joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481705
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x481733
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x481751
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048166b
jmp 0x481751
mov eax, dword [esi + 0x14]
test eax, eax
je 0x481751
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048166b
test edi, edi
mov eax, edi
jne 0x48173b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x9b2058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9b21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9b207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b206a
add dl, dl
jne 0x9b2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b20dc
xor eax, eax
add dl, dl
jne 0x9b2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b217d
add dl, dl
jne 0x9b20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9b20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9b2075
mov eax, 1
add dl, dl
jne 0x9b20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b20e1
sub eax, ebx
mov ebx, 1
jne 0x9b2128
mov ecx, 1
add dl, dl
jne 0x9b210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9b213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b2136
cmp eax, 0x7d00
jae 0x9b216d
cmp eax, 0x500
jb 0x9b2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b2075
cmp eax, 0x7f
ja 0x9b2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9b219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9b2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x103a95a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103a95aa
pushal
call 0x103a95b0
pop ebp
sub ebp, 0x10
sub ebp, 0x3a95a0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103a95d4
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103a95dd
mov eax, 0x3a95a0
add eax, ebp
add eax, 0x63
mov ecx, 0x5e9
mov edx, 0x3ceb8d42
xor byte [eax], dl
inc eax
dec ecx
jne 0x103a95f4
jmp 0x103a9607
leave
invalid
Function at 0x9ee058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9ee1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9ee07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ee06a
add dl, dl
jne 0x9ee089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ee0dc
xor eax, eax
add dl, dl
jne 0x9ee096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ee17d
add dl, dl
jne 0x9ee0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ee0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ee0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ee0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9ee0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9ee075
mov eax, 1
add dl, dl
jne 0x9ee0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ee0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ee0e1
sub eax, ebx
mov ebx, 1
jne 0x9ee128
mov ecx, 1
add dl, dl
jne 0x9ee10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ee119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ee105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ee075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9ee13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ee14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ee136
cmp eax, 0x7d00
jae 0x9ee16d
cmp eax, 0x500
jb 0x9ee168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ee075
cmp eax, 0x7f
ja 0x9ee170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ee075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9ee19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9ee075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x3001ccbc
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x3001ccdd
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x3001ccdd
cmp edx, eax
jb 0x3001ccdd
add eax, 0x10000
cmp eax, ecx
jae 0x3001cd08
mov eax, dword [0x30036574]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.3001e7c0
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.kernel32.dll_RaiseException]
ret
Function at 0x30030e08
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x30034158
call fcn.3003107e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x3006bf28
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30030bf8
cmp eax, esi
jne 0x30030beb
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x30030bfb
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x30030bd2
xor esi, esi
inc esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c0e
push 0x1f
call sub.msvcr80.dll__amsg_exit
pop ecx
jmp 0x30030c49
mov eax, dword [0x3006bf24]
test eax, eax
jne 0x30030c43
mov dword [0x3006bf24], esi
push 0x30001378
push 0x3000136c
call sub.msvcr80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30030c49
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x30030d20
mov dword [0x3006bbd0], esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c6d
push 0x30001368
push 0x30001350
call sub.msvcr80.dll__initterm
pop ecx
pop ecx
mov dword [0x3006bf24], 2
cmp dword [ebp - 0x1c], ebx
jne 0x30030c7a
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x3006bf34], ebx
je 0x30030c9b
push 0x3006bf34
call fcn.3003143c
pop ecx
test eax, eax
je 0x30030c9b
push ebx
push 2
push ebx
call dword [0x3006bf34]
mov eax, dword [0x3006bbb8]
mov ecx, dword [sym.imp.msvcr80.dll___winitenv]
mov dword [ecx], eax
push dword [0x3006bbb8]
push dword [0x3006bbbc]
push dword [0x3006bbb4]
call fcn.3001e7c0
add esp, 0xc
mov dword [0x3006bbcc], eax
cmp dword [0x3006bbc0], ebx
jne 0x30030d06
push eax
call dword [sym.imp.msvcr80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcr80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x3006bbd0], ebx
jne 0x30030d14
call dword [sym.imp.msvcr80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3006bbcc]
call fcn.300310c3
ret
call fcn.3001e7c0
jmp 0x30030bb0
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40288e
pop dword [ebp - 0x34]
mov eax, 0x5d5095d9
add eax, 0xa2ef92b5
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x4f07c5f
sub dword [ebp - 0x44], 0xb69e3714
mov dword [ebp - 0x40], 0xaed8bf8f
add dword [ebp - 0x40], 0x835a8cb6
mov dword [ebp - 0x3c], 0x2d5b326b
add dword [ebp - 0x3c], 0x1ef111c3
mov dword [ebp - 0x38], 0xd3ded9cd
sub dword [ebp - 0x38], 0xd3ded9cd
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x5d324d65
sub dword [ebp - 0x44], 0xe8bfe40f
mov dword [ebp - 0x40], 0xb16edd8
add dword [ebp - 0x40], 0x3655739d
mov dword [ebp - 0x3c], 0x6949992c
add dword [ebp - 0x3c], 0xfa25d340
mov dword [ebp - 0x38], 0x8d84d2e2
sub dword [ebp - 0x38], 0x8d84d2e2
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xbe851ef7
sub eax, 0xbe449e23
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x36baa
push 0
call eax
mov ecx, 0xa5ccd1b3
add ecx, 0x5a3376d5
xor edi, edi
add edi, eax
mov edx, 0xdadd8b20
sub edx, 0xda9c7b20
add edx, dword [ebp - 0x34]
mov esi, 0x96b7bf33
add esi, 0x3bda0dc8
sub dword [ebp - 0x24], edi
mov ebx, dword [edx]
add dword [ebp - 8], 0x1a1f837d
sub ebx, esi
xor dword [ebp - 0x24], ecx
mov dword [edi], ebx
add dword [ebp - 0x1c], 0xf4d92ace
add edi, 4
add edx, 0x281cc3f9
add edx, 0xd7e33c0b
loop 0x4029ad
add eax, 0x4d5a3d2
add eax, 0xfb2b7121
xor ebx, ebx
add ebx, eax
add eax, 0x19266992
add eax, 0xe6d99673
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x406190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x4061ba
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x427a50]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x16
jb 0x4061b0
mov eax, ecx
ret

Function at 0x4061e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x4061f2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x4061e8
mov eax, ecx
ret

Function at 0x10630058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106301a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1063007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063006a
add dl, dl
jne 0x10630089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106300dc
xor eax, eax
add dl, dl
jne 0x10630096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063017d
add dl, dl
jne 0x106300a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106300d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10630075
mov eax, 1
add dl, dl
jne 0x106300ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106300e1
sub eax, ebx
mov ebx, 1
jne 0x10630128
mov ecx, 1
add dl, dl
jne 0x1063010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10630119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10630105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10630075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1063013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1063014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10630136
cmp eax, 0x7d00
jae 0x1063016d
cmp eax, 0x500
jb 0x10630168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10630075
cmp eax, 0x7f
ja 0x10630170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10630075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1063019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10630075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.1000dd3f
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.1000dd3f
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.1000dd3f
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.1000dd3f
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.1000dd3f
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.1000dd3f
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.1000dd3f
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.1000dd3f
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x1000dd3f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000dd4e
pop dword [ebp - 0x40]
mov eax, 0x1000dd4e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x73a98c0e
sub dword [ebp - 0x50], 0x255746c3
mov dword [ebp - 0x4c], 0xf8a6d11e
sub dword [ebp - 0x4c], 0xc67384d9
mov dword [ebp - 0x48], 0xec2544fb
add dword [ebp - 0x48], 0x6026ff33
mov dword [ebp - 0x44], 0xbef8cf08
sub dword [ebp - 0x44], 0xbef8cf08
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x82f4a23e
add dword [ebp - 0x50], 0xf17dc718
mov dword [ebp - 0x4c], 0xbe05c9ed
add dword [ebp - 0x4c], 0x83669788
mov dword [ebp - 0x48], 0xb8b229c8
sub dword [ebp - 0x48], 0x5542bd5c
mov dword [ebp - 0x44], 0x424c5eb2
sub dword [ebp - 0x44], 0x424c5eb2
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c9a9
push 0
call eax
mov ecx, 0x81c98466
add ecx, 0x7e36bf17
xor ebx, ebx
add ebx, eax
mov edx, 0xb81bef59
add edx, 0x57e76aa7
add edx, dword [ebp - 0x40]
mov edi, 0x1edd0a4b
add edi, 0x7706994e
sub dword [ebp - 0x38], ecx
mov esi, dword [edx]
xor dword [ebp - 0x20], 0x7aa00843
sub esi, edi
add dword [ebp - 0x34], eax
mov dword [ebx], esi
add dword [ebp - 0x3c], ecx
add ebx, 4
add edx, 4
loop 0x1000de63
add eax, 0xb619e9d1
add eax, 0x49e716f6
xor ebx, ebx
add ebx, eax
add eax, 0x4848e6a4
add eax, 0xb7b71961
mov ecx, 0x309cd18a
sub ecx, 0x209cd18a
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x4770477d
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x63d0175
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40596d
pop dword [ebp - 0x40]
mov eax, 0xb650e9b6
add eax, 0x49ef6fb7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xf5957bdc
add dword [ebp - 0x50], 0x58bcc96f
mov dword [ebp - 0x4c], 0x3263949f
sub dword [ebp - 0x4c], 0x30485a
mov dword [ebp - 0x48], 0x63a851d0
add dword [ebp - 0x48], 0xe8a3f25e
mov dword [ebp - 0x44], 0x61ecf292
add dword [ebp - 0x44], 0x9e130d6e
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x8bbe33bf
add dword [ebp - 0x50], 0xe8b43597
mov dword [ebp - 0x4c], 0x385b9e74
add dword [ebp - 0x4c], 0x910c301
mov dword [ebp - 0x48], 0xc1915652
add dword [ebp - 0x48], 0xa1de161a
mov dword [ebp - 0x44], 0x43403a19
add dword [ebp - 0x44], 0xbcbfc5e7
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3d0eb
push 0
call eax
mov ecx, 0x615d
xor edx, edx
add edx, eax
mov ebx, 0x4dc8b85
add ebx, 0xfb64747b
add ebx, dword [ebp - 0x40]
mov edi, 0xda251e0c
sub edi, 0x7178e172
sub dword [ebp - 8], 0x6e1da21
mov esi, dword [ebx]
xor esi, edi
xor dword [ebp - 0x18], edx
mov dword [edx], esi
sub dword [ebp - 0x18], 0x64ee5ce4
add edx, 0xde77b160
sub edx, 0xde77b15c
add ebx, 4
loop 0x405a81
add eax, 0xd7dfa4d9
sub eax, 0xd7de2c92
mov ebx, eax
add eax, 0x7831d878
add eax, 0x87ce278d
mov ecx, 0x3f73d26
sub ecx, 0x3b73d26
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x10014a2
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001928
call fcn.01001634
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100125d
cmp eax, esi
jne 0x1001250
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001260
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001237
xor esi, esi
inc esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x1001273
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10012a2
mov eax, dword [0x100236c]
test eax, eax
jne 0x100129c
mov dword [0x100236c], esi
push 0x100109c
push 0x1001090
call fcn.01001199
pop ecx
pop ecx
test eax, eax
je 0x10012a2
jmp 0x10013c6
mov dword [0x1002034], esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x10012c6
push 0x100108c
push 0x1001084
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x10012d3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002374], ebx
je 0x10012f4
push 0x1002374
call fcn.010015a9
pop ecx
test eax, eax
je 0x10012f4
push ebx
push 2
push ebx
call dword [0x1002374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10013c6
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x100135e
cmp cx, bx
je 0x1001319
cmp dword [ebp - 0x1c], ebx
jne 0x100135e
movzx ecx, word [eax]
cmp cx, bx
je 0x100132e
cmp cx, 0x20
ja 0x100132e
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1001319
test byte [ebp - 0x40], 1
je 0x100133a
movzx ecx, word [ebp - 0x3c]
jmp 0x100133d
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x10013a3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x100136f
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1001303
cmp dword [0x1002034], ebx
jne 0x10013b1
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
jmp 0x10013d2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001679
ret
call fcn.01001781
jmp 0x10011fa

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4027b5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push esi
push edi
xor edi, edi
xor esi, esi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, 0x9f60fc3
jg 0x4027db
inc esi
cmp esi, 0x1e70dee2
jl 0x4027c1
cmp dword [0x478104], 0x400
jne 0x40280e
push edi
call fcn.00402948
push edi
push edi
call fcn.00402a93
fldz
push ecx
fst qword [esp + 8]
fstp qword [esp]
call fcn.00402870
push edi
fstp st(0)
call fcn.00402b80
add esp, 0x14
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc6e
jg 0x40282d
inc esi
cmp esi, 0xe52f
jl 0x402810
mov eax, dword [0x4700c4]
mov dword [0x478104], eax
call fcn.0040252b
mov esi, 0x3078f
cmp dword [0x478104], 0x51f
jne 0x402859
push edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec esi
jne 0x402841
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x4059a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46f328]
jne 0x4059b2
repz ret
jmp fcn.00407cbc