joyce8/EMBER2024-capa huggingface dataset:
Function at 0x578a56
Capabilities:
Check for software breakpoints

Disassembly:
add eax, 0xa9fec583
cld
enter 0xffffffffffffb7e7, 0xfffffffffffffffd
sbb bh, byte [ebp - 0x3f]
push edi
rcl dl, 1
xor al, al
mov ecx, 0xa0b861a5
jnp 0x578a5c
jne 0x578a70
pop esi
dec esi
invalid

Function at 0x592760
Capabilities:
Encode data using xor

Disassembly:
retf
push 0xffffffffffffffee
aam 0x5e
pop edi
add eax, 0x8f043e81
jp 0x592744
mov esi, 0xd53a73a6
pop esi
inc ebx
mov esp, fs
scasd eax, dword es:[edi]
dec ecx
mov edx, 0x9b3f3f12
sbb bh, byte [edi + 0xa]
inc esp
clc
cmpsb byte [esi], byte es:[edi]
push cs
enter 0xffffffffffffd45b, 0xffffffffffffffaa
xor ecx, dword [edi + edi*4 + 0x30]
pop ebx
in eax, 0x44
jnp 0x592784
imul edx, dword [ebp + 0x2abedbd0], 0xbb8e3c81
fimul word [edx]
sbb dword fs:[edi - 0x59], ecx
or esp, dword [edx - 0x2a]
mov al, 0xe
ffreep st(1)
mov eax, 0xa6000c5d
jb 0x592771
xchg edi, eax
pop edx
dec ebp
lodsb al, byte [esi]
lodsb al, byte [esi]
fld dword [esi - 0x2c6dea6]
jl 0x5927ba
dec edx
push es
pop edx
adc al, 0x12
sub al, 0x8d
dec ebp
push ebx
test al, 6
insb byte es:[edi], dx
sbb al, byte [esi + 0x4eb0904b]
scasb al, byte es:[edi]
iretd

Function at 0x5bcc60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f0150
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bcd83
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc480
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bcd9a
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc390
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5de800
Capabilities:
Check for software breakpoints

Disassembly:
pop edi
scasd eax, dword es:[edi]
imul ecx, dword [eax + 0x7c], 0xffffff82
into
dec ebp
and al, bl
push esp
into
ret 0xa142
ret
inc edx
mov eax, dword [0xac5d7340]
int1
aaa
add eax, 0x17991209
mov bh, 0x5f
adc eax, 0x5ef297b7
imul ecx, dword [eax], 0xffffffe4
pop edi
cmpsb byte [esi], byte es:[edi]
jno 0x5de76f
sub esp, dword [edx + 0x59caf740]
test edx, 0x96fea259
and bh, byte [edx - 0x7997801]
adc esp, dword [esi + 0x2929c576]
pop ecx
mov byte [0xba2296fe], al
inc dword [edi - 0x59ec079a]
jbe 0x5de744
sub dword [ecx], ebp
hlt
fild word [ecx - 0xd]
jae 0x5de751
and eax, 0x3ec3b4f7
jle 0x5de771
shl byte [edx - 0x5d160a03], 1
pop esi
jae 0x5de74d
add eax, 0xe7b34c37
dec esi
cmp dword [eax - 0x5e], esp
shl byte [edi], cl
loop 0x5de77f
pushal
mov byte [0xd8e227d2], al
int1
aaa
test eax, 0x80210042
mov dh, 0x68
push es
or eax, 0xe04af953
cmp dh, byte [edi - 0x35]
loopne 0x5de7f2
ja 0x5de785
neg bl
mov ch, 0x6a
adc al, ch
cld
and ebp, ecx
mov dh, 0xf8
mov bh, 0xe2
daa
rcr dword [ebx + 0x6c], 0xfb
sti
retf
pop es
je 0x5de791
mov cl, 0x21
scasd eax, dword es:[edi]
jne 0x5de832
mov gs, edx
adc eax, 0x33f30e6b
pop es
rol byte [edi - 0x534190df], cl
sbb al, byte [ebx + 0x106cec5f]
add eax, esp
pop es
sbb dword [edi - 0x14], 0x6c
adc byte [ebx], al
les eax, [edi]
sal dword [edi - 0x79327619], 0x2b
xchg byte [ebx], ch
dec esp
mov edi, 0xee4b295b
xchg dword [eax - 0x58], esp
loop 0x5de843
lodsb al, byte [esi]
jae 0x5de7b6
xchg ebx, eax
inc eax
cli
or ecx, eax
jge 0x5de7a1
cmpsb byte [esi], byte es:[edi]
pop ebp
xlatb
aad 0x31
mov cl, 0x22
xor eax, 0x7fc3ef11
mov ah, 0x33
add cl, dl
push es
push edx
xor dword [ecx - 0x42], 0xa4099703
jg 0x5de7da
xor dh, byte [ebx - 0x61]
jbe 0x5de7cc
dec ecx
std
mov cl, 0xed
cmp byte [edi + 0x15f29964], 0xcc
sbb eax, 0x8f3606e1
adc eax, esi
mov dh, 0xa5
loope 0x5de84b
invalid
xor dword [esi + 0x22], 2
aaa
mov dl, byte [edi]
iretd
Function at 0x6062f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006397e0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606413
push ecx
lea ecx, [esi + 0x18]
call fcn.00625b10
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x60642a
push ecx
lea ecx, [esi + 0x24]
call fcn.00625a20
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x60ba04
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
mov cl, 0x64
mov ebp, 0x2398fdda
mov esi, 0xc3fd4c74
adc dword [ecx + 0xba124bd], ecx
cmpsd dword [esi], dword es:[edi]
enter 0xffffffffffff8cb2, 0xffffffffffffffd3
xchg ebp, eax
cmp byte [esi], dh
lahf
xor al, 0xa9
pop ebx
lodsb al, byte [esi]
jecxz 0x60ba0f
std
ret
invalid
Function at 0x64d5ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d60f
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d600
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d73d
mov eax, dword [0xa58c94]
cmp eax, 1
je 0x64d717
test eax, eax
jne 0x64d640
cmp dword [0x655264], 1
je 0x64d717
cmp edx, 0xfc
je 0x64d73d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d677
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064dfd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d6ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x6528ac
push edi
call fcn.00650330
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064dfd0
add byte [ebp - 0x9f7b], cl
call dword [edi + 0x50]
lea eax, [ebp + 8]
lea esi, [esi + 0x65533c]
push 0
push eax
push dword [esi]
call fcn.0064e460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x409de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0x40
call dword [0x427004]
mov ebx, eax
xor esi, esi
mov byte [ebx + edi], 0
test edi, edi
je 0x409e3e
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 4], eax
lea ebx, [ebx]
mov ecx, dword [ebp + 0xc]
push ecx
lea edi, [esi + ebx]
call dword [0x4270c8]
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
mov eax, dword [ebp + 0xc]
inc esi
add esp, 4
mov cl, byte [edx + eax]
mov edx, dword [ebp - 4]
xor cl, byte [edx + edi]
mov byte [edi], cl
cmp esi, dword [ebp + 0x10]
jb 0x409e10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bd00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
cmp dword [eax + 4], 0x40
push ebx
mov ebx, dword [ebp + 8]
jb 0x40bdc5
mov eax, dword [eax]
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov ecx, 0x40
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x5a4d
cmp word [ebx], cx
jne 0x40be0d
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x40be0d
mov ecx, dword [ebp + 0xc]
lea esi, [eax + 0xf8]
lea edx, [ebx + 0x40]
mov dword [ebp - 8], edx
cmp esi, dword [ecx + 4]
ja 0x40bdcf
mov ecx, dword [ecx]
add ecx, eax
mov dword [ebp - 4], ecx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov ecx, 0xf8
rep movsb byte es:[edi], byte [esi]
cmp dword [edx], 0x4550
jne 0x40be0d
mov edx, 0x10b
cmp word [ebx + 0x58], dx
jne 0x40be0d
movzx eax, word [ebx + 0x46]
test ax, ax
je 0x40be0d
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [ebx + 0x140], eax
call dword [0x63007c]
push eax
call dword [0x630014]
mov dword [ebx + 0x138], eax
test eax, eax
jne 0x40bddb
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, word [ebx + 0x54]
mov edx, dword [ebx + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebx + 0x140]
push edx
push ecx
push eax
mov dword [ebx + 0x13c], ecx
call fcn.0040c410
add esp, 0x10
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea eax, [edi + 1]
mov dword [esi + 8], edi
call fcn.00403250
mov dword [esi], eax
cmp eax, edi
je 0x422f0b
push 0x429b92
push eax
call dword [0x6300bc]
mov esi, dword [0x62fa98]
xor eax, eax
cmp byte [esi], al
je 0x422f1e
inc eax
cmp byte [esi + eax], 0
jne 0x422f17
inc eax
call fcn.00403250
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x422f35
push esi
push ebx
call dword [0x6300bc]
lea eax, [ebp - 0x24]
push eax
call dword [0x62ffd0]
mov eax, dword [ebp - 0x16]
lea esi, [eax + eax*4]
mov word [0x62fe80], si
cmp dword [ebp + 0xc], edi
jle 0x422fa9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
lea esp, [esp]
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x62fe84], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x422f60
mov word [0x62fe80], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x423021
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x422ff1
cmp dword [ecx], 0
je 0x422ff1
cmp dword [case.0x418ce2.1], ecx
jne 0x422fdb
mov dword [case.0x418ce2.1], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x422ff1
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x423021
cmp dword [ecx], 0
je 0x423021
cmp dword [case.0x418ce2.1], eax
jne 0x42300b
mov dword [case.0x418ce2.1], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x423021
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4236e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x630068]
test esi, esi
jne 0x4236f8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4236f1
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x4236f1
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x42375a
jmp 0x423740
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x62fbd8]
add eax, esi
call fcn.00422e80
test eax, eax
je 0x423763
inc edi
cmp edi, dword [ebp - 4]
jb 0x423740
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401060
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, eax
xor eax, esi
xor ebx, eax
xor eax, esi
mov ebx, eax
mov esi, ebx
xor esi, esi
xor ebx, esi
mov ebx, ebx
sbb edi, 0x10
and esi, 0x7c
and ebx, 0x83
rcr ebx, 0x6a
and esi, 0xba
or eax, 0x8c
rcr edx, 0xa9
rol esi, 0xa1
neg ebx
inc esi
and ebx, 0x2b
rcl edx, 0xbf
or edi, 0xd
neg esi
inc edi
neg edx
sub ebx, 0xe1
sub edi, 0x7a
rcr eax, 0x54
or esi, 0xb9
bswap ebx
sbb eax, 0x57
rol ebx, 0xd2
not ebx
dec ebx
ror edi, 0x3e
imul eax
inc edi
sub esi, 0xbd
not edi
dec edi
neg esi
rol eax, 0xea
imul ebx
bswap edx
and edi, 0xc0
rcl eax, 0x47
mov ebx, 0x8f
or ebx, 0x15
sub ebx, 0x7f
not eax
inc esi
not eax
not edi
bswap esi
neg ebx
rol ebx, 0x15
imul eax
dec edx
neg ebx
xor ecx, ecx
xor edi, edi
xor eax, esi
mov esi, ebx
xor esi, eax
mov eax, esi
xor eax, esi
xor eax, ebx
inc esi
not edx
inc edx
dec edi
add ebx, 0xc6
imul ebx
rcl eax, 0xed
mov edx, 0x53
and ebx, 0x1c
sbb edx, 0xf8
rcl edi, 0x6f
dec ebx
sbb ebx, 0xa7
not edi
not edx
bswap edi
sub ebx, 0x7b
mov eax, 0x33
bswap edx
sbb eax, 0x92
bswap edi
ror eax, 0x74
ror edx, 6
rcl edi, 0x84
sub edx, 0x28
sbb edx, 0x32
inc esi
rcr eax, 0xc8
imul ebx
sub ebx, 0xce
neg edi
add eax, 0x84
inc edx
inc edx
add ebx, 0xc4
bswap edx
sub eax, 0x3a
rol edi, 0xb5
bswap edi
dec edx
inc eax
add edi, 0x56
or esi, 0x67
sub esi, 0xc5
rol ebx, 0xfc
inc edi
imul edi
ror ebx, 0x9a
rcr edi, 0xaa
inc ebx
xor esi, esi
xor esi, eax
mov esi, esi
xor eax, eax
mov ebx, esi
mov esi, ebx
mov ebx, eax
xor ebx, ebx
mov esi, esi
mov ecx, dword [ebp + 0xc]
rol edi, 0x3c
bswap edi
bswap edi
imul edi
dec edx
rol edi, 0x2e
and edx, 0xe5
imul edx
imul eax
imul edx
rcl ebx, 0x9c
mov ebx, 0x42
neg edx
rol ebx, 0x68
inc edx
inc ebx
neg edi
neg esi
not eax
rol ebx, 0x2e
not eax
dec edi
bswap eax
rcr esi, 0x6c
neg ebx
dec esi
not edx
dec eax
sub esi, 0xa0
dec eax
bswap ebx
rcl ebx, 0xee
or eax, 0x1c
sub edx, 0x81
bswap eax
bswap eax
and eax, 0xcb
imul ebx
rcl edx, 0xdd
dec ebx
imul edi
ror edx, 0x2d
bswap edi
rcl edi, 0x67
rcl edi, 0x23
or ebx, 0xaf
bswap ebx
not edx
mov eax, 0xc4
sbb edi, 0x66
mov edi, dword [ebp + 8]
mov eax, eax
xor ebx, eax
mov eax, ebx
mov ebx, esi
mov esi, esi
mov esi, ebx
xor eax, eax
xor ebx, ebx
mov ebx, eax
not byte [edi]
mov esi, eax
mov ebx, esi
mov ebx, esi
xor eax, eax
xor esi, eax
xor ebx, eax
xor ebx, eax
mov esi, esi
xor esi, eax
xor esi, ebx
xor eax, ebx
xor ebx, eax
add byte [edi], 0xff
sub byte [edi], 0x4a
mov ebx, eax
xor ebx, esi
xor eax, eax
xor esi, eax
xor ebx, esi
mov esi, eax
mov eax, eax
xor ebx, eax
xor esi, eax
imul byte [edi]
inc edi
loop 0x401249
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4041c0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4041ff
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4041ff
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4041ff
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4041ff
cmp dword [ecx + 0x74], 0xe
jbe 0x4041ff
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409d53
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x409df0
push ebx
push esi
call fcn.00409d1c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409cb0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x409d9d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409def
push edi
push eax
call fcn.0040a970
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x409dbd
call fcn.00408811
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409dee
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409cb0
add esp, 0x20
test eax, eax
jne 0x409ddc
push edi
call fcn.00408811
jmp 0x409de4
push ebx
call fcn.00408811
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b0ed
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b040
push 0x41b038
push str.FlsAlloc
push 0x1f
call fcn.0040afac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b121
push dword [ebp + 8]
mov ecx, esi
call dword [0x413154]
call esi
jmp 0x40b127
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b16b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b050
push 0x41b048
push str.FlsGetValue
push 0x21
call fcn.0040afac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b1a2
push dword [ebp + 8]
mov ecx, esi
call dword [0x413154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b1aa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b058
push 0x41b050
push str.FlsSetValue
push 0x22
call fcn.0040afac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b1e4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x413154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41066d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41066d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10001d40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100127d0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001b008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x1001b938
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.10005420
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x1001b920
push eax
call fcn.10005420
mov esi, dword [0x1001b948]
xor ebx, ebx
mov edi, dword [0x1001b94c]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x1001c608], bl
mov eax, ebx
mov ecx, 0x1001b938
cmovae ecx, dword [0x1001b938]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x1001c508], al
inc ebx
cmp ebx, 0x100
jl 0x10001dc0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x1001c608]
movzx eax, byte [esi + 0x1001c508]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10001e14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x1001c608]
mov byte [esi + 0x1001c608], al
inc esi
mov byte [edi + 0x1001c608], dl
cmp esi, 0x100
jl 0x10001df0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.10001b30
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10001e69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001e5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001ebf
push edx
push ecx
call fcn.10005e32
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x10001eab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001ea1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001ebf
push edx
push ecx
call fcn.10005e32
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10009730
int3