx, cl
neg al
lea edx, [eax + ecx]
call 0x61cb38
cli
mov esp, 0xf6c2d3dd
fmul dword [ebp + reloc.WINMM.dll_midiStreamOut]
add byte [eax], al
add dl, bh
jg 0x61cacc
mov bh, byte [ecx + 0x38]
rcl byte [eax - 0x3a]
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
mov al, byte [esp + 3]
xchg edx, ebp
rdtsc
jmp 0x61c81d
Function at 0x6214d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, eax
pop cx
lea esp, [esp + 2]
call fcn.006214bd

Function at 0x759e85
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 3], dh
mov byte [esp + 5], ch
neg dh
bswap eax
inc edi
jmp 0x759ec2
mov dh, byte [esp + 5]
mov dh, bl
btr di, ax
pop di
sub esp, 0x15
mov dword [esp + 3], esp
jmp 0x759ea7

Function at 0x75a71b
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 3
pop eax
lea edi, [eax + ebx]
mov byte [esp + 0xf], ch
clc
neg dx
jmp 0x75a6b9
xchg dx, ax
btc ax, bx
rdtsc
push word [esp + 9]
add esp, 0xc
mov edx, esi
jmp 0x75a68f
lea esp, [esp + 1]
mov dl, byte [esp + 0x11]
pop edx
push word [esp]
pushfd
sub esp, 0x10
jmp 0x75a6f0
pop di
cld
xchg dword [esp + 0x1d], edi
add esp, 4
pop word [esp + 5]
push dword [esp + 2]
jmp 0x75a6a5
pop dword [esp]
pop edi
bsr ax, bx
xchg byte [esp + 1], al
push ebp
mov edx, 0x6fd40d46
jmp 0x75a733
push word [esp + 0x13]
mov dh, byte [esp + 8]
not di
mov dword [esp + 0x1e], ecx
jmp 0x75a71d
jmp 0x75a6db
not dh
xchg byte [esp + 0x18], ah
mov edi, ecx
setbe dl
rdtsc
xchg dh, dl
jmp 0x75a74b
bts edx, edi
dec dx
mov word [esp + 2], dx
push dword [esp + 0x1f]
mov dword [esp + 0x10], ebx
push dword [esp + 0x1f]
jmp 0x75a704
mov eax, 0xf923dcce
pop word [esp + 0xe]
xchg dword [esp + 0x23], eax
mov dl, byte [esp + 8]
lea eax, [ecx*4]
jmp 0x75a780
mov di, sp
cmp ax, 0xe7cc
xchg byte [esp + 6], dh
pop dx
xchg di, ax
bsr edi, eax
jmp 0x75a7ca
setp dh
mov edx, 0xac60771f
mov byte [esp + 1], bh
dec dh
mov dl, 0x99
sub esp, 0xc
call fcn.0075a7b0
ja 0x75a845
jbe 0x75a84b
dec edi
jne 0x75a85d
push eax
jb 0x75a851
jo 0x75a84f
jb 0x75a855
dec eax
popal
jb 0x75a7f7
bsf edi, esi
xor ebx, ebp
inc eax
pop esi
test eax, 0x58f86bc8
imul edi, eax, 0x58
mov edi, 0x920f62d7
shl byte [esi - 0x75], 0xd4
aam 0x8d
and al, 8

Function at 0x75a7b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x75a81b
xchg dword [esp + 0x14], edi
push word [esp + 0x28]
lea edi, [eax + ebx]
add esp, 0x16
mov edi, eax
jmp 0x75a805
xchg edx, eax
lea edx, [edx*4]
pop word [esp + 0x1e]
push word [esp + 0xc]
mov word [esp + 1], di
bsr dx, sp
jmp 0x75a7b2

Function at 0x75aabe
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
bsr ax, sp
lea edi, [esp + edx]
jmp 0x75aacc
mov word [esp + 9], si
mov edi, dword [esp + 8]
not di
dec edi
sub esp, 0x10
jmp 0x75ab04
Function at 0x75e282
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
add esp, 8
xchg dword [esp], ecx
neg si
rdtsc
jmp 0x75e2ca
not dl
mov bp, word [esp + 0xe]
xchg dword [esp + 9], edx
mov ch, bh
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0x75e26c
pop word [esp + 8]
bts cx, di
sub esp, 0x14
mov al, byte [esp + 0x15]
jmp 0x75e2e2
xchg edi, ecx
xchg bl, cl
push word [esp + 9]
mov ax, si
pop word [esp + 6]
rdtsc
jmp 0x75e297
mov dh, byte [esp + 1]
lea edi, [ecx + ecx]
sub esp, 9
xchg word [esp + 5], bx
not dx
pop dword [esp + 6]
jmp 0x75e2ad
mov al, 0x4b
push word [esp + 8]
lea eax, [edx + edi]
cld
mov byte [esp + 0x15], bh
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x75e329
lea eax, [esi + 0xaa]
cpuid
setb dh
mov byte [esp + 0x1c], bl
mov bl, byte [esp + 2]
add esp, 4
jmp 0x75e313

Function at 0x75ec96
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
cpuid
mov dh, byte [esp + 3]
shl ch, cl
xchg word [esp + 4], bx
jmp 0x75ec6a
sub di, 0x4a5f
mov esi, eax
lea esp, [esp + 0xb]
not cx
inc dl
jmp 0x75ec2c
ror ch, 0
xchg word [esp + 0xa], bx
not si
jmp 0x75ec7c
sub esp, 0x13
xchg dl, cl
xchg byte [esp + 0x11], bl
lea eax, [ecx + esi]
not cx
std
jmp 0x75ec54
lea eax, [ebp*4]
or bp, 0x811c
mov ax, 0x8a54
call fcn.0075ed82
out 0xe, eax
cdq
clc
fucomi st(1)
invalid
jno 0x75ec98
invalid
invalid
Function at 0x10451058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104511a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045106a
add dl, dl
jne 0x10451089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104510dc
xor eax, eax
add dl, dl
jne 0x10451096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045117d
add dl, dl
jne 0x104510a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104510d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10451075
mov eax, 1
add dl, dl
jne 0x104510ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104510e1
sub eax, ebx
mov ebx, 1
jne 0x10451128
mov ecx, 1
add dl, dl
jne 0x1045110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10451119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10451105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10451075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10451136
cmp eax, 0x7d00
jae 0x1045116d
cmp eax, 0x500
jb 0x10451168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10451075
cmp eax, 0x7f
ja 0x10451170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10451075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10451075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10008ec9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10008ed8
pop dword [ebp - 0x18]
mov eax, 0x269c888
sub eax, 0xf26939b0
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xdc50edff
add dword [ebp - 0x28], 0x7201574c
mov dword [ebp - 0x24], 0x6b88f9b0
add dword [ebp - 0x24], 0xc6aa5295
mov dword [ebp - 0x20], 0xdb12efcc
sub dword [ebp - 0x20], 0x8ec6ab9e
mov dword [ebp - 0x1c], 0xcecb2a54
sub dword [ebp - 0x1c], 0xcecb2a54
lea eax, [ebp - 0x28]
push eax
mov eax, 0x6ffd6c6c
add eax, 0xa00353b8
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x403a57fd
add dword [ebp - 0x28], 0x34381159
mov dword [ebp - 0x24], 0x6aead93f
add dword [ebp - 0x24], 0xd6818836
mov dword [ebp - 0x20], 0x67f06b2c
add dword [ebp - 0x20], 0xfb7f0140
mov dword [ebp - 0x1c], 0x309857bf
add dword [ebp - 0x1c], 0xcf67a841
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xe3fe9c9f
add eax, 0x2c02238d
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3483c
push 0
call eax
mov ecx, 0x919e921
add ecx, 0xf6e65100
mov edi, eax
mov ebx, 0x4e192525
sub ebx, 0x3e14b125
add ebx, dword [ebp - 0x18]
mov edx, 0x38f53cd8
sub edx, 0x51490886
xor dword [ebp - 0x14], edx
mov esi, dword [ebx]
mov dword [ebp - 0x14], 0xe5f6faf3
sub esi, edx
add dword [ebp - 0x14], 0x2ff47357
mov dword [edi], esi
add dword [ebp - 0x14], edi
add edi, 0x6bff2d82
add edi, 0x9400d282
add ebx, 0xfec60c6e
add ebx, 0x139f396
loop 0x10008ffa
add eax, 0xd34ce876
sub eax, 0xd34c0d1f
mov ebx, eax
add eax, 5
mov ecx, 0xacf57b85
add ecx, 0x630a847b
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x100caec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100caecf
pop dword [ebp - 0x50]
mov eax, 0xe3927ee1
sub eax, 0xd385d012
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa018e034
add dword [ebp - 0x60], 0xae396517
mov dword [ebp - 0x5c], 0x40753160
sub dword [ebp - 0x5c], 0xe41e51b
mov dword [ebp - 0x58], 0xeb9e6fe9
sub dword [ebp - 0x58], 0x9f522bbb
mov dword [ebp - 0x54], 0x9b23afe3
sub dword [ebp - 0x54], 0x9b23afe3
lea eax, [ebp - 0x60]
push eax
mov eax, 0xbf4dbbd5
sub eax, 0xaf370acd
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa84e508b
sub dword [ebp - 0x60], 0x33dbe735
mov dword [ebp - 0x5c], 0xa84a7657
add dword [ebp - 0x5c], 0x9921eb1e
mov dword [ebp - 0x58], 0xdc430003
sub dword [ebp - 0x58], 0x78d39397
mov dword [ebp - 0x54], 0xc3cb0bd5
add dword [ebp - 0x54], 0x3c34f42b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x750f0bb8
add eax, 0x9b07a548
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc60
push 0
call eax
mov ecx, 0xcef6ccce
sub ecx, 0xcef67754
mov esi, eax
mov edx, 0x7fb4a552
add edx, 0x906af6ae
add edx, dword [ebp - 0x50]
mov ebx, 0x71d0b539
sub ebx, 0x8492a647
sub dword [ebp - 0x38], 0x7ad3ed0e
mov edi, dword [edx]
sub dword [ebp - 0x40], ebx
add edi, ebx
sub dword [ebp - 4], esi
mov dword [esi], edi
xor dword [ebp - 0x4c], 0xd387ea76
add esi, 0xb6c39f9
sub esi, 0xb6c39f5
add edx, 0xb5cf96ff
sub edx, 0xb5cf96fb
loop 0x100caff1
add eax, 0x148bb
mov ebx, eax
add eax, 0x2d3f650a
add eax, 0xd2c09afb
mov ecx, 0x9d6a50ff
add ecx, 0x7295af01
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x100cb2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100cb468
cmp dword [esi + 0x20], 0
je 0x100cb468
cmp dword [esi + 0x24], 0
je 0x100cb468
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100cb468
cmp dword [eax], esi
jne 0x100cb468
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x100cb347
cmp eax, 0x39
je 0x100cb347
cmp eax, 0x45
je 0x100cb347
cmp eax, 0x49
je 0x100cb347
cmp eax, 0x5b
je 0x100cb347
cmp eax, 0x67
je 0x100cb347
cmp eax, 0x71
je 0x100cb347
cmp eax, 0x29a
jne 0x100cb468
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x100cb380
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x100cb3a2
call fcn.100caec0
jmp 0x100cb3a7
call fcn.100caec0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.100caec0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x101ab5da]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x101ab5d8]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x101ab5dc]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x101ab5de]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret
mov eax, 0xfffffffe
pop esi
pop ebp
ret
Function at 0x406802
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x406811
pop dword [ebp - 0x3c]
mov eax, 0xe6332212
sub eax, 0xe5f2ba01
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xdc117bce
add dword [ebp - 0x4c], 0x7240c97d
mov dword [ebp - 0x48], 0x96bef212
add dword [ebp - 0x48], 0x9b745a33
mov dword [ebp - 0x44], 0x540998ea
sub dword [ebp - 0x44], 0x7bd54bc
mov dword [ebp - 0x40], 0x5cd5f1e8
sub dword [ebp - 0x40], 0x5cd5f1e8
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xda1937a8
sub eax, 0xd9d856ac
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8862f8ed
add dword [ebp - 0x4c], 0xec0f7069
mov dword [ebp - 0x48], 0xe64bbf97
add dword [ebp - 0x48], 0x5b20a1de
mov dword [ebp - 0x44], 0x618dc5a
sub dword [ebp - 0x44], 0xa2a96fee
mov dword [ebp - 0x40], 0xa2493629
sub dword [ebp - 0x40], 0xa2493629
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x38576
push 0
call eax
mov ecx, 0x4a8e
xor ebx, ebx
add ebx, eax
mov esi, 0xc9d7a6f
add esi, 0xf3a47591
add esi, dword [ebp - 0x3c]
mov edx, 0x6ae19af6
mov edi, dword [esi]
add dword [ebp - 0x20], 0xfd47d0ec
add edi, edx
xor dword [ebp - 0x24], 0x33608ab6
mov dword [ebx], edi
xor dword [ebp - 0xc], 0x7ea68f8d
add ebx, 0x852a2d98
add ebx, 0x7ad5d26c
add esi, 0x1534bc91
add esi, 0xeacb4373
loop 0x406924
add eax, 0x11d0b
mov ebx, eax
add eax, 0x83d9a729
add eax, 0x7c2658dc
mov ecx, 0x492859aa
add ecx, 0xb717a656
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x406b16
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x40d6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x110]
lea eax, [ebp]
mov edi, dword [ebp + 0x114]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406bb4
cmp eax, ebx
jae 0x406bb4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004060ea
pop ecx
pop ecx
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
jmp 0x406ba7
push esi
lea ecx, [edi + 0x18]
call fcn.00403db8
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x406b9b
lea ecx, [ebp - 0x18]
call fcn.0040422a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.0040baa8
add ebp, 0x108
leave
ret