joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033500
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x1c]
push ebx
push esi
push edi
push eax
push 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x10033623
mov ebx, dword [esp + 0x1c0]
test ebx, ebx
jl 0x10033623
cmp ebx, 0xffff
jg 0x10033623
mov edi, dword [esp + 0x1c4]
push edi
call fcn.10034690
add esp, 4
cmp eax, 1
jne 0x10033570
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10033586
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.10034880
add esp, 8
test eax, eax
je 0x10033623
mov esi, dword [esp + 0x1bc]
xor edx, edx
lea ecx, [esp + 0x14]
push ebx
lea eax, [esi + 0x34]
push ecx
push esi
mov dword [eax], edx
mov byte [eax + 4], dl
call fcn.10033340
add esp, 0xc
mov dword [esi + 0xc], eax
test eax, eax
je 0x10033623
push eax
call fcn.10033880
push esi
lea edx, [esp + 0x18]
push 0x100333b0
push edx
mov dword [esi + 0x10], 0
call fcn.100348d0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x1003360c
push esi
lea ecx, [esp + 0x10]
push 0x10033420
push ecx
call fcn.100348d0
mov edx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x1c]
push 0x10033490
push eax
mov dword [esi + 0x18], edx
call fcn.100348d0
mov ecx, dword [esp + 0x24]
add esp, 0x18
mov dword [esi + 0x1c], ecx
call fcn.10033270
mov dword [esi + 8], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1ac
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1ac
ret

Function at 0x10033880
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
test eax, eax
setge dl
mov eax, edx
pop ecx
ret
Function at 0x10034880
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x1003488f
ret
mov ecx, dword [eax + 0xc]
push esi
push edi
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x100348d0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], eax
mov eax, edx
ret

Function at 0x10034900
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10034919
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0xcd1108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00cd1258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcd112e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd111a
add dl, dl
jne 0xcd1139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd118c
xor eax, eax
add dl, dl
jne 0xcd1146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd122d
add dl, dl
jne 0xcd1155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd1160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd116b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd1176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcd1182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcd1125
mov eax, 1
add dl, dl
jne 0xcd119a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd11a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd1191
sub eax, ebx
mov ebx, 1
jne 0xcd11d8
mov ecx, 1
add dl, dl
jne 0xcd11be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcd11c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd11b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd1125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcd11ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcd11fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd11e6
cmp eax, 0x7d00
jae 0xcd121d
cmp eax, 0x500
jb 0xcd1218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd1125
cmp eax, 0x7f
ja 0xcd1220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd1125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcd124e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcd1125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401c66
pop dword [ebp - 0x18]
mov eax, 0x740bc1
add eax, 0xffcc10a5
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x56d92ba1
sub dword [ebp - 0x28], 0x886e656
mov dword [ebp - 0x24], 0x260a38ed
add dword [ebp - 0x24], 0xc291358
mov dword [ebp - 0x20], 0x1598bad9
sub dword [ebp - 0x20], 0xc94c76ab
mov dword [ebp - 0x1c], 0x25412d7a
sub dword [ebp - 0x1c], 0x25412d7a
lea eax, [ebp - 0x28]
push eax
mov eax, 0xca6df828
add eax, 0x35d2382c
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x3169175f
add dword [ebp - 0x28], 0x430951f7
mov dword [ebp - 0x24], 0xa788793c
sub dword [ebp - 0x24], 0x661c17c7
mov dword [ebp - 0x20], 0xd6b25833
add dword [ebp - 0x20], 0x8cbd1439
mov dword [ebp - 0x1c], 0x1a1640f6
add dword [ebp - 0x1c], 0xe5e9bf0a
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x44a27216
sub eax, 0x446241ea
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x32ad2
push 0
call eax
mov ecx, 0x38c8
mov esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x18]
mov edi, 0x624d66c3
mov ebx, dword [edx]
xor dword [ebp - 0x14], ebx
sub ebx, edi
xor dword [ebp - 0xc], edi
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x84e8cb51
add esi, 4
add edx, 0xc0b1a21c
add edx, 0x3f4e5de8
loop 0x401d76
add eax, 0x13a9aed
sub eax, 0x139c4fa
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401050
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x427014]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x428bd0
push ebx
push esi
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401070
sub edx, esi
push ecx
sar edx, 1
push 0
push 0x1fffff
lea ebx, [edx*2 + 2]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4010be
push eax
push str.InjectDll
push 0x424974
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret
push edi
push 4
push 0x1000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
push 0
test edi, edi
jne 0x4010fc
push str.InjectDll
push str.DLL
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret
push ebx
push 0x428bd0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push edi
push dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
jne 0x4011ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x200
mov ebx, eax
mov dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00405610
add esp, 0xc
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40119a
lea ecx, [ebp - 0x208]
push ecx
push esi
call eax
test eax, eax
je 0x40119a
cmp dword [ebp - 0x208], 0
je 0x40119a
push ebx
lea eax, [ebp - 0x204]
push 0x4248e0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
lea eax, [ebp - 0x204]
push str.LoadLibrary
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x204]
push 0
push str.InjectDll
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x428dd8
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403589
mov esp, ebp
pop ebp
ret
Function at 0x402080
Capabilities:
Check if file exists

Disassembly:
push ebx
push 0x104
push 0x428bd0
push str.sdk.dll
mov bl, cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x428bd0
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test bl, bl
pop ebx
je 0x4020b6
push str.spy_debug.dll
jmp 0x4020bb
push str.spy.dll
push 0x428bd0
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x428bd0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4020ed
push eax
push 0x424aac
push 0x428bd0
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 2
ret
xor eax, eax
ret

Function at 0x402fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x427014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push str.SoftwareTencentWeChat
push 0x80000001
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x402fe7
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x208
push eax
push 0
push str.InstallPath
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40301a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40302a
test esi, esi
je 0x40302a
push str.WeChat.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x403038
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00403589
mov esp, ebp
pop ebp
ret

Function at 0x403200
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x27c
mov eax, dword [0x427014]
xor eax, esp
mov dword [esp + 0x278], eax
push edi
mov edi, ecx
call fcn.00403050
mov dword [edi], eax
test eax, eax
jne 0x4032ca
push 0x40
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0x44
push eax
call fcn.00405610
push 0x208
lea eax, [esp + 0x80]
push 0
push eax
call fcn.00405610
add esp, 0x18
lea ecx, [esp + 0x70]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
call fcn.00402fa0
test eax, eax
jne 0x4032cc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [esp + 0x90]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4032b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00403589
mov esp, ebp
pop ebp
ret
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov dword [edi], eax
xor eax, eax
mov ecx, dword [esp + 0x27c]
pop edi
xor ecx, esp
call fcn.00403589
mov esp, ebp
pop ebp
ret
Function at 0x403470
Capabilities:
Create thread
Inject thread
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
xor bh, bh
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ecx - 2]
cmp eax, 2
ja 0x4034c3
cmp ecx, 4
jne 0x4034d0
mov eax, dword [esi + 0xc]
mov ecx, str.debug
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4034b7
test dl, dl
je 0x4034ae
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4034b7
add eax, 2
add ecx, 2
test dl, dl
jne 0x403492
xor eax, eax
test eax, eax
sete bh
jmp 0x4034d0
sbb eax, eax
or eax, 1
test eax, eax
sete bh
jmp 0x4034d0
push str._nUsage:__n
call fcn.00403440
add esp, 4
mov ecx, dword [esi + 4]
mov edx, str.start
mov eax, ecx
nop word [eax + eax]
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x403500
test bl, bl
je 0x4034fc
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x403500
add eax, 2
add edx, 2
test bl, bl
jne 0x4034e0
xor eax, eax
jmp 0x403505
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403523
push 0xa
push eax
push dword [esi + 8]
call fcn.00409d3f
add esp, 0xc
mov cl, bh
mov edx, eax
pop esi
pop ebx
pop ebp
jmp fcn.004020f0
mov eax, str.stop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x403548
test dl, dl
je 0x403544
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x403548
add ecx, 2
add eax, 2
test dl, dl
jne 0x403528
xor eax, eax
jmp 0x40354d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403559
pop esi
pop ebx
pop ebp
jmp fcn.004024d0
push str._nUsage:__n
call fcn.00403440
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret

Function at 0x40f803
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040f679

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10086ac4], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x10003e8a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x10086ac0], eax
inc ebx
cmp ebx, 0x100
jb 0x10003df0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x10003eb6
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10086ac0]
sub edi, 1
jne 0x10003e95
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10003ee8
nop dword [eax]
cmp cl, 0x23
jne 0x10003ecf
cmp byte [esi], cl
jne 0x10003ecf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10086ac0]
test cl, cl
jne 0x10003ec0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10031c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
call fcn.1003b147
mov ecx, eax
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
lea eax, [esp + 0x14]
push eax
push 0
push ecx
push 0x1003b040
push 0
push 0
mov dword [ecx + 4], 0x100317e0
call dword [0x1003d254]
add esp, 0x18
mov dword [esp + 0x10], eax
test eax, eax
je 0x10031db8
cmp dword [esp + 0x14], 0
jne 0x10031cdc
push 1
call dword [0x1003d180]
call dword [0x1003d0ec]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jne 0x10031cf2
push 5
call dword [0x1003d180]
push 0
push ecx
push dword [esp + 0x18]
call dword [0x1003d0f0]
add esp, 0xc
test eax, eax
je 0x10031d0e
push 2
call dword [0x1003d180]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10031d13
sub ecx, edx
mov edx, 0
sar ecx, 1
je 0x10031daf
mov ebx, dword [0x10086130]
cmp ecx, 0x20
jb 0x10031d9f
lea eax, [esi - 2]
lea eax, [eax + ecx*2]
cmp esi, eax
jbe 0x10031d9f
movsx eax, bx
mov edi, ecx
and edi, 0xffffffe0
movd xmm0, eax
lea eax, [esi + 0x20]
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add edx, 0x20
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax - 0x60], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x50]
xorps xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x30]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
cmp edx, edi
jb 0x10031d60
cmp edx, ecx
jae 0x10031daf
movzx eax, bx
xor word [esi + edx*2], ax
inc edx
cmp edx, ecx
jb 0x10031da6
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
mov dword [esp + 0x18], 0
call dword [0x1003d180]
int3
Function at 0x10039820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
sub dword [ebp + 0xc], 1
jne 0x100398b4
push esi
push 0x20
call fcn.1003b147
mov esi, eax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp + 0xc], esi
mov edx, 8
add esp, 4
xor ecx, ecx
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0x948e8392
mov dword [ebp - 8], 0x848b82cb
mov byte [ebp - 4], 0xe9
mov word [ebp - 3], ax
mov byte [ebp - 1], al
nop
lea eax, [ecx - 0x1f]
xor byte [ebp + ecx - 0xc], al
inc ecx
mov edx, dword [ebp - 0x10]
cmp ecx, edx
jb 0x10039870
lea eax, [ebp - 0xc]
mov byte [ebp + edx - 0xc], 0
push eax
call dword [fcn.1003d080]
mov byte [esi], 0
test eax, eax
je 0x10039898
mov dword [esi + 4], eax
push 0
push 0
push 0
push 0x10039360
push 0
push 0
mov dword [0x10086950], esi
call dword [fcn.1003d028]
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100951cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10095218
push ecx
sub esp, 0x18
jmp 0x10095202
lea esp, [esp + 0x18]
push eax
push sp
lea esp, [esp + 2]
jmp 0x100953c0
push word [esp + 0x1b]
lea esp, [esp + 1]
lea esp, [esp + 0x20]
add eax, 0xb9
jmp 0x100951d1
mov al, byte [esp]
mov eax, dword [ebp - 0x74]
call fcn.10095242
lea esp, [esp + 4]
call dword [fcn.1003d02c]
cmp byte [ebp - 0x65], 0
jne 0x10093469
je 0x10095271
lea esp, [esp + 4]
call esi
jmp 0x100952f4
cmp dword [0xc7deea], 0
mov dx, 0x2386
rdtsc
jmp 0x10095303
test ax, ax
je 0x1009343d
mov al, 0x7d
rdtsc
jmp 0x100952de
mov eax, dword [0xc7ded0]
mov ecx, 0xb4ec7460
mov dl, byte [esp]
mov ecx, dword [0xc7dec8]
jmp 0x10095355
xchg al, ah
mov eax, 0xd9a8f356
setle ah
jmp 0x1009533f
lea edx, [edx - 0xcc]
mov edx, dword [esp]
mov edx, dword [0xc7decc]
mov dword [ebp - 0x6c], eax
jmp 0x10095318
push dword [0x100869c8]
push ecx
mov word [esp], di
mov word [esp], cx
jmp 0x100952b0
Function at 0x100967d8
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
lea eax, [ebp - 0x70]
push eax
jmp 0x100967ae
Function at 0x1090f158
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1090f162
pushal
call 0x1090f168
pop ebp
sub ebp, 0x10
sub ebp, 0x90f158
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1090f18c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1090f195
mov eax, 0x90f158
add eax, ebp
add eax, 0x63
mov ecx, 0x5c0
mov edx, 0x486e01d1
xor byte [eax], dl
inc eax
dec ecx
jne 0x1090f1ac
jmp 0x1090f1bf
pop edx
sbb al, 0x5a
pop eax
in eax, dx
rcl ecx, 1
rcl dword [eax + 0x10]
sub ecx, edx
rcl ecx, 1
rcr byte [ecx + ebp*2], cl
fcom st(1)
rcl ecx, 1
imul edi, ecx, 0xffffffd1
rcl ecx, 1
xor edx, edx
sbb dword [edx + 0x50], ebx
fst st(1)
rcl ecx, 1
rcl byte [esp + ebx*2], cl
mov ch, 0xf5
sub eax, 0x5cf5d558
mov ch, 0xf5
sub eax, 0xb9f5d558
mov dl, 0xcc
sar dword [ecx - 0x2e5da38b], 1
sar ch, 1
cmc
mov ecx, 0xe3bfe85b
cmp esp, edx
rcl ecx, 1
sar dword [eax], 1
out 0xd1, eax
rcl ecx, 1
pop esp
mov ch, 0xf5
sub eax, 0x5cf5fd58
mov ebp, 0x545ad1f5
invalid

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4064e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40650c
xor eax, eax
test eax, eax
je 0x40651f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40651f
xor ecx, ecx
jmp 0x406522
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406609
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x406640
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40661a
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406615
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406671
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406653
pop edi
not eax
pop esi
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219