joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41be28
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
mov eax, dword [0x4b5144]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
call eax
sub esp, 4
test eax, eax
call fcn.0041ba4b
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
add eax, 8
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xfffffffe
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.ntdll.dll_NtDuplicateObject]
call eax
sub esp, 0x1c
test eax, eax
jns 0x41beba
mov dword [esp], str.__MCF_thread_attach_foreign
call fcn.0041d804
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
jne 0x41bed0
mov dword [esp], str.__MCF_thread_attach_foreign
call fcn.0041d804
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x4b5144]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x41bf11
mov dword [esp], str.__MCF_thread_attach_foreign
call fcn.0041d804
mov eax, dword [ebp + 8]
leave
ret

Function at 0x41c076
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b5144]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne al
movzx eax, al
test eax, eax
je 0x41c0a7
mov eax, dword [ebp - 0xc]
jmp 0x41c0ce
mov dword [esp], 0x320
call fcn.0041d016
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41c0c3
mov eax, 0
jmp 0x41c0ce
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0041be28
leave
ret
Function at 0x41d75c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b5144]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41d7de
cmp dword [ebp - 0xc], 0xffffff81
je 0x41d7de
mov eax, dword [ebp - 0xc]
add eax, 0x14
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0041c892
mov eax, dword [ebp - 0xc]
add eax, 0x310
mov dword [esp], eax
call fcn.0041cdd5
mov eax, dword [0x4b5144]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0xffffff81
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0041bf16
jmp 0x41d7df
nop
leave
ret
Function at 0x475fe0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.ucrtbase.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.ucrtbase.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x476020
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.ucrtbase.dll__errno]
cmp dword [eax], 4
je 0x475ff1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x532680
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd5000]
push edi
jmp 0x53269a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5326a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x532690
mov eax, 1
add ebx, ebx
jne 0x5326b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5326c4
jne 0x5326e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5326e3
dec eax
add ebx, ebx
jne 0x5326d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5326a8
add ebx, ebx
jne 0x5326df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x532735
xor ecx, ecx
sub eax, 3
jb 0x5326fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53276a
sar eax, 1
mov ebp, eax
jmp 0x532706
add ebx, ebx
jne 0x532706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5326d4
inc ecx
add ebx, ebx
jne 0x532714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5326d4
add ebx, ebx
jne 0x532721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x532716
jne 0x532732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x532716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x532754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x532746
jmp 0x532696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x532754
add edi, ecx
jmp 0x532696
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x532772
cmp byte [edi], 0x11
jne 0x532772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x532777
lea edi, [esi + 0x12b000]
mov eax, dword [edi]
or eax, eax
je 0x5327ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17f340]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17f4bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5327a4
mov ecx, edi
jns 0x5327d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17f4c0]
or eax, eax
je 0x5327e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5327c1
call dword [esi + 0x17f4d0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x532820
cmp al, 0xef
ja 0x532813
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5327f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x532802
mov ebp, dword [esi + 0x17f4c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x532854
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x10cc0bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x111121c]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [edi*4 + 2]
push eax
mov word [ebp - 0x24], 0x30
mov word [ebp - 0x22], 0x31
mov word [ebp - 0x20], 0x32
mov word [ebp - 0x1e], 0x33
mov word [ebp - 0x1c], 0x34
mov word [ebp - 0x1a], 0x35
mov word [ebp - 0x18], 0x36
mov word [ebp - 0x16], 0x37
mov word [ebp - 0x14], 0x38
mov word [ebp - 0x12], 0x39
mov word [ebp - 0x10], 0x61
mov word [ebp - 0xe], 0x62
mov word [ebp - 0xc], 0x63
mov word [ebp - 0xa], 0x64
mov word [ebp - 8], 0x65
mov word [ebp - 6], 0x66
call fcn.0105f04e
pop ecx
mov ecx, eax
test ecx, ecx
mov dword [ebp - 0x28], ecx
je 0x10cc185
push esi
xor esi, esi
test edi, edi
jle 0x10cc180
push ebx
mov eax, dword [ebp + 8]
add eax, esi
movzx edx, byte [eax]
shr edx, 4
mov dx, word [ebp + edx*2 - 0x24]
mov word [ecx], dx
movzx eax, byte [eax]
cdq
push 0x10
pop ebx
idiv ebx
inc ecx
inc ecx
mov ax, word [ebp + edx*2 - 0x24]
mov word [ecx], ax
inc ecx
inc ecx
inc esi
cmp esi, edi
jl 0x10cc152
pop ebx
and word [ecx], 0
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
pop edi
call fcn.0105eca9
leave
ret 8

Function at 0x10f1f80
Capabilities:
Encode data using xor

Disassembly:
dec eax
push ebx
push ebp
push esi
push edi
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
dec eax
sub esp, 0x60
inc esp
mov ebp, edx
xor edx, edx
dec ecx
mov ebp, eax
dec esp
mov esi, ecx
inc esp
lea eax, [edx + 0x40]
dec eax
lea ecx, [esp + 0x20]
dec ecx
mov esi, ecx
call 0x11284f0
xor ebx, ebx
dec eax
test ebp, ebp
je 0x10f204d
dec eax
mov edi, dword [esp + 0xc8]
dec esp
mov esp, dword [esp + 0xc0]
dec eax
test edi, edi
je 0x10f1fdc
test bl, bl
jne 0x10f1fdc
dec eax
mov eax, dword [edi]
dec eax
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
jne 0x10f204f
dec ecx
mov eax, dword [esp]
dec ecx
mov ecx, esp
call dword [eax + 0x18]
dec ebp
mov ebx, dword [esp]
inc ebp
mov eax, ebp
dec ecx
mov edx, esi
dec ecx
mov ecx, esp
inc ecx
call dword [ebx + 0x20]
dec ebp
mov ebx, dword [esp]
dec eax
lea edx, [esp + 0x20]
dec ecx
mov ecx, esp
inc ecx
call dword [ebx + 0x28]
dec ebp
mov ebx, dword [esp]
dec ecx
mov ecx, esp
inc ecx
call dword [ebx + 0x30]
cmp eax, 0x40
ja 0x10f205e
xor ecx, ecx
test eax, eax
je 0x10f2038
inc esp
lea eax, [eax - 1]
dec eax
lea edx, [esp + 0x20]
inc ecx
shr eax, 2
inc ecx
inc eax
xor ecx, dword [edx]
dec eax
add edx, 4
dec ecx
dec eax
jne 0x10f202d
dec eax
test esi, esi
je 0x10f2041
cmp ecx, dword [esi]
jne 0x10f205e
dec eax
inc ebx
dec eax
cmp ebx, ebp
jb 0x10f1fc6
xor eax, eax
dec eax
add esp, 0x60
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, 1
jmp 0x10f204f
Function at 0x10f2068
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x10f21fb
mov eax, edx
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
dec eax
dec eax
jne 0x10f2072
mov eax, ecx
ret
Function at 0x10f2290
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor edx, edx
dec esp
mov ebx, ecx
dec ecx
cmp edx, edx
jbe 0x10f22d8
inc ebp
mov ecx, dword [eax]
inc ecx
mov ecx, dword [eax + 4]
inc ecx
movzx eax, cx
inc ecx
shr ecx, 0x10
imul eax, eax, 0x9069
inc ecx
add eax, ecx
inc ecx
mov dword [eax], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
inc ecx
mov dword [eax + 4], eax
inc ecx
xor al, byte [eax + 8]
inc ebx
mov byte [edx + ebx], al
dec ecx
inc edx
dec esp
cmp edx, edx
jb 0x10f229b
dec ecx
mov ecx, ebx
jmp fcn.010f2250

Function at 0x10f30a8
Capabilities:
Encode data using xor

Disassembly:
dec eax
push ebx
push ebp
push esi
push edi
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
dec eax
mov ebp, dword [ecx + 8]
dec esp
mov ebp, dword [ecx]
inc ebp
xor ecx, ecx
dec eax
test ebp, ebp
inc ebp
lea esp, [ecx + 1]
inc ebp
mov esi, eax
inc esp
mov edi, edx
mov ebx, 0x159a55e5
mov edi, 0x1f123bb5
inc ebp
mov edx, esp
inc ebp
mov ebx, esp
je 0x10f3258
movzx ecx, bx
shr ebx, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
movzx ecx, di
shr edi, 0x10
mov edx, ebx
shl edx, 0x10
imul ecx, ecx, 0x4650
add edi, ecx
add edx, edi
inc ecx
xor edx, esi
mov eax, edx
shr edx, 1
inc ecx
and eax, esp
je 0x10f3245
inc ecx
cmp ecx, 0x400
jb 0x10f3245
mov ecx, edx
shr edx, 2
inc ebp
mov eax, esp
and ecx, 3
inc ecx
inc ecx
shl eax, cl
inc ebp
sub eax, esp
inc esp
and eax, edx
shr edx, cl
mov eax, edx
inc ecx
inc eax
shr edx, 3
and eax, 7
je 0x10f3211
mov ecx, edx
shr edx, 2
inc ecx
mov eax, esp
and ecx, 3
inc ecx
shl eax, cl
inc ecx
sub eax, esp
and eax, edx
shr edx, cl
inc esp
add eax, eax
jmp 0x10f3169
inc ebp
add ebx, esp
inc ecx
mov ecx, ebx
inc ecx
mov eax, esp
shl eax, cl
inc ecx
cmp eax, ecx
jb 0x10f3166
inc ebp
cmp edi, ebx
mov ecx, 5
inc ecx
mov esi, edi
inc ecx
cmova esi, ebx
lea eax, [ecx - 1]
cmp esi, 0x15
cmovbe ecx, eax
inc ecx
mov eax, esp
shl eax, cl
movzx ecx, bx
shr ebx, 0x10
inc esp
lea edx, [eax - 1]
inc esp
and edx, edx
movzx edx, di
shr edi, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
inc ecx
add edx, 6
imul edx, edx, 0x4650
add edi, edx
mov edx, ebx
shl edx, 0x10
add edx, edi
inc ecx
xor edx, esi
inc esp
cmp edx, esi
ja 0x10f3193
inc ecx
mov ecx, edx
inc ecx
mov edx, 1
inc ecx
shl edx, cl
inc ecx
dec edx
inc esp
and edx, edx
inc ebp
cmp edx, ecx
jb 0x10f3208
movzx ecx, bx
shr ebx, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
movzx ecx, di
shr edi, 0x10
mov edx, ebx
imul ecx, ecx, 0x4650
add edi, ecx
shl edx, 0x10
add edx, edi
inc ecx
xor edx, esi
jmp 0x10f3193
inc ecx
mov esp, 1
inc ebp
add edx, esp
mov eax, ebp
inc ecx
mov ecx, ecx
inc ecx
sub eax, ecx
inc esp
cmp eax, eax
inc esp
cmova eax, eax
dec ecx
add ecx, ebp
inc ecx
mov eax, edx
dec eax
mov edx, ecx
inc ebp
add ecx, eax
dec eax
sub edx, eax
inc ebp
test eax, eax
je 0x10f324c
mov al, byte [edx]
dec ecx
add edx, esp
mov byte [ecx], al
dec ecx
add ecx, esp
dec ebp
sub eax, esp
jne 0x10f3234
jmp 0x10f324c
inc ebx
mov byte [ecx + ebp], dl
inc ebp
add ecx, esp
inc ecx
mov eax, ecx
dec eax
cmp eax, ebp
jb 0x10f30e2
inc ecx
pop edi
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x110ae36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol byte [ebx + edi - 0x18], 0xf
test edi, edx
add eax, dword [eax]
add byte [eax - 0x77], cl
test byte [eax + ebp*8], ah
add byte [eax], al
add byte [ebp + ecx*4 - 0x74], cl
and al, 0xe8
add byte [eax], al
add byte [ebp - 0x75], al

Function at 0x110ae52
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg eax, eax
add byte [eax], al
add byte [eax - 0x75], cl
aad 0x49

Function at 0x110ae6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [eax + eax]
add byte [eax - 0x75], cl
mov word [eax + ebp*8], fs
add byte [eax], al
add byte [ebp + 0x33], al
in eax, dx

Function at 0x110aeb3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
mov ebp, eax
mov ecx, 1
cmp eax, ecx
jne 0x110aee8
inc ecx
mov eax, dword [edi + 0xc0]
mov byte [eax + esi], cl
dec eax
mov ecx, dword [esp + 0xe8]
inc ebp
xor ebp, ebp
dec ecx
cmp ecx, ebp
je 0x110b184
xor eax, eax
inc esp
cmp ebp, eax
jne 0x110b2e3
inc ebp
xor ecx, ecx
inc ebp
xor eax, eax
dec eax
mov edx, dword [esp + 0xe8]
dec ecx
mov ecx, edi
call fcn.0110598c
inc esp
mov ebp, eax

Function at 0x110aedd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x110b184

Function at 0x110af0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
inc esp
cmp ebp, eax
jne 0x110b353
inc ebp
xor ebp, ebp
dec ebp
cmp dword [edi + 0xd8], ebp
jle 0x110af3f
dec eax
mov ecx, dword [esp + 0xe8]
dec ecx
cmp ecx, ebp
je 0x110b184
dec eax
mov eax, dword [ecx]
call dword [eax + 0x10]
invalid

Function at 0x110afb5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0x38
inc esp
cmp byte [esp + 0x3c], ch
je 0x110afcc
dec eax
lea eax, [ebp + 0xc]
dec eax
mov dword [esp + 0xe0], eax
jmp 0x110affb
inc ecx
cmp cl, ch
je 0x110afdf
dec eax
lea eax, [ebp + 0xf]
dec eax
mov dword [esp + 0xe0], eax
loopne 0x110afdb
add byte [eax], al
dec eax
lea eax, [ebp + 0x15]
dec eax
lea ecx, [ebp + 0x12]
inc esp
cmp byte [esp + 0x468], ch
dec eax
cmovne ecx, eax
dec eax
mov dword [esp + 0xe0], ecx

Function at 0x110afd9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
loopne 0x110afdb
add byte [eax], al
jmp 0x110affb
inc ebp
cmp byte [edi + 0x20], ch
je 0x110b46b
inc esp
cmp byte [ebp + 0x1c], ch
je 0x110b03c
dec ecx
mov eax, dword [edi + 0xe0]
dec esp
lea eax, [edx + eax]
dec eax
Function at 0x1000121c
Capabilities:
Access peb ldr_data

Disassembly:
push esi
jmp 0x1000123c
xor eax, eax
mov eax, dword fs:[eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x1000125f
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push edx
push ecx
mov ecx, 0x10014e79
xor dword [ecx - 0x121], 0x1638db40
pop ecx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
push dword [ebx + 0x7c]
push 0x9c830a79
pop dword [0x10014f30]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
add dword [esp], ebx
push edi
mov edi, 0x10015138
xor dword [edi - 0x326], 0x411f6b3b
mov byte [edi - 0x258], 0x58
pop edi
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
jmp 0x100012f4
jmp 0x1000132b
jmp 0x10001351
add edx, ecx
mov dword [ebp - 4], edx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x10001358
mov dword [0x10014d6c], edi
cmp eax, dword [ebp + 0xc]
je 0x10001380
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x100012b7
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
push edi
mov edi, 0x10014d8f
and byte [edi + 0xfc], 0xef
mov word [edi + 0x185], 0x3fc
pop edi
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
pop ecx
cmp eax, ebx
jbe 0x100013fb
cmp eax, ecx
jae 0x100013fb
push edi
mov edi, 0x10014e35
sbb word [edi + 0xbf], 0x63e8
and word [edi + 0x31f], 0x6a01
pop edi
push dword [ebp - 4]
push dword [ebp + 8]
sub esp, 4
mov dword [esp], 0xeb8ed3f6
add dword [esp], 0x343216f8
push dword [ebp + 8]
call fcn.1000125f
call eax
sub dword [0x10014ed7], edi
pop edi
pop esi
push ecx
mov ecx, 0x10015162
sub dword [ecx - 0x2bf], 0x15bc800
pop ecx
pop edx
pop ebx
leave
ret 8
Function at 0x40317f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40318e
pop dword [ebp - 8]
mov eax, 0x3d0814f0
sub eax, 0x3cc7e362
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xc067246c
sub dword [ebp - 0x18], 0x7214df21
mov dword [ebp - 0x14], 0xb6dbb835
add dword [ebp - 0x14], 0x7b579410
mov dword [ebp - 0x10], 0x47124f66
sub dword [ebp - 0x10], 0xfac60b38
mov dword [ebp - 0xc], 0xfe60cec9
add dword [ebp - 0xc], 0x19f3137
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x3e176b49
add dword [ebp - 0x18], 0x365afe0d
mov dword [ebp - 0x14], 0x20d7b308
add dword [ebp - 0x14], 0x2094ae6d
mov dword [ebp - 0x10], 0xb2c266b0
add dword [ebp - 0x10], 0xb0ad05bc
mov dword [ebp - 0xc], 0x11c6a29b
sub dword [ebp - 0xc], 0x11c6a29b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xd887f4a5
add eax, 0x27ba3c7f
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x40363
push 0
call eax
mov ecx, 0xb6461cec
add ecx, 0x49ba34b6
mov esi, eax
mov edi, 0x64dbde8d
add edi, 0x9b676573
add edi, dword [ebp - 8]
mov edx, 0x7f41aefd
sub edx, 0x6b321549
mov ebx, dword [edi]
sub dword [ebp - 4], 0x8f4f7287
xor ebx, edx
xor dword [ebp - 4], esi
mov dword [esi], ebx
add dword [ebp - 4], 0x977e26b7
add esi, 0x367d2722
sub esi, 0x367d271e
add edi, 0x62ac1f4f
sub edi, 0x62ac1f4b
loop 0x4032ab
add eax, 0x1970bcd
add eax, 0xfe6a2d8e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x1011b640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c7bfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x38]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], ecx
lea ecx, [edi + 0x4c]
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov eax, dword [esi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4