joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10096600
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x10122d90]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10096663
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1009a48f
test eax, eax
jne 0x1009668e
mov eax, 0xa
jmp 0x10096790
cmp dword [ebp + 0xc], 0
je 0x100966da
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100966d8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x10096716
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10096701
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1009bc80
add esp, 0xc
jmp 0x10096716
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.1009bc80
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1009a48f
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1009a48f
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1009a48f
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x100967b4]
call fcn.1009a43b
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.1009a48f
mov esp, ebp
pop ebp
ret
Function at 0x10096e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x10122d80]
mov dword [ebp - 4], eax
jmp 0x10096ea7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10096ec0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10096ebe
mov eax, dword [ebp - 4]
jmp 0x10096f44
jmp 0x10096e9f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1009a48f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10096f41
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x10096f03
mov edx, dword [ebp - 4]
mov eax, dword [0x10122d80]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10122d80], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1009a48f
mov esp, ebp
pop ebp
ret

Function at 0x10097430
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10097480
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10097480
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10097480
xor eax, eax
jmp 0x100974c1
mov dword [ebp - 4], 1
jmp 0x10097492
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100974bc
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100974ba
xor eax, eax
jmp 0x100974c1
jmp 0x10097489
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100b0506
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b0488
Function at 0x100b3ac2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b3933

Function at 0x100b3f58
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d40a0
push 0x100d4098
push str.FlsAlloc
push 0x1e
call fcn.100b3da2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b3f8c
push dword [ebp + 8]
mov ecx, esi
call dword [0x100cd184]
call esi
jmp 0x100b3f92
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100b3fd6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d40b0
push 0x100d40a8
push str.FlsGetValue
push 0x20
call fcn.100b3da2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b400d
push dword [ebp + 8]
mov ecx, esi
call dword [0x100cd184]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100b48a8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1009b440
mov eax, dword [0x100f03c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100b16a9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100b48ea
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100b4a46
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100c0540
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1011ad18]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.100b56a3
mov ecx, dword [esi*4 + 0x1011ad18]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100b4a3f
cmp eax, dword [edi + ecx + 0x24]
jne 0x100b4a3f
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b4a3f
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100b56a3
add esp, 0x14
test edx, edx
jl 0x100b4a3f
jg 0x100b49b5
test eax, eax
jb 0x100b4a3f
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100b4a3f
jl 0x100b49cf
cmp dword [ebp - 0x1008], eax
ja 0x100b4a3f
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100b49ed
test ebx, ebx
je 0x100b4a26
cmp ecx, edi
jae 0x100b4a26
mov al, byte [ecx]
cmp al, 0xd
jne 0x100b4a07
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100b4a13
cmp byte [ecx + 1], 0xa
jne 0x100b4a13
inc ecx
jmp 0x100b4a13
movzx eax, al
movsx eax, byte [eax + 0x100f0650]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100b49ed
cmp edx, ebx
jne 0x100b49ed
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100b4a44
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1009999a
leave
ret
Function at 0x100b4b41
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1011ad18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100b4b81
cmp byte [ebx], 0xa
jne 0x100b4b81
or byte [eax + edi + 0x28], 4
jmp 0x100b4b86
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x100b4c84
mov al, byte [edx]
cmp al, 0x1a
je 0x100b4c66
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x100b4bb5
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x100b4bda
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x100b4be4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x100b4b97
jmp 0x100b4c84
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b4c61
cmp dword [ebp - 0xc], 0
je 0x100b4c61
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1011ad18]
test byte [eax + edi + 0x28], 0x48
je 0x100b4c3b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100b4c26
mov byte [esi], dl
jmp 0x100b4c37
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1011ad18]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100b4c84
cmp byte [ebp - 1], 0xa
jne 0x100b4c4a
cmp esi, ebx
jne 0x100b4c4a
mov byte [esi], 0xa
jmp 0x100b4c83
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100b56c1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100b4c84
mov byte [esi], 0xd
jmp 0x100b4c83
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1011ad18]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100b4c80
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100b4c84
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100b4c8d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1011ad18]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100b4cd0
cmp word [esi], dx
jne 0x100b4cd0
or byte [edi + eax + 0x28], 4
jmp 0x100b4cd5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x100b4e28
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x100b4e08
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x100b4d17
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100b4d4d
cmp eax, edx
jae 0x100b4d59
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x100b4cef
jmp 0x100b4e28
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b4e04
cmp dword [ebp - 0x14], 0
je 0x100b4e04
mov eax, dword [ebx*4 + 0x1011ad18]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x100b4ddc
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x100b4da5
mov word [esi], cx
jmp 0x100b4dd8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1011ad18]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1011ad18]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1011ad18]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x100b4e28
pop ebx
cmp word [ebp - 4], bx
jne 0x100b4ded
cmp esi, dword [ebp + 0xc]
jne 0x100b4ded
mov word [esi], bx
jmp 0x100b4e25
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100b56c1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x100b4e28
push 0xd
jmp 0x100b4e21
mov ecx, dword [ebx*4 + 0x1011ad18]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100b4e1f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100b4e28
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100b908b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100b9128
push ebx
push esi
call fcn.100b9054
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100b7e2b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100b90d5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100b9127
push edi
push eax
call fcn.100b0874
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100b90f5
call fcn.100b0056
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100b9126
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100b7e2b
add esp, 0x20
test eax, eax
jne 0x100b9114
push edi
call fcn.100b0056
jmp 0x100b911c
push ebx
call fcn.100b0056
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100bf7a1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100bf71d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100bf919
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100bf919
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100bf8c8
jg 0x100bf7fa
test eax, eax
je 0x100bf8be
push 1
push 0x1000
call fcn.100b0817
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100bf820
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x100bf8b5
push 0x8000
push ebx
call fcn.100bf64e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100bf84c
jg 0x100bf847
cmp ecx, 0x1000
jb 0x100bf84c
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100b3389
add esp, 0x10
cmp eax, 0xffffffff
je 0x100bf891
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100bf847
jl 0x100bf878
test ecx, ecx
jne 0x100bf839
push dword [ebp - 0xc]
push ebx
call fcn.100bf64e
push esi
call fcn.100b0056
add esp, 0xc
xor edi, edi
jmp 0x100bf92a
cmp byte [edi + 0x24], 0
je 0x100bf8a8
cmp dword [edi + 0x20], 5
jne 0x100bf8a8
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100bf8b3
mov edi, dword [edi + 0x18]
jmp 0x100bf8b5
xor edi, edi
push esi
call fcn.100b0056
pop ecx
jmp 0x100bf92a
test ecx, ecx
jg 0x100bf88a
jl 0x100bf8c8
test eax, eax
jae 0x100bf88a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100b56c1
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100bf8eb
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100bf88a
jmp 0x100bf922
push ebx
call fcn.100bd27a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100bf88a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100bf92a
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100bf927
mov edi, dword [edi + 0x18]
jmp 0x100bf92a
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100b56c1
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov bl, byte [eax]
cmp bl, 0xd8
je 0x40102e
cmp bl, 0xd7
je 0x40102e
mov esi, dword [ebp + 0x10]
lea ecx, [eax + 1]
test esi, esi
jle 0x40104f
mov eax, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x401023
jmp 0x40104f
mov esi, dword [ebp + 0xc]
inc eax
push esi
push eax
call fcn.00401af0
cmp bl, 0xd8
jne 0x40104f
xor eax, eax
cmp dword [ebp + 0x10], eax
jle 0x40104f
xor byte [eax + esi], 0xf0
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x401045
pop esi
pop ebx
pop ebp
ret

Function at 0x4010c1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
xor esi, esi
push edi
push esi
push dword [esp + 0x14]
push esi
push 0x8000040
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4010fc
push esi
push esi
push esi
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
jne 0x40112a
push 0x40
push 0x101000
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40112a
push esi
mov eax, 0x401130
push esi
push eax
push eax
push 0x80030008
call fcn.00401057
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x401315
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x401371
push esi
push edi
push ebx
mov edi, 0x400
push ebx
lea eax, [ebp - 0x800]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
push ebx
push ebx
lea eax, [ebp - 0x400]
push edi
push eax
push 0xffffffffffffffff
push dword [ebp + 0x10]
push ebx
push ebx
call esi
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
pop esi
jmp 0x40137d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop ebx
leave
ret

Function at 0xa12f7c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa12f86
pushal
call 0xa12f8c
pop ebp
sub ebp, 0x10
sub ebp, 0x612f7c
jmp 0xa12fa2
mov eax, 0x612f7c
add eax, ebp
add eax, 0x4c
mov ecx, 0x607
mov edx, 0x9a636856
xor byte [eax], dl
inc eax
dec ecx
jne 0xa12fb9
jmp 0xa12fcc
fstp qword [ebx + 0x566adfdd]
push esi
push esi
xlatb
xchg edi, eax
scasb al, byte es:[edi]
push esi
push esi
push esi
push ebp
wait
out dx, al
push edx
push esi
push esi
push esi
in al, dx
jle 0xa1303a
push esi
push esi
mov eax, dword [0xdd9e55b4]
xlatb
pop edx
push esi
push esi
push esi
push ebp
xchg ebx, eax
invalid
test eax, 0x727adda9
invalid
Function at 0xc001a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x635000]
lea eax, [edi + 0x6375f4]
push dword [eax]
mov dword [eax], 0x7c8543c8
push eax
push edi
or ebp, 0xffffffff
jmp 0xc001d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc001d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc001c8
mov eax, 1
add ebx, ebx
jne 0xc001eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc001fc
jne 0xc0021b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc0021b
dec eax
add ebx, ebx
jne 0xc00208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc001e0
add ebx, ebx
jne 0xc00217
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc0026d
xor ecx, ecx
sub eax, 3
jb 0xc00233
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc002a2
sar eax, 1
mov ebp, eax
jmp 0xc0023e
add ebx, ebx
jne 0xc0023e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc0020c
inc ecx
add ebx, ebx
jne 0xc0024c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc0020c
add ebx, ebx
jne 0xc00259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc0024e
jne 0xc0026a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc0024e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc0028c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc0027e
jmp 0xc001ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc0028c
add edi, ecx
jmp 0xc001ce
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xd945
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc002ae
cmp byte [edi], 0x8e
jne 0xc002ae
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc002b3
lea edi, [esi + 0x7fd000]
mov eax, dword [edi]
or eax, eax
je 0xc0032b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8035ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8036ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc002e0
mov ecx, edi
jns 0xc0030f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8036f4]
or eax, eax
je 0xc00325
mov dword [ebx], eax
add ebx, 4
jmp 0xc002fd
call dword [esi + 0x8036f0]
mov ebp, dword [esi + 0x8036f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x25f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc0035f
sub esp, 0xffffff80
jmp 0x61cbe8