joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10111ee6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x101b633c]
add edx, 0xffffef19
mov dword [0x101b6340], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10111978
lea ecx, [esp + 0x38]
mov edx, dword [esp + 0x28]
add ecx, 0x20
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
lea eax, [0x1011226d]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [esp + 0x8c], 0x12fe00
mov esi, dword [0x101b6328]
mov dword [esp + 0x88], esi
mov esi, dword [0x101b632c]
mov dword [esp + 0x4c], esi
mov esi, dword [0x101b6330]
mov dword [esp + 0x40], esi
mov esi, dword [0x101b6334]
mov dword [esp + 0x64], esi
mov esi, dword [0x101b6338]
mov dword [esp + 0x38], esi
mov dword [0x101b6340], 0x717
mov dword [0x101b633c], 0x127a
mov dword [esp + 0x14], eax
jmp 0x10112005
lea eax, [esp + 0x38]
mov dword [0x101b633c], 0xf39
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101125f4
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x10], eax
jmp 0x10111fe9
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x10112016
jmp 0x10111ff3
mov eax, dword [esp + 0x10]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
je 0x10111fd3
jmp 0x10111ff3
mov eax, dword [esp + 0xc]
mov dword [esp + 0x70], eax
mov dword [0x101b633c], 0x25db
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x54], edx
call fcn.10111d5d
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x10111f9d
jmp 0x10111fe9
Function at 0x101120d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, 0x2448
mov dword [0x101b6344], 0
mov dword [0x101b6348], 0
mov dword [0x101b6354], 0
mov dword [0x101b633c], 0x2448
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x10112265
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
mov dword [0x101b6340], 0x264a
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x101b6344], edx
mov ecx, dword [ebp - 0x34]
add ecx, 0xffffffa9
mov dword [0x101b633c], ecx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x101b6348], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101b634c], cl
mov dword [0x101b6340], 0x20ef
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x101b634c]
mov edx, dword [0x101b6348]
mov byte [edi + edx], cl
mov edx, dword [0x101b633c]
mov ebx, edx
add ebx, 0xffffe99b
mov dword [0x101b6340], ebx
mov ebx, dword [0x101b6344]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x101b6348]
movzx ecx, byte [edi + ecx]
add ecx, ebx
and ecx, 0xff
mov dword [0x101b6354], ecx
mov dword [0x101b6340], 0x1562
mov cl, byte [edi + ecx]
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [ebx + esi]
add edx, 0x5a6
mov dword [0x101b6340], edx
xor ch, cl
mov dword [0x101b633c], 0x6a8
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x3c], esi
je 0x10112265
mov eax, dword [0x101b6344]
mov ecx, dword [0x101b633c]
mov edx, dword [0x101b6348]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], esi
jmp 0x10112140
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10112407
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x101b633c], 0x15d2
mov dword [0x101b6340], 0x1167
mov dword [ebp - 0x10], eax
call fcn.1011136a
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10112457
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [0x101b6340], 0xfffffc1e
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x101b633c], 0x901
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x10112593
jmp 0x10112521
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x101b6340], 0x1d20
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x34], edx
jmp 0x10112593
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x34], eax
jb 0x10112531
jmp 0x10112593
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
je 0x10112583
jmp 0x10112557
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x101b6340], 0x1167
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edx
jmp 0x101124f6
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x52]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x48], eax
jne 0x101124f6
mov al, byte [ebp - 0x52]
test al, 1
jne 0x101124a3
jmp 0x101124cd
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101125f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x101b633c]
add esi, 0xffffe61c
mov dword [0x101b6340], esi
mov dword [0x101b633c], 0x1cc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
jmp 0x10112737
mov eax, dword [ebp - 0x38]
mov dword [0x101b6340], 0x12d8
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101b6340]
add ecx, 0x206f
mov dword [0x101b633c], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.101116a2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x3c], 0xd0
mov dword [0x101b633c], 0x22f9
mov dword [edx + 0xd0], 0x4550
add edx, 0xffc00000
mov dword [0x101b6340], 0x2203
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x48], edx
mov edx, dword [ebp - 0x3c]
mov dword [esi + 4], edx
mov edi, dword [0x101b633c]
add edi, 0xffffe791
mov dword [0x101b633c], edi
add edx, 0x1fef
mov edi, dword [ebp - 0x3c]
cmp edi, 0
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], eax
je 0x101126fa
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x54
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x28]
mov dword [0x101b633c], 0x179a
mov dword [ebp - 0x4c], eax
call fcn.10112963
mov dword [esp], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
call fcn.101114e7
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1011275f
jmp 0x1011262e
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x1016fdc8]
mov dl, byte [eax + 0x1016fd99]
sub dl, cl
mov byte [ebp + eax - 0x28], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
je 0x10112704
jmp 0x10112737
xor eax, eax
add esp, 0x54
pop esi
pop edi
pop ebp
ret
Function at 0x10010ad2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1001c68c], 0
push esi
push edi
jne 0x10010a48
call fcn.100109b4
test eax, eax
je 0x10010a8d
mov eax, dword [0x1001c68c]
cmp eax, 1
jne 0x10010a69
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10010a8d
jmp 0x10010acf
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10010acf
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10010a91
xor eax, eax
jmp 0x10010acf
mov eax, dword [esi]
push dword [0x1001c68c]
call edi
mov edi, eax
test edi, edi
je 0x10010ab3
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x10010acf
lea edi, [esi + 0xff0]
push esi
push dword [0x1001c68c]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x10010ab9
mov eax, esi
pop edi
pop esi
ret
jmp 0x10010a34

Function at 0x10010e30
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001c578]
jne 0x10010e3a
repz ret
jmp fcn.1001165a

Function at 0x10011310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001131f
pop dword [ebp - 0xc]
mov eax, 0x19ae9099
sub eax, 0x9ad7d7a
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3d1cf
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x106f16fe
sub ecx, 0x106ebe7a
xor edx, edx
add edx, eax
mov ebx, 0xac4a95cd
add ebx, 0x63b77033
add ebx, dword [ebp - 0xc]
mov esi, 0xf8ab89ae
xor dword [ebp - 4], ecx
mov edi, dword [ebx]
sub dword [ebp - 4], edi
sub edi, esi
mov dword [edx], edi
xor dword [ebp - 8], 0x391a2175
add edx, 4
add ebx, 0x358d65a7
add ebx, 0xca729a5d
loop 0x10011375
add eax, 0x8b59699a
add eax, 0x74a7eb49
mov ebx, eax
add eax, 0x95359726
sub eax, 0x95359721
mov ecx, 0x6bd55a9c
sub ecx, 0x5bd55a9c
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x405b91
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405e5c
test bl, 8
mov dword [ebp - 8], eax
je 0x405bd0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x47afc8], eax
jmp 0x405d4d
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405bea
test eax, eax
je 0x405cfb
test bl, 2
je 0x405cfb
mov esi, 0x460290
push edi
push esi
call fcn.0040647f
cmp dword [ebp + 8], 0
je 0x405c09
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405c0f
push edi
call fcn.00405da0
cmp word [edi], 0
jne 0x405c1f
cmp word [0x460290], 0x5c
jne 0x405c2a
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405cf0
cmp word [ebp - 0x22c], 0x2e
jne 0x405c74
cmp word [ebp - 0x22a], 0
je 0x405cd3
cmp word [ebp - 0x22a], 0x2e
jne 0x405c74
cmp word [ebp - 0x228], 0
je 0x405cd3
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040647f
test byte [ebp - 0x258], 0x10
je 0x405c9f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405cd3
push dword [ebp + 0xc]
push edi
call fcn.00405b91
jmp 0x405cd3
push dword [ebp - 4]
push edi
call fcn.00405b49
test eax, eax
jne 0x405ccb
cmp dword [ebp - 4], eax
je 0x405cc3
push edi
push 0xfffffffffffffff1
call fcn.004054e7
push 0
push edi
call fcn.00406245
jmp 0x405cd3
inc dword [0x47afc8]
jmp 0x405cd3
push edi
push 0xfffffffffffffff2
call fcn.004054e7
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405c4c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405cfb
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405d4d
cmp dword [ebp - 8], esi
jne 0x405d0f
inc dword [0x47afc8]
jmp 0x405d4d
push edi
call fcn.004067c2
test eax, eax
je 0x405d4d
push edi
call fcn.00405d54
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405b49
test eax, eax
jne 0x405d45
cmp dword [ebp - 4], esi
je 0x405d07
push edi
push 0xfffffffffffffff1
call fcn.004054e7
push esi
push edi
call fcn.00406245
jmp 0x405d4d
push edi
push 0xffffffffffffffe5
call fcn.004054e7
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1000eca3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000ece2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ece2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ece2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000ece2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000ece2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10011960
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100119fd
push ebx
push esi
call fcn.10011929
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100118bd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100119aa
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100119fc
push edi
push eax
call fcn.1001291b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100119ca
call fcn.10010405
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100119fb
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100118bd
add esp, 0x20
test eax, eax
jne 0x100119e9
push edi
call fcn.10010405
jmp 0x100119f1
push ebx
call fcn.10010405
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10011c6a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.10011b86
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011c9e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10011ca4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10011ce8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.10011b86
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011d1f
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10011d27
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.10011b86
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011d61
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100173e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001740d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001740d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x43b657
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
mov esi, ebx
sub ebx, ebx
or esi, esi
call fcn.0043b697
add esi, 1
mov ebx, ebx
add ebx, 1
xor dword [edx], eax
add esi, ebx
add ebx, 0x5e66b38e
inc edx
push 0xfa4f873a
pop ebx
or esi, ebx
cmp edx, ecx
jne fcn.0043b657
mov ebx, ebx
sub ebx, 0x4c75c216
ret
Function at 0x402f0f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408010]
jne 0x404450
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x409368], eax
mov dword [0x409364], ecx
mov dword [0x409360], edx
mov dword [0x40935c], ebx
mov dword [0x409358], esi
mov dword [0x409354], edi
mov word [0x409380], ss
mov word [0x409374], cs
mov word [0x409350], ds
mov word [0x40934c], es
mov word [0x409348], fs
mov word [0x409344], gs
pushfd
pop dword [0x409378]
mov eax, dword [ebp]
mov dword [0x40936c], eax
mov eax, dword [ebp + 4]
mov dword [0x409370], eax
lea eax, [ebp + 8]
mov dword [0x40937c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4092b8], 0x10001
mov eax, dword [0x409370]
mov dword [0x40926c], eax
mov dword [0x409260], 0xc0000409
mov dword [0x409264], 1
mov eax, dword [0x408010]
mov dword [ebp - 0x328], eax
mov eax, dword [0x408014]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4092b0], eax
push 1
call fcn.00406093
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x401d80
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4092b0], 0
jne 0x40453c
push 1
call fcn.00406093
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x403c8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403c9b
pop dword [ebp - 0x34]
mov eax, 0x6321989b
add eax, 0x9d1ea400
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x820feaa0
add dword [ebp - 0x44], 0xcc425aab
mov dword [ebp - 0x40], 0x1d496e79
add dword [ebp - 0x40], 0x14e9ddcc
mov dword [ebp - 0x3c], 0x65a3156c
add dword [ebp - 0x3c], 0xe6a92ec2
mov dword [ebp - 0x38], 0xae881d94
add dword [ebp - 0x38], 0x5177e26c
lea eax, [ebp - 0x44]
push eax
mov eax, 0x25cf2bd
sub eax, 0x21ce2a1
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x39e1df72
add dword [ebp - 0x44], 0x3a9089e4
mov dword [ebp - 0x40], 0x89176c81
sub dword [ebp - 0x40], 0x47ab0b0c
mov dword [ebp - 0x3c], 0x1d6c072a
sub dword [ebp - 0x3c], 0xb9fc9abe
mov dword [ebp - 0x38], 0x71534c
sub dword [ebp - 0x38], 0x71534c
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd55799c
add eax, 0xf2ea9688
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3938b
push 0
call eax
mov ecx, 0x4d32
xor edx, edx
add edx, eax
mov esi, 0xad99aa99
add esi, 0x52a98d67
add esi, dword [ebp - 0x34]
mov ebx, 0xdf5ef6cb
sub dword [ebp - 0x28], edi
mov edi, dword [esi]
xor dword [ebp - 0xc], edi
add edi, ebx
sub dword [ebp - 0x30], eax
mov dword [edx], edi
sub dword [ebp - 0x20], 0xcee3a57
add edx, 0x97c69346
sub edx, 0x97c69342
add esi, 0x573891fe
add esi, 0xa8c76e06
loop 0x403db3
add eax, 0xd62d3c07
add eax, 0x29d3eb94
mov ebx, eax
add eax, 0xc864806a
sub eax, 0xc8648065
mov ecx, 0x3ad2dfff
add ecx, 0xc56d2001
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4025c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [eax]
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x40260b
push esi
inc bl
movzx ebx, bl
mov edx, dword [eax + ebx*4 + 8]
add cl, dl
movzx ecx, cl
lea esi, [eax + ecx*4 + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [esi]
mov dword [eax + ebx*4 + 8], ecx
add cl, dl
mov dword [esi], edx
mov esi, dword [ebp + 8]
movzx ecx, cl
mov cl, byte [eax + ecx*4 + 8]
add esi, edi
xor byte [esi], cl
mov ecx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x4025d4
pop esi
pop edi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
leave
ret

Function at 0x404557
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ecx
push eax
add esp, 4
xor ecx, 0x2a7e
pop ecx
push eax
push edx
add esp, 4
sub eax, 0xa3ef
xor eax, 0x1392
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push eax
add eax, 0xde3c
and eax, 0x143e
jmp 0x4045be
pop eax
push ebx
push edi
add esp, 4
sub ebx, 0x9f8b
and ebx, 0x17f19
pop ebx
push esi
push edi
add esp, 4
xor esi, 0x37a8
pop esi
mov dword [ebp - 0x10], 1
push edi
call 0x4045f2
add byte [ebx + 0x3a], al
cmp byte [eax + 0x4a], al
aaa
dec ebp
add esp, 4
call 0x404604
add byte [eax], bh
cmp al, 0x3c
inc ecx
inc ebp
push eax
inc esp
aaa
add esp, 4
sub edi, 0x1766e
pop edi
push ebx
sub ebx, 0x183ad
pop ebx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push esi
add esp, 4
sub esi, 0x123d1
and esi, 0x2265
and esi, 0x3e87
pop esi
push eax
add eax, 0x9067
or eax, 0xb445
add eax, 0x88b3
xor eax, 0x4524
pop eax
push eax
call 0x40467b
add byte [edi], dh
inc edx