joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c2cf8
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, 0x1017e06c
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
push edi
cmp eax, 2
jne 0x100c2d1e
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
jmp 0x100c2d24
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
pop edi
pop esi
pop ecx
ret

Function at 0x100c2d28
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x1017e06c
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
cmp eax, 2
jne 0x100c2d49
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
pop esi
ret
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
pop esi
ret

Function at 0x100c3620
Capabilities:
Enumerate files on windows

Disassembly:
push 0x680
mov eax, 0x100ebc4a
call fcn.10001b03
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test edi, edi
je 0x100c37ca
push 0
push 0x104
lea ecx, [ebp - 0x474]
xor bl, bl
call sym.fpsrvutl.dll_Ordinal_2082
and dword [ebp - 4], 0
lea ecx, [ebp - 0x474]
push 0
call sym.fpsrvutl.dll_Ordinal_2082
lea edx, [ebp - 0x474]
mov ecx, eax
call fcn.100c2cf8
test eax, eax
je 0x100c37b0
xor ebx, ebx
lea ecx, [ebp - 0x684]
inc ebx
push esi
mov dword [ebp - 0x68c], ebx
call sym.fpsrvutl.dll_Ordinal_2082
lea ecx, [ebp - 0x684]
mov byte [ebp - 4], bl
call fcn.100c2d28
test eax, eax
je 0x100c37a1
mov dword [ebp - 0x688], 0x10181f8c
lock inc dword [0x10181f80]
mov ecx, 0x1017e06c
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x264]
push eax
jne 0x100c36da
push 0x100f8a30
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x100c36e5
push 0x100f0d04
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100c3793
mov bl, byte [ebp + 0x10]
test byte [ebp - 0x264], 0x10
jne 0x100c3759
mov ecx, 0x1017e06c
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x238]
jne 0x100c371f
push eax
lea ecx, [ebp - 0x688]
call sym.fpsrvutl.dll_Ordinal_3753
jmp 0x100c373a
push 0
push eax
call sym.fpsrvutl.dll_Ordinal_2082
push eax
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x688]
call sym.fpsrvutl.dll_Ordinal_1496
mov ecx, dword [ebp - 0x688]
mov dl, bl
call fcn.100c37d2
test al, al
je 0x100c3759
lea eax, [ebp - 0x688]
mov ecx, edi
push eax
call sym.fpsrvutl.dll_Ordinal_2082
mov ecx, 0x1017e06c
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x264]
push eax
push esi
jne 0x100c3778
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x100c377e
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x100c36f3
push esi
call dword [sym.imp.kernel32.dll_FindClose]
mov ebx, dword [ebp - 0x68c]
mov ecx, dword [ebp - 0x688]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
lea ecx, [ebp - 0x684]
mov byte [ebp - 4], 0
call fcn.100058ed
test bl, bl
je 0x100c37bf
lea ecx, [ebp - 0x474]
call fcn.100c2d28
lea ecx, [ebp - 0x474]
call fcn.100058ed
call fcn.10001b39
ret 0xc
Function at 0x100c7e49
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
movsx eax, byte [edi + 8]
push eax
push dword [edi + 0x50]
mov eax, dword [vtable.VprocessGlobals.0]
push str.VdirectUpdateLock::endUpdate__InFilePath___s__Locked___d_n
push 3
push 0
push 0x1017e06c
call dword [eax + 0x24]
lea ebx, [edi + 0xb0]
add esp, 0x18
cmp dword [ebx], 0
jne 0x100c7e9b
mov eax, dword [edi]
push 8
pop ecx
mov edx, dword [eax + 0x14]
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, ecx
mov ecx, edi
push eax
call edx
test eax, eax
jne 0x100c7f37
mov eax, dword [edi + 0x12c]
cmp eax, 0xffffffff
je 0x100c7f1e
push 0
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
test eax, eax
jne 0x100c7f3e
push eax
lea eax, [ebp - 4]
push eax
push dword [edi + 0x134]
push dword [edi + 0x124]
push dword [edi + 0x12c]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100c7f3e
mov eax, dword [ebp - 4]
cmp eax, dword [edi + 0x134]
jne 0x100c7f3e
cmp byte [edi + 0x130], 0
jne 0x100c7f00
push dword [edi + 0x12c]
call dword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
je 0x100c7f3e
push dword [edi + 0x12c]
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x100c7f17
mov esi, 0x20006
jmp 0x100c7f43
or dword [edi + 0x12c], 0xffffffff
push dword [edi + 0x124]
call sym.fpsrvutl.dll_Ordinal_2082
xor eax, eax
mov dword [edi + 0x124], eax
mov byte [edi + 8], al
mov dword [ebx], eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, 0x2000c
mov eax, dword [edi + 0x68]
mov dword [ebp + 8], eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, edi
push dword [ebp + 8]
mov edx, eax
mov ecx, esi
call fcn.1006a99f
mov edx, dword [edi]
mov ecx, edi
mov esi, eax
call dword [edx + 8]
mov edi, 0x124
push dword [edi + ebx]
call sym.fpsrvutl.dll_Ordinal_2082
and dword [ebx + edi], 0
mov eax, esi
jmp 0x100c7f36
Function at 0x100d076b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov eax, dword [0x1014d250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push dword [0x10174460]
mov edi, dword [ebp + 8]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x100d07bf
cmp dword [esi + 0xc], 0
jle 0x100d07bf
mov ecx, dword [esi + 0x10]
cmp dword [ecx], 0
je 0x100d07bf
push 0xffffffffffffffff
push dword [ecx]
lea eax, [ebp - 0x84]
push 0x80
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
jmp 0x100d07d9
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push str.thread_0x_x
lea eax, [ebp - 0x84]
push 0xffffffffffffffff
push eax
call sym.fpsrvutl.dll_Ordinal_2082
mov eax, dword [vtable.VprocessGlobals.0]
add esp, 0x10
cmp byte [0x10181cd7], 0
push edi
je 0x100d0802
push ebx
push str._Assert_failure_in__s_xx____.400s_
push 0
push 0
push 0x1017e06c
call dword [eax + 0x24]
add esp, 0x18
jmp 0x100d081a
push dword [ebp + 0x10]
push ebx
push str._Assert_failure_in__s__d___.400s_
push 0
push 8
push 0x1017e06c
call dword [eax + 0x24]
add esp, 0x1c
cmp byte [0x10181cdb], 0
jne 0x100d08e4
mov ecx, str.SoftwareMicrosoftFrontPageServerExtensionsNoAssertMsgBox
call sym.fpsrvutl.dll_Ordinal_2082
test al, al
jne 0x100d089f
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x84]
push ebx
push eax
push str.Assert_failed__Vframework___s___File__.200s__line__d_nExpression___.400s_n_click_Retry_to_debug_
lea eax, [ebp - 0x484]
push 0xffffffffffffffff
push eax
call sym.fpsrvutl.dll_Ordinal_2082
add esp, 0x1c
mov ecx, str.SoftwareMicrosoftFrontPageServerExtensionsIgnoreAsserts
call sym.fpsrvutl.dll_Ordinal_2082
push 3
pop ecx
push 5
test al, al
pop edx
cmovne ecx, edx
cmp byte [0x1017712c], 0
je 0x100d088d
push 0x12
push 0x1012d1d0
lea eax, [ebp - 0x484]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, eax
cmp ecx, 3
je 0x100d089f
cmp ecx, 4
jne 0x100d08e4
call dword [sym.imp.kernel32.dll_DebugBreak]
jmp 0x100d08e4
test esi, esi
je 0x100d08e4
cmp dword [0x10181be0], 0
je 0x100d08b8
mov ecx, 0x2d0
call sym.fpsrvutl.dll_Ordinal_2082
jmp 0x100d08c4
push 0x2d0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov esi, eax
test esi, esi
je 0x100d08dc
lea eax, [esi + 4]
mov dword [esi], vtable.VassertContextStatus.0
push eax
call dword [sym.imp.kernel32.dll_RtlCaptureContext]
jmp 0x100d08de
xor esi, esi
push esi
call sym.fpsrvutl.dll_Ordinal_2082
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100013fd
leave
ret 0xc
Function at 0x100d08f5
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100d0985
mov eax, dword [vtable.VprocessGlobals.0]
push ebx
push edi
push dword [ebp + 0x10]
xor edi, edi
mov ebx, 0x1017e06c
cmp byte [0x10181cdb], 0
push dword [ebp + 0xc]
je 0x100d092a
push str._nUnexpected_status_in_file:__s__line:_xx__n
push edi
push edi
jmp 0x100d0932
push str._nUnexpected_status_in_file:__s__line:__d__n
push edi
push 8
push ebx
call dword [eax + 0x24]
mov eax, dword [vtable.VprocessGlobals.0]
add esp, 0x18
mov ecx, ebx
push esi
push edi
call dword [eax + 0xc]
mov eax, dword [vtable.VprocessGlobals.0]
push 0x100f02b0
push edi
push edi
push ebx
call dword [eax + 0x24]
add esp, 0x10
push dword [0x10174460]
call dword [sym.imp.kernel32.dll_TlsGetValue]
pop edi
pop ebx
test eax, eax
je 0x100d0979
cmp byte [0x10181cdb], 0
jne 0x100d0979
push esi
call sym.fpsrvutl.dll_Ordinal_2082
test esi, esi
je 0x100d0985
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
pop esi
pop ebp
ret 0xc
Function at 0x100d3b5f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.100d303e
mov edi, dword [ebp + 8]
test edi, edi
je 0x100d3bb0
cmp dword [esi + 0x4c], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
je 0x100d3b89
push edi
push dword [esi + 0x4c]
call ebx
test eax, eax
jne 0x100d3b99
cmp dword [esi + 0x50], 0
je 0x100d3b9d
push edi
push dword [esi + 0x50]
call ebx
test eax, eax
je 0x100d3b9d
mov al, 1
jmp 0x100d3bb2
cmp dword [esi + 0x54], 0
je 0x100d3bb0
push edi
push dword [esi + 0x54]
call ebx
test eax, eax
setne al
jmp 0x100d3bb2
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100d7805
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x100ed0ef
call fcn.10001371
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
push 1
xor ebx, ebx
push ebx
push ebx
call sym.fpsrvutl.dll_Ordinal_2082
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [esi + 0x50], eax
mov al, byte [ebp + 0xc]
push ebx
mov byte [esi + 0x54], al
mov al, byte [ebp + 0x14]
push ebx
push 8
mov dword [esi], vtable.SMP_HEAP.0
mov byte [esi + 0x55], 1
mov byte [esi + 0x56], al
mov word [esi + 0x34], bx
call fcn.100d57cc
push ebx
push ebx
push 0x14
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.100d57cc
push ebx
push ebx
push 8
mov ecx, esi
mov dword [esi + 0x3c], eax
call fcn.100d57cc
push ebx
push ebx
push 0xc
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
call fcn.100d57cc
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x48], eax
test ecx, ecx
je 0x100d78d1
cmp dword [esi + 0x3c], ebx
je 0x100d78d1
cmp dword [esi + 0x40], ebx
je 0x100d78d1
test eax, eax
je 0x100d78d1
mov dword [ecx + 4], ebx
mov dword [ecx], ebx
mov eax, dword [esi + 0x40]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov edi, dword [esi + 0x48]
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
setne cl
mov byte [edi], cl
je 0x100d78db
cmp eax, 0x40000000
jge 0x100d78db
lea eax, [eax*4 + 0xe10]
mov dword [edi + 8], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x34], 1
mov eax, esi
call fcn.1000140a
ret 0x14
mov ecx, str.No_TLS_available
call sym.fpsrvutl.dll_Ordinal_2082
int3

Function at 0x100d7dbc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x100d7df6
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d7de4
lea ecx, [eax + 8]
mov eax, dword [ecx]
pop esi
mov eax, dword [eax + 0xc]
pop ebp
jmp eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100d56ca
jmp 0x100d7df8
xor al, al
pop esi
pop ebp
ret 0xc
Function at 0x826058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8261a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x82607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82606a
add dl, dl
jne 0x826089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8260dc
xor eax, eax
add dl, dl
jne 0x826096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82617d
add dl, dl
jne 0x8260a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8260b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8260bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8260c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8260d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x826075
mov eax, 1
add dl, dl
jne 0x8260ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8260f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8260e1
sub eax, ebx
mov ebx, 1
jne 0x826128
mov ecx, 1
add dl, dl
jne 0x82610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x826119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x826105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x826075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x82613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x82614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x826136
cmp eax, 0x7d00
jae 0x82616d
cmp eax, 0x500
jb 0x826168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x826075
cmp eax, 0x7f
ja 0x826170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x826075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x82619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x826075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100023dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100023eb
pop dword [ebp - 0x18]
mov eax, 0x100023eb
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb1b5e55d
sub dword [ebp - 0x28], 0x6363a012
mov dword [ebp - 0x24], 0xb0850d67
add dword [ebp - 0x24], 0x81ae3ede
mov dword [ebp - 0x20], 0x11158f14
sub dword [ebp - 0x20], 0xc4c94ae6
mov dword [ebp - 0x1c], 0xcb491a1f
add dword [ebp - 0x1c], 0x34b6e5e1
lea eax, [ebp - 0x28]
push eax
mov eax, 0xe71066c6
sub eax, 0xd70fc6c2
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x9444b3fe
sub dword [ebp - 0x28], 0x1fd24aa8
mov dword [ebp - 0x24], 0x1bc6047f
sub dword [ebp - 0x24], 0xda59a30a
mov dword [ebp - 0x20], 0x8955dfc8
sub dword [ebp - 0x20], 0x25e6735c
mov dword [ebp - 0x1c], 0x60124aa
sub dword [ebp - 0x1c], 0x60124aa
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x123aa06c
add eax, 0xfdc5ff9c
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x35f9f
push 0
call eax
mov ecx, 0x32e26508
sub ecx, 0x32e21f8a
xor ebx, ebx
add ebx, eax
mov esi, 0x3e9be3c8
add esi, 0xd1651438
add esi, dword [ebp - 0x18]
mov edx, 0x42823e84
add edx, 0x2cf12a
xor dword [ebp - 0xc], 0x4e0ed070
mov edi, dword [esi]
xor edi, edx
mov dword [ebx], edi
add dword [ebp - 8], edx
add ebx, 4
add esi, 4
loop 0x1000250a
add eax, 0xc0a4500c
add eax, 0x3f5cb8bf
mov ebx, eax
add eax, 0x191f4952
add eax, 0xe6e0b6b3
mov ecx, 0xdef909b0
add ecx, 0x3106f650
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1002aaee
pop dword [ebp - 0x20]
mov eax, 0x1002aaee
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xedbc00f2
add dword [ebp - 0x30], 0x60964459
mov dword [ebp - 0x2c], 0xdb68ee9
sub dword [ebp - 0x2c], 0xdb8342a4
mov dword [ebp - 0x28], 0x10fed2e5
add dword [ebp - 0x28], 0x3b4d7149
mov dword [ebp - 0x24], 0x5ed14c33
add dword [ebp - 0x24], 0xa12eb3cd
lea eax, [ebp - 0x30]
push eax
mov eax, 0x4e8c84d7
add eax, 0xc1763b61
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x39f50ed9
sub dword [ebp - 0x30], 0xc582a583
mov dword [ebp - 0x2c], 0x78cce38c
sub dword [ebp - 0x2c], 0x37608217
mov dword [ebp - 0x28], 0xb4835747
add dword [ebp - 0x28], 0xaeec1525
mov dword [ebp - 0x24], 0xef617385
sub dword [ebp - 0x24], 0xef617385
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xbaf592c4
add eax, 0x550d2d64
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35014
push 0
call eax
mov ecx, 0x87ab896e
sub ecx, 0x87ab4748
xor edx, edx
add edx, eax
mov esi, 0x10039600
add esi, dword [ebp - 0x20]
mov ebx, 0x7d6c2b43
add ebx, 0xce006706
add dword [ebp - 0x14], 0x3012e5cc
mov edi, dword [esi]
sub dword [ebp - 0x10], 0x56bd5ea3
sub edi, ebx
xor dword [ebp - 0x14], 0x8e74049c
mov dword [edx], edi
xor dword [ebp - 0x10], 0xcc1510dc
add edx, 0xb0d0092f
sub edx, 0xb0d0092b
add esi, 0xc5996e69
sub esi, 0xc5996e65
loop 0x1002ac07
add eax, 0xfb6b
xor ebx, ebx
add ebx, eax
add eax, 0xe1e11697
sub eax, 0xe1e11692
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6f0c2ecc
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x40561c7a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x41c4d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
jmp 0x41c4ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c4f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c4e0
mov eax, 1
add ebx, ebx
jne 0x41c503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c4f8
jne 0x41c514
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c4f8
xor ecx, ecx
sub eax, 3
jb 0x41c528
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c59a
mov ebp, eax
add ebx, ebx
jne 0x41c533
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c540
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c564
inc ecx
add ebx, ebx
jne 0x41c550
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c545
jne 0x41c561
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c545
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c584
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c575
jmp 0x41c4e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c584
add edi, ecx
jmp 0x41c4e6
pop esi
mov edi, esi
mov ecx, 0x1ac
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c5a2
cmp byte [edi], 1
jne 0x41c5a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41c5a7
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c616
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d478]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d520]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c5d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d528]
or eax, eax
je 0x41c610
mov dword [ebx], eax
add ebx, 4
jmp 0x41c5f1
call dword [esi + 0x1d524]
mov ebp, dword [esi + 0x1d52c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41c64a
sub esp, 0xffffff80
jmp 0x405b22
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1000e9bf
pop dword [ebp - 0x38]
mov eax, 0x1000e9bf
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xe85003b5
add dword [ebp - 0x48], 0x66024196
mov dword [ebp - 0x44], 0xe32d400d
sub dword [ebp - 0x44], 0xb0f9f3c8
mov dword [ebp - 0x40], 0x6d6a60cf
add dword [ebp - 0x40], 0xdee1e35f
mov dword [ebp - 0x3c], 0xf65fcf46
add dword [ebp - 0x3c], 0x9a030ba
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x642658ff
sub dword [ebp - 0x48], 0xefb3efa9
mov dword [ebp - 0x44], 0x761dd391
add dword [ebp - 0x44], 0xcb4e8de4
mov dword [ebp - 0x40], 0x5e1f5224
sub dword [ebp - 0x40], 0xfaafe5b8
mov dword [ebp - 0x3c], 0xedb29b31
sub dword [ebp - 0x3c], 0xedb29b31
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x285a7ace
sub eax, 0x1858ea96
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x330d5
push 0
call eax
mov ecx, 0x39f8
mov edi, eax
mov edx, 0x820d0dba
sub edx, 0x720ae5ba
add edx, dword [ebp - 0x38]
mov esi, 0x876ff028
sub esi, 0x836b8865
xor dword [ebp - 0x34], 0x5194501c
mov ebx, dword [edx]
add dword [ebp - 0x1c], ecx
sub ebx, esi
add dword [ebp - 8], 0x89d9f945
mov dword [edi], ebx
add edi, 4
add edx, 0x7cfdb76f
sub edx, 0x7cfdb76b
loop 0x1000ead1
add eax, 0xfb63b8d
sub eax, 0xfb560da
mov ebx, eax
add eax, 5
mov ecx, 0x9600944b
sub ecx, 0x8600944b
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret