joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c20
Capabilities:
Copy file
Get file version info
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
movlpd qword [ebp - 8], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov byte [ebx], al
call fcn.00403060
mov esi, dword [ebp + 8]
push esi
push 0x491260
push 0x45c36c
call fcn.00404170
push 0x5c
push 0x491260
call fcn.0040ab3b
add esp, 0x14
test eax, eax
jne 0x405c75
mov eax, 0x491260
jmp 0x405c78
add eax, 2
push eax
push esi
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
push 0x45bac8
push edi
call fcn.004020d0
add esp, 0x10
cmp byte [0x46ffc4], 0
je 0x405d97
lea eax, [ebp - 0x10]
mov byte [0x46abaf], 1
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.004139ef
add esp, 4
mov ebx, eax
mov dword [ebp - 0x14], ebx
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x405d14
mov ecx, dword [ebx + 0x30]
xor eax, eax
or eax, dword [ebx + 0x34]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x491260
mov dword [ebp - 0xc], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.004139ef
add esp, 4
mov ebx, eax
mov dword [ebp + 0xc], ebx
push ebx
push esi
push 0
push 0x491260
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x405d20
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebx + 0x30]
or esi, dword [eax + 0x34]
jmp 0x405d26
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x405d36
push eax
call fcn.004139ea
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405d46
push eax
call fcn.004139ea
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ecx
mov edx, dword [ebp - 0xc]
or eax, edx
je 0x405d5c
cmp edx, ebx
ja 0x405dae
jb 0x405d5c
cmp ecx, esi
jae 0x405dae
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.00406470
add esp, 8
test al, al
je 0x405d94
lea eax, [ebp - 0x2c]
push eax
push 0x491260
call fcn.00406470
add esp, 8
test al, al
je 0x405d94
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
ja 0x405dae
jb 0x405d94
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jae 0x405dae
mov ebx, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push edi
push 0x491260
call esi
test eax, eax
je 0x405db7
mov byte [ebx], 1
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x46abaf], 0
je 0x405dda
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push edi
push 0x491260
call esi
test eax, eax
jne 0x405dae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
je 0x405dae
call fcn.00403060
push 0x491260
push str._rError_copying__s_to_remote_system:_n
push 2
call fcn.00413ed7
add esp, 4
push eax
call fcn.00402680
push esi
call fcn.004040a0
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405e20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call fcn.00405390
add esp, 4
test eax, eax
jne 0x405e55
call fcn.00403060
push str._rError_initializing_crypto:_n
jmp 0x405f50
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405e7e
call fcn.00403060
push str._rError_reading_public_key_length_from_PsExec_services:_n
jmp 0x405f50
push dword [ebp - 8]
call fcn.004139ef
add esp, 4
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
push 0
push ecx
push dword [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405eb0
call fcn.00403060
push str._rError_reading_public_key_from_PsExec_service:_n
jmp 0x405f50
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [edi]
call fcn.00405310
add esp, 0x14
test eax, eax
jne 0x405ed6
call fcn.00403060
push str._rError_importing_public_key:_n
jmp 0x405f50
push dword [ebp - 4]
call fcn.004139ea
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push 0x6610
push dword [ebp - 0x10]
push dword [edi]
call fcn.00405230
add esp, 0x1c
test eax, eax
jne 0x405f12
call fcn.00403060
push str._rError_generation_session_key:_n
jmp 0x405f50
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0xc]
push 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call edi
test eax, eax
je 0x405f46
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call edi
test eax, eax
je 0x405f46
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00403060
push str._rError_sending_session_key_to_PsExec_service:_n
push 2
call fcn.00413ed7
add esp, 4
push eax
call fcn.00402680
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004040a0
mov eax, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x405f80
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x405f90
push eax
call fcn.004139ea
add esp, 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4062f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406327
mov ecx, dword [ebp + 0x14]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x406310
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406330
mov eax, dword [ebp + 0x10]
sub ecx, edx
sar ecx, 1
add eax, ecx
push ebx
push edi
lea eax, [eax*2 + 4]
push eax
call fcn.004139ef
mov ebx, dword [ebp + 0xc]
add esp, 4
mov edi, eax
mov dword [ebp - 4], edi
test ebx, ebx
je 0x406426
cmp word [ebx], 0
je 0x406426
mov edx, edi
mov eax, ebx
sub edx, ebx
nop word [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x406380
push 0x3b
push edi
call fcn.0040aa74
add esp, 8
test eax, eax
je 0x4063a4
xor ecx, ecx
mov word [eax], cx
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4063b0
mov eax, dword [0x45c368]
mov edx, esi
mov dword [edi], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4063c5
mov edi, dword [ebp - 4]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4063e0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406438
push 0x3b
push ebx
call fcn.0040aa74
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x406426
mov esi, dword [ebp + 8]
add ebx, 2
jne 0x406366
push edi
call fcn.004139ea
add esp, 4
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov ecx, edi
sub edx, edi
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x406440
push edi
call fcn.004139ea
add esp, 4
mov al, 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441cdc
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00441a63

Function at 0x443e92
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044366c

Function at 0x443e9d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004438a7

Function at 0x44bf59
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044bb5e

Function at 0x44bf64
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044bcdf
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10008e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x10086280]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xe731dc89
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0x8b564a18
je 0x10008fba
jmp 0x10008e35
mov eax, dword [ebp - 0x14]
sub eax, 0xba9bfa23
je 0x10008fa9
jmp 0x10008e48
mov eax, dword [ebp - 0x14]
sub eax, 0xbe2d495f
je 0x10008ec3
jmp 0x10008e5b
mov eax, dword [ebp - 0x14]
sub eax, 0xe731dc89
je 0x10008e86
jmp 0x10008e6e
mov eax, dword [ebp - 0x14]
sub eax, 0x74fb35ed
je 0x10008f36
jmp 0x10008e81
jmp 0x10008fc1
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x87
sub byte [edi], 0x35
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x10008e96
mov dword [ebp - 0x10], 0xbe2d495f
jmp 0x10008fc1
mov ecx, dword [0x1008778c]
mov eax, dword [0x10087788]
mov edx, ecx
sub edx, 0xdec112a7
sub edx, 1
add edx, 0xdec112a7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8b564a18
mov ecx, 0x74fb35ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x10008fc1
mov ecx, dword [0x1008778c]
mov eax, dword [0x10087788]
mov edx, ecx
add edx, 0x7567d1b8
sub edx, 1
sub edx, 0x7567d1b8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8b564a18
mov ecx, 0xba9bfa23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x10008fc1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10025e30
add esp, 0xc
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0x74fb35ed
jmp 0x10008e1f
Function at 0x1000b980
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions
Execute shellcode via indirect call
Hash data using murmur3
Hide graphical window
Parse credit card information
Parse pe header
Resume thread

Disassembly:
jmp 0x100106bb
sete cl
and cl, 1
jmp 0x10018379
push ebp
test eax, 0xd9ab9e04
sar cl, cl
sub ecx, edx
mov ebp, esp
cbw
and dh, 6
shl cl, 0x2e
push ebx
dec cx
stc
sbb dl, 0xc
push edi
sub edx, 0x89a1db0
clc
rdtsc
push esi
cwde
sub esp, 0x220
cwde
mov eax, dword [0x10086280]
xor eax, ebp
bsr edx, ecx
rcr cx, 0x96
mov dword [ebp - 0x10], eax
and edx, 0x70943798
bt dx, 0x86
mov ecx, dword [0x10087764]
bt edx, ebx
mov eax, dword [0x10087760]
clc
rcr dl, cl
sub esi, esi
bt edx, esp
lea esi, [esi - 1]
clc
mov edx, ecx
cmp bp, 0xe533
add edx, esi
test bh, ah
cmp sp, 0xc989
imul ecx, edx
stc
clc
and ecx, 1
cmp ah, 0x8f
cmp ecx, 0
jmp 0x10010269
cmp eax, 0xa
setl al
and al, 1
stc
mov byte [ebp - 0x221], al
bt ax, bx
mov dword [ebp - 0x228], 0xcef8d2d3
mov byte [ebp - 0x222], cl
jmp 0x10015ff7

Function at 0x1002ae4a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002ae89
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002ae89
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002ae89
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002ae89
cmp dword [ecx + 0x74], 0xe
jbe 0x1002ae89
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002d814
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002d8b1
push ebx
push esi
call fcn.1002d7dd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002d771
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002d85e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d8b0
push edi
push eax
call fcn.1002c112
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002d87e
call fcn.1002c160
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d8af
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002d771
add esp, 0x20
test eax, eax
jne 0x1002d89d
push edi
call fcn.1002c160
jmp 0x1002d8a5
push ebx
call fcn.1002c160
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002db1e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036540
push 0x10036538
push str.FlsAlloc
push 0x1f
call fcn.1002da3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002db52
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034150]
call esi
jmp 0x1002db58
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002db9c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036550
push 0x10036548
push str.FlsGetValue
push 0x21
call fcn.1002da3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002dbd3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002dbdb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036558
push 0x10036550
push str.FlsSetValue
push 0x22
call fcn.1002da3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002dc15
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10034150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10033120
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003314d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003314d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x538d5a
Capabilities:
Encrypt data using speck

Disassembly:
shl edx, 2
mov eax, ebp
add eax, edx
mov dword [ebp - 4], eax
sal dword [esp + 4], 0xf3
not word [esp + 4]
test ebx, ebx
mov dword [esp], 0xfcabb03b
jmp 0x59a3be
lea esp, [esp + 8]
je 0x6157a9
mov eax, 0x143f2aa6
imul ax, ax
mov eax, dword [ebp + ebx*4]
jb 0x5c530f
push eax
dec ebx
call 0x61579f
push 0x3f14038a
mov eax, dword [ebp]
call fcn.005f132d
dec edi
lcall 0xd3a5, 0x178dfb08
xchg byte [ecx - 0x4c], al
cmpsb byte [esi], byte es:[edi]
push ecx
mov bh, byte [ecx]
adc dword [edx - 0x4afdbf0e], esp
int 0xa4
push ss
or dword [esi], ebx
int1
retf

Function at 0x558bb1
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00542c48
mov edi, 0x32106b36
neg edi
sbb ebp, 1
dec di
sar di, 0xe5
ror di, 0x42
movzx edi, word [ebp]
js 0x5830d6
xor di, bx
rol di, 1
call fcn.0072e636
cdq
mov esp, 0xb55a4f69
pushal
movsb byte es:[edi], byte [esi]
adc eax, 0xe3db521
adc dword [esi + esi*4], eax
shr edx, 0x99
scasb al, byte es:[edi]
cli
jmp 0x566f02
sbb al, 0xc9
fcomp qword [ebx]
invalid
jbe 0x719d9d
mov ebp, 0x5130ab8d
add ebp, ebp
push ebp
mov ebp, dword [edi]
adc edi, 4
call fcn.0070d707
jp 0x566e86

Function at 0x567f6a
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.005f2a58
mov ecx, 0x8d0cce0a
ror ecx, 0x28
jae 0x5b5aa8
rep stosd dword es:[edi], eax
jmp fcn.005a38f2
call fcn.00727daf
mov dword [esp + 4], 0x88955f2e
call fcn.00599094
mov edx, 0xbd2b73b4
mov edi, dword [ebp]
imul edx, edx
sar edx, 0x29
bt edx, edx
mov edx, dword [ebp + 4]
jb 0x567f65
insd dword es:[edi], dx
inc ebx
nop
out 0xb3, al
wait
dec ecx
pushfd
insb byte es:[edi], dx
push esi
cmp cl, byte fs:[edi - 0x7a]
aad 0xa0
shl byte [ebp + 0x7323b630], 1
rcr dword [ebx + 0xc], 0x4e
sbb al, 0xb2
pop es
xor dword [ebp + 0x37], 0x8e70a580
jnp 0x5b65ce
mov ecx, 0x3820f5ca
out dx, al
pop edi
sar edi, 0xff
invalid

Function at 0x57cef7
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [edx*4 + 0x6f13d11d]
pop ebx
mov eax, dword [esp + edx - 0x28b4276e]
mov ebx, dword [esp + edx - 0x28b4276a]
call fcn.00746681
sti
sub ah, bl
sbb eax, 0x659deb5
mov ecx, 0x604578e1
lea ecx, fs:[edx + ecx + 4]

Function at 0x58a351
Capabilities:
Encrypt data using speck

Disassembly:
mov cl, byte [edi + ecx - 0x614f30a1]
ror word [esp + 1], 0x4b
neg dword [esp]
adc edi, 3
sar word [esp], 0x87
neg word [esp + 1]
jp 0x5844f1
shrd ax, dx, cl
call fcn.0060c6f7
rol dl, 5
sbb cl, 0xa7
push edx
and dl, dl
shr dword [esp + edx - 0x1dd45312], 0xd3
xor bl, cl
lea ecx, [esp + ecx + 4]
call fcn.0054a3e5
mov edi, 0xe384301f
sar di, 0xa4
push edi
sbb ebp, 1
movzx edi, word [ebp]
push 0x128b96a2
shl dword [esp + 4], 0x5b
call fcn.0071718d
jp 0x74e271
jmp 0x5f728d
sal byte [esp + 7], 0x82
rol al, 1
xor al, 0x2f
xor bl, al
jmp 0x5d35a7
shr byte [esp + 8], 0x82
push 0xbf17d493
lea eax, [esp + eax + 0x10]
jns 0x588c90
test sp, 0x123b
mov ax, word [edi]
mov edx, 0x8a1d89ae
lea ecx, [edx + edx*4 - 0x51447fc1]
mov dx, word [edi + ecx - 0x614f30a3]
push ecx
jmp 0x56c9c7
mov word [eax], dx
lea esp, [esp + 0x10]
jns fcn.005d2f6f