joyce8/EMBER2024-capa huggingface dataset:
Function at 0x636480
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x6364a3
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x6364c9
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x6364b0
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x636580
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x6365b7
push esi
call fcn.006680d0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x6365b0
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x636636
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x636620
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x6365da
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x636619
cmp eax, 2
je 0x636620
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x6365d0
cmp eax, 3
je 0x6365fd
cmp eax, 1
jne 0x6365d0
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x6365d0
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x6365d0
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.00636480
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x63664d
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.00636480
pop esi
pop ebp
ret 4

Function at 0x63d4b5
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov dword [esi + 4], ecx
lea eax, [ecx + eax - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 4], eax
jne 0x63d4fa
mov ecx, 0x100000
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x669556
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x669565
xor eax, eax
jmp 0x669648
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x669628
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
inc edx
dec edi
jne 0x669585
pop edi
test eax, eax
je 0x669642
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6ddc00]
inc edx
dec eax
jne 0x66962c
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x6697e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x669815
test ecx, ecx
jne 0x66981f
test esi, esi
jne 0x66981f
mov eax, edx
jmp 0x669890
cmp eax, 0xffffffff
jne 0x66981f
push 0xfffffffffffffffe
pop eax
jmp 0x669890
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x669890
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x669855
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x669874
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x66993d
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x6698b5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6698bf
xor ecx, ecx
jmp 0x6698fe
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x6698e1
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.0068fe18
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x669929
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x66993d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x6697f7
pop edi
pop esi
leave
ret
Function at 0x23627b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x237703c], 0x8088405
inc edx
mov dword [0x237703c], edx
mul edx
mov eax, edx
ret

Function at 0x23693ac
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov ebp, edx
mov dword [esp], eax
xor ebx, ebx
mov esi, dword [esp]
lea edi, [esp + 4]
mov byte [esi], bl
mov eax, ebx
cdq
idiv ecx
add edx, ebp
mov al, byte [edx]
mov byte [edi], al
inc ebx
inc edi
inc esi
cmp ebx, 0x100
jne 0x23693c4
xor esi, esi
mov ebx, pe_nt_image_headers32
mov eax, dword [esp]
lea edi, [esp + 4]
mov dl, byte [eax]
xor ecx, ecx
mov cl, dl
add esi, ecx
xor ecx, ecx
mov cl, byte [edi]
add esi, ecx
and esi, 0xff
mov ecx, dword [esp]
mov cl, byte [ecx + esi]
mov byte [eax], cl
mov ecx, dword [esp]
mov byte [ecx + esi], dl
inc edi
inc eax
dec ebx
jne 0x23693ea
mov edx, dword [esp]
mov eax, dword [esp]
add eax, 0x100
mov ecx, pe_nt_image_headers32
call fcn.02365250
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x2369444
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor edx, edx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x23694d5
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
inc ecx
and cl, 0xff
xor ebx, ebx
mov bl, cl
add dl, byte [eax + ebx]
and dl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov byte [ebp - 9], bl
mov esi, edx
and esi, 0xff
xor ebx, ebx
mov bl, cl
lea edi, [eax + ebx]
mov bl, byte [eax + esi]
mov byte [edi], bl
mov bl, byte [ebp - 9]
mov byte [eax + esi], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov esi, edx
and esi, 0xff
add bl, byte [eax + esi]
and bl, 0xff
mov byte [ebp - 9], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 9]
xor bl, byte [eax + esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov byte [esi + edi], bl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x236946a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x236bad4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
xor edi, edi
mov dword [ebp - 0x10], 0x67452301
mov dword [ebp - 0xc], 0xefcdab89
mov dword [ebp - 8], 0x98badcfe
mov dword [ebp - 4], 0x10325476
mov eax, ebx
shl eax, 3
mov edx, eax
add edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x54]
jae 0x236bb1d
inc dword [ebp - 0x58]
add dword [ebp - 0x54], eax
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x58], eax
mov esi, dword [ebp + 0xc]
cmp ebx, 0x40
jb 0x236bb45
mov edx, esi
lea eax, [ebp - 0x10]
call fcn.0236bbe4
add esi, 0x40
sub ebx, 0x40
cmp ebx, 0x40
jae 0x236bb30
test ebx, ebx
jbe 0x236bb5a
mov edi, ebx
lea eax, [ebp - 0xa8]
mov ecx, edi
mov edx, esi
call fcn.02365250
push edi
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0x50]
mov ecx, edi
call fcn.02365250
mov byte [ebp + edi - 0x50], 0x80
lea eax, [edi + 1]
cmp eax, 0x38
jbe 0x236bba3
mov edx, 0x40
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.02365264
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.0236bbe4
xor eax, eax
mov edx, 0x38
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.02365264
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.0236bbe4
mov eax, dword [ebp + 8]
mov edi, eax
lea esi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x237109c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x23711ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.023635f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.02371024
mov edx, dword [ebp - 0xc]
mov eax, 0x2371208
call fcn.023638dc
test eax, eax
je 0x23710ef
mov byte [0x2377a8c], 1
cmp byte [0x2377a8c], 0
je 0x23711d2
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.023635f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.02371024
mov edx, dword [ebp - 0xc]
mov eax, 0x237121c
call fcn.023638dc
test eax, eax
jne 0x23711d2
mov edx, 0x2371228
mov ecx, 4
mov eax, ebx
call fcn.02370ed0
test eax, eax
jne 0x2371147
mov edx, ebx
add edx, 4
mov eax, ebx
call fcn.02370ea8
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push ebx
call fcn.02365138
mov ebx, eax
cmp ebx, 0xffffffff
je 0x23711d2
push 0
push 0
push 0
push 2
push 0
push ebx
call fcn.02365140
mov esi, eax
push ebx
call fcn.02365128
test esi, esi
je 0x23711d2
push 0
push 0
push 0
push 4
push esi
call fcn.02365208
mov ebx, eax
test ebx, ebx
je 0x23711d2
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x23711d2
mov eax, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x23711d2
mov edi, eax
mov eax, dword [eax + 0x1c]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.02370ef8
test al, al
je 0x23711c6
mov byte [ebp - 1], 1
push ebx
call fcn.02365218
push esi
call fcn.02365128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x23711f4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.02363464
ret

Function at 0x23712dc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ebp

Function at 0x2372268
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x2372279
mov al, 1
ret
Function at 0x237c651
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x237c66e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x237c65f
add dl, dl
jne 0x237c679
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x237c6c5
xor eax, eax
add dl, dl
jne 0x237c686
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x237c762
add dl, dl
jne 0x237c695
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x237c6a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x237c6ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x237c6b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x237c6c0
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x237c665
mov eax, 1
add dl, dl
jne 0x237c6d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x237c6de
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x237c6ca
sub eax, 2
jne 0x237c70d
mov ecx, 1
add dl, dl
jne 0x237c6f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x237c6fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x237c6ea
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x237c665
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x237c724
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x237c72f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x237c71b
cmp eax, 0x7d00
jae 0x237c752
cmp eax, 0x500
jb 0x237c74d
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x237c665
cmp eax, 0x7f
ja 0x237c755
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x237c665
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x237c77e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x237c665
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x668657ef
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x4fa21c7b
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x806048
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x80604e
pop ebp
sub ebp, 6
sub ebp, 0x406048
jmp 0x8060ac
jmp 0x8060b5
mov eax, 0x406048
add eax, ebp
add eax, 0x93
mov ecx, 0x621
mov edx, 0x9fa86543
xor byte [eax], dl
inc eax
dec ecx
jne 0x8060cc
jmp 0x8060df
sub dword [ebx], eax
sub eax, dword [ebx + 0x53]
inc ebx
inc ebx
sub eax, dword [ebx - 0x71]
outsd dx, dword [esi]
inc ebx
ret 0xf2b3

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x19cc74ca
mov byte [esi + eax - 0x6e], dh
cmc
retf 0x1a33
fidivr word [edx - 0x2c71a5e9]
mov edx, 0xd38e5a17
xchg ebx, eax
fisttp qword [ebx - 0x66b365ce]
jo 0x4153e1
mov esi, dword [edx]
lcall 0x7df6, 0xf270994c
fld xword [eax - 0x5d338ae0]
je 0x415408
idiv byte [ebp - 0x25]
test al, 0x20
jne 0x4153c2
mov byte [0xc8e0f74], al
arpl word [edx], si
mov cs, word [ebx]
xor dh, byte [ebx]
ret 0x8bdf
xor eax, edx
fisttp word [ebx - reloc.ole32.dll_CoInitializeEx]
xor ecx, dword [edx - 0x24]
sti
jb 0x4153fd
je 0x4153e8
int3
Function at 0x1002e9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x50]
cmp edx, dword [ecx + 0x54]
jae 0x1002e9e3
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x50], ecx
jmp 0x1002ea97
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4c], 0
jl 0x1002ea93
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58]
mov dword [ebp - 0xc], edx
push 0xfa0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4c]
push edx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1002ea31
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 4
je 0x1002e9f9
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0xb
je 0x1002e9f9
cmp dword [ebp - 8], 1
jge 0x1002ea47
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], 0xffffffff
mov byte [ebp - 1], 0
jmp 0x1002ea91
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x50], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x54], eax
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x1002ea91
mov edx, dword [ebp + 8]
push edx
call sym.glib_2.0.dll_g_scanner_sync_file_offset
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x50]
mov dword [eax + 0x54], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], 0xffffffff
jmp 0x1002ea97
mov byte [ebp - 1], 0
movzx ecx, byte [ebp - 1]
cmp ecx, 0xa
jne 0x1002eab8
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x1002eacd
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002eacd
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x1002ecf9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [esp + 8], 1
jne 0x1002ed96
mov eax, dword [str.KERNEL32.dll]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push eax
call esi
push 0
mov ebx, eax
call esi
mov edi, eax
xor ecx, ecx
mov esi, dword [edi + 0x3c]
add esi, edi
movzx eax, word [esi + 0x14]
movzx edx, word [esi + 6]
add eax, 0x3c
test edx, edx
je 0x1002ed46
add eax, esi
nop dword [eax]
cmp dword [eax], 0
jl 0x1002ed46
inc ecx
add eax, 0x28
cmp ecx, edx
jl 0x1002ed39
mov esi, dword [esi + 0x28]
mov eax, dword [0x100e7554]
add esi, edi
sub eax, dword [fcn.10064ce6]
sub esi, eax
mov dword [esp + 0x14], 0
mov eax, dword [str.VirtualProtect]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x100e754c]
push 0x40
push ecx
push esi
call eax
mov eax, dword [0x100e754c]
push eax
mov eax, dword [fcn.10064ce6]
push eax
push esi
call fcn.1002eca9
add esp, 0xc
or al, 0x5f
pop esi
pop ebx
mov eax, 1
ret 0xc

Function at 0x10037a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.glib_2.0.dll_g_option_context_get_help
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x100e2b1c
call sym.glib_2.0.dll_g_print
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call sym.glib_2.0.dll_g_free
add esp, 4
push 0
call dword [sym.imp.MSVCR90.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x402029
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4060e0
cmp edx, dword [eax]
je 0x40204b
add eax, 8
inc ecx
cmp eax, 0x406170
jl 0x40203c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4060e0]
jne 0x402179
mov eax, dword [0x40648c]
cmp eax, 1
je 0x402153
test eax, eax
jne 0x40207c
cmp dword [0x406034], 1
je 0x402153
cmp edx, 0xfc
je 0x402179
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4020b3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004026e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402850
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4020f6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402850
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053a0
push edi
call fcn.00401160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004026e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004026f0
lea eax, [ebp - 0xa0]
push 0x405380
push eax
call fcn.004026f0
push dword [esi + 0x4060e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004026f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403b61
add esp, 0x2c
pop edi
jmp 0x402179
lea eax, [ebp + 8]
lea esi, [esi + 0x4060e4]
push 0
push eax
push dword [esi]
call fcn.00402850
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x408027
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x40803c
popal
leave
ret 0xc

Function at 0x408347
Capabilities:
Resolve function by parsing pe exports

Disassembly:
enter 0, 0
pushal
mov edi, dword [ebp + 0xc]
xor ecx, ecx
dec ecx
xor al, al
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [ebp + 8]
add edx, dword [edx + 0x3c]
mov edx, dword [edx + 0x78]
add edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
xor ebx, ebx
mov esi, dword [ebp + 8]
add esi, dword [ebx + eax]
mov edi, dword [ebp + 0xc]
push ecx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x408380
add ebx, 4
jmp 0x40836c
shr ebx, 1
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov bx, word [ebx + eax]
shl ebx, 2
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov eax, dword [ebx + eax]
add dword [ebp + 8], eax
popal
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x4083a3
Capabilities:
Parse pe header

Disassembly:
enter 0, 0
pushal
mov eax, dword [ebp + 8]
xor ax, ax
cmp word [eax], 0x5a4d
je 0x4083b8
dec eax
jmp 0x4083ab
mov edx, eax
add edx, dword [eax + 0x3c]
cmp dword [edx], 0x4550
je 0x4083c7
xor eax, eax
mov dword [ebp + 8], eax
popal
mov eax, dword [ebp + 8]
leave
ret 4