joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af6f0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4af719
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4af719
mov eax, 1
pop esi
ret 4
push esi
push 0x4bf
call fcn.00466860
push eax
mov eax, dword [0x507344]
push eax
call fcn.00499df0
add esp, 0xc
xor eax, eax
pop esi
ret 4

Function at 0x4affec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d98f0]
jne 0x4afff6
repz ret
jmp fcn.004b6eec

Function at 0x4bf565
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004b6827
and dword [ebp - 4], 0
cmp dword [0x54b8b0], 0
mov ebx, eax
jne 0x4bf616
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4bf6c7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4bf6c7
push eax
call fcn.004b67b5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x54b8b0], eax
call esi
push eax
call fcn.004b67b5
mov dword [esp], 0x4cf878
push edi
mov dword [0x54b8b4], eax
call esi
push eax
call fcn.004b67b5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x54b8b8], eax
call esi
push eax
call fcn.004b67b5
pop ecx
mov dword [0x54b8c0], eax
test eax, eax
je 0x4bf616
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b67b5
pop ecx
mov dword [0x54b8bc], eax
mov eax, dword [0x54b8bc]
cmp eax, ebx
je 0x4bf66e
cmp dword [0x54b8c0], ebx
je 0x4bf66e
push eax
call fcn.004b6830
push dword [0x54b8c0]
mov esi, eax
call fcn.004b6830
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4bf66e
test edi, edi
je 0x4bf66e
call esi
test eax, eax
je 0x4bf665
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4bf665
test byte [ebp - 0xc], 1
jne 0x4bf66e
or dword [ebp + 0x10], 0x200000
jmp 0x4bf6a7
mov eax, dword [0x54b8b4]
cmp eax, ebx
je 0x4bf6a7
push eax
call fcn.004b6830
pop ecx
test eax, eax
je 0x4bf6a7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4bf6a7
mov eax, dword [0x54b8b8]
cmp eax, ebx
je 0x4bf6a7
push eax
call fcn.004b6830
pop ecx
test eax, eax
je 0x4bf6a7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x54b8b0]
call fcn.004b6830
pop ecx
test eax, eax
je 0x4bf6c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4bf6c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002620
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov eax, 1
imul ecx, eax, 0
mov dl, byte [ebp + 0xc]
mov byte [ebp + ecx - 0xc], dl
mov dword [ebp - 8], 1
jmp 0x1000264e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x10002689
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0xd]
shl edx, 1
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0xc], dl
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0xd]
and edx, 0x80
je 0x10002687
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0xc]
xor ecx, 0x1b
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0xc], cl
jmp 0x10002645
mov dword [ebp - 8], 0
jmp 0x1000269b
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100026c2
movzx edx, byte [ebp + 8]
mov ecx, dword [ebp - 8]
sar edx, cl
and edx, 1
je 0x100026c0
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0xc]
movzx edx, byte [ebp - 1]
xor edx, ecx
mov byte [ebp - 1], dl
jmp 0x10002692
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x10003500
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x10325476
push 0x40
push 0
mov eax, dword [ebp - 4]
add eax, 0x58
push eax
mov ecx, dword [ebp - 4]
call fcn.10004a30
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov byte [eax + edx + 0x58], 0x80
mov esp, ebp
pop ebp
ret

Function at 0x10036780
Capabilities:
Encode data using xor

Disassembly:
nop
and byte [edx], cl
mov es, word [esi]
mov ch, bh
mov ah, 0x12
arpl word [eax + 0x5e6e9b20], sp
xor byte [eax], ch
inc ecx
xor dl, byte [ebx - 0x71]
pushfd
cmp al, 0x92
outsd dx, dword [esi]
push edi
test al, 0xab
insb byte es:[edi], dx
popfd
and dword [edi], esp
cmp byte [ebp - 0x50], cl
sub al, 0x42
push es
dec esi
xor dword [edx - 0x72], ecx
mov dword [0xe491bc37], eax
mov ebx, 0xe0fa16e7
pop ss
sal dword [esi + 0x66], 0x8d
pop edi
nop
jbe 0x100367be
lea ebx, [edi - 0x70]
inc eax
wait
cmp esi, esp
fidivr word [edi]
jg 0x1003671f
sbb al, 0xd5
add dword [eax], ecx
retf 0x834f
in al, 0xa5
jmp 0x6decc85e
pop ebp
insb byte es:[edi], dx
mov ecx, 0xb5d0bfb4
out 0x93, al
test byte [ebp - 0x6720bb08], 0x15
push 0x2f
pop ss
push esi
cmp dword [esi - 0xe], ebp
xchg ebp, eax
inc ebx
enter 0x25a0, 0x71
rcl edx, cl
pop edi
and al, byte [ecx + 0x26b0345b]
jp 0x10036756
pop ebp
invalid
imul esi, dword [esi - 0x30], 0xb0908355
jl 0x10036770
mov byte [esi + 0x163010b9], bh
push ss
xchg ecx, eax
mov dh, 9
add bh, ch
jmp 0x100367cc
Function at 0x100838ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
rdtsc
xchg dx, ax
jmp 0x100b1b92
mov dword [esp + 0x44], esi
lea esi, [edi - 0x7e508b5f]
pushfd
mov esi, ecx
pushfd
lea esp, [esp + 0x4c]
jne 0x10078d0f
lea esi, [ebp + 0x5affcc8d]
cmc
xor al, al
not si
call fcn.1003832a
mov eax, dword [esi]
lea edx, [eax - 0x402e698d]
movsx dx, bl
mov dl, cl
mov edx, dword [eax + 4]
call fcn.10076786
Function at 0x101e73b
Capabilities:
Check if file exists
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101e6d0
and dword [eax], 0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101e6da
and dword [eax], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101e6e5
mov ebx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, ebx
jb 0x101e703
mov eax, 0x80070057
jmp 0x101e742
mov dword [ebp + 8], 1
test esi, esi
jbe 0x101e72d
cmp word [edi + esi*2 - 2], 0x5c
jne 0x101e728
push edi
dec esi
call fcn.0101e55a
test eax, eax
jne 0x101e728
and dword [ebp + 8], eax
mov word [edi + esi*2], ax
lea edi, [edi + esi*2]
sub ebx, esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101e736
mov dword [eax], edi
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101e73f
mov dword [eax], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x101ed7b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x210], ebx
cmp ecx, ebx
je 0x101ef75
cmp dword [ebp + 0xc], ebx
je 0x101ef75
mov edx, 0x8000
cmp dword [ebp + 0xc], edx
ja 0x101ef75
push esi
cmp eax, ebx
jne 0x101ede2
cmp edi, ebx
jne 0x101ee13
mov esi, 0x80070057
push 0x1001b64
push dword [ebp + 0xc]
push dword [ebp - 0x220]
call fcn.0101e259
lea eax, [ebp - 0x20c]
cmp dword [ebp - 0x210], eax
je 0x101edda
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
jmp 0x101ef7a
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ede5
sub eax, esi
sar eax, 1
mov dword [ebp - 0x21c], eax
cmp eax, edx
jb 0x101ee04
mov esi, 0x800700ce
jmp 0x101edad
test eax, eax
je 0x101ee0f
inc eax
mov dword [ebp - 0x21c], eax
test edi, edi
je 0x101ee31
mov eax, edi
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ee18
sub eax, esi
sar eax, 1
mov ebx, eax
cmp ebx, edx
jae 0x101edfd
test ebx, ebx
je 0x101ee31
inc ebx
mov eax, dword [ebp - 0x21c]
lea edi, [ebx + eax]
mov eax, 0x104
cmp edi, eax
jbe 0x101ee63
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x101ee7a
mov esi, 0x8007000e
jmp 0x101edad
xor ecx, ecx
mov word [ebp - 0x20c], cx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
mov edi, eax
cmp dword [ebp - 0x21c], 0
je 0x101ef37
test ebx, ebx
jne 0x101ee96
push dword [ebp - 0x214]
jmp 0x101ef41
mov ebx, dword [ebp - 0x218]
push ebx
call fcn.0101e020
test eax, eax
je 0x101eef5
push dword [ebp - 0x214]
push edi
push dword [ebp - 0x210]
call fcn.0101e259
mov esi, eax
test esi, esi
jl 0x101edad
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push dword [ebp - 0x210]
call fcn.0101e62b
mov esi, eax
test esi, esi
jl 0x101edad
push ebx
push dword [ebp - 0x218]
push dword [ebp - 0x214]
jmp 0x101ef48
cmp word [ebx], 0x5c
jne 0x101ef34
add ebx, 2
cmp word [ebx], 0x5c
je 0x101ef2e
push dword [ebp - 0x214]
push edi
push dword [ebp - 0x210]
call fcn.0101e259
mov esi, eax
test esi, esi
jl 0x101edad
push edi
push dword [ebp - 0x210]
call fcn.0101e865
jmp 0x101eeb8
mov ebx, dword [ebp - 0x218]
push ebx
jmp 0x101ef41
test ebx, ebx
je 0x101ef57
push dword [ebp - 0x218]
push edi
push dword [ebp - 0x210]
call fcn.0101e259
mov esi, eax
test esi, esi
jl 0x101edad
push dword [ebp + 0x18]
push dword [ebp - 0x210]
push dword [ebp + 0xc]
push dword [ebp - 0x220]
call fcn.0101e8e8
mov esi, eax
jmp 0x101edc0
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0101d51a
leave
ret 0x14
Function at 0x101ee14
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1021004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x210], ebx
cmp ecx, ebx
je 0x101ef75
cmp dword [ebp + 0xc], ebx
je 0x101ef75
mov edx, 0x8000
cmp dword [ebp + 0xc], edx
ja 0x101ef75
push esi
cmp eax, ebx
jne 0x101ede2
cmp edi, ebx
jne 0x101ee13
mov esi, 0x80070057
push 0x1001b64
push dword [ebp + 0xc]
push dword [ebp - 0x220]
call fcn.0101e259
lea eax, [ebp - 0x20c]
cmp dword [ebp - 0x210], eax
je 0x101edda
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
jmp 0x101ef7a
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ede5
sub eax, esi
sar eax, 1
mov dword [ebp - 0x21c], eax
cmp eax, edx
jb 0x101ee04
mov esi, 0x800700ce
jmp 0x101edad
test eax, eax
je 0x101ee0f
inc eax
mov dword [ebp - 0x21c], eax
test edi, edi
je 0x101ee31
mov eax, edi
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101ee18
sub eax, esi
sar eax, 1
mov ebx, eax
cmp ebx, edx
jae 0x101edfd
test ebx, ebx
je 0x101ee31
inc ebx
mov eax, dword [ebp - 0x21c]
lea edi, [ebx + eax]
mov eax, 0x104
cmp edi, eax
jbe 0x101ee63
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x101ee7a
mov esi, 0x8007000e
jmp 0x101edad
xor ecx, ecx
mov word [ebp - 0x20c], cx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
mov edi, eax
cmp dword [ebp - 0x21c], 0
je 0x101ef37
test ebx, ebx
jne 0x101ee96
push dword [ebp - 0x214]
jmp 0x101ef41
mov ebx, dword [ebp - 0x218]
push ebx
call fcn.0101e020
test eax, eax
je 0x101eef5
push dword [ebp - 0x214]
push edi
push dword [ebp - 0x210]
call fcn.0101e259
mov esi, eax
test esi, esi
jl 0x101edad
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push dword [ebp - 0x210]
call fcn.0101e62b
mov esi, eax
test esi, esi
jl 0x101edad
push ebx
push dword [ebp - 0x218]
push dword [ebp - 0x214]
jmp 0x101ef48
cmp word [ebx], 0x5c
jne 0x101ef34
add ebx, 2
cmp word [ebx], 0x5c
je 0x101ef2e
push dword [ebp - 0x214]
push edi
push dword [ebp - 0x210]
call fcn.0101e259
mov esi, eax
test esi, esi
jl 0x101edad
push edi
push dword [ebp - 0x210]
call fcn.0101e865
jmp 0x101eeb8
mov ebx, dword [ebp - 0x218]
push ebx
jmp 0x101ef41
test ebx, ebx
je 0x101ef57
push dword [ebp - 0x218]
push edi
push dword [ebp - 0x210]
call fcn.0101e259
mov esi, eax
test esi, esi
jl 0x101edad
push dword [ebp + 0x18]
push dword [ebp - 0x210]
push dword [ebp + 0xc]
push dword [ebp - 0x220]
call fcn.0101e8e8
mov esi, eax
jmp 0x101edc0
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0101d51a
leave
ret 0x14
Function at 0x1000cef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edx
and edx, 0x39e9
and edx, 0x6920
or edx, 0x8cb7
and edx, 0x1246a
pop edx
push eax
push esi
add esp, 4
xor eax, 0xb1d7
add eax, 0xdcb0
and eax, 0xc06b
pop eax
mov ecx, dword [ebp - 0x3e4]
add ecx, 0xe
mov dword [ebp - 0x19e8], ecx
push edi
sub edi, 0x152b5
add edi, 0x12116
sub edi, 0x11e73
pop edi
push eax
push edi
add esp, 4
sub eax, 0xcf3e
add eax, 0x12816
xor eax, 0x1db6
sbb eax, 0xf0810000
jg 0x1000cecc
add byte [eax], al
pop eax
cmp dword [ebp - 0x3e4], 0
je 0x1000ce8c
cmp dword [ebp - 0xac4], 0
jne 0x1000ced2
push edi
push edx
add esp, 4
jmp 0x1000ce97
sub edi, 0x4f6c
call 0x1000ceab
add byte [ebp + 0x48], cl
aaa
dec esi
inc esp
cmp ecx, dword [edi + esi - 0x7d]
les eax, [ebx + ebp*8]
add eax, 0x394f3d50
push eax
cmp eax, 0x5f46394f
push edx
jmp 0x1000cebd
pop edx
mov edx, dword [ebp - 0x7a0]
mov dword [ebp - 0x199c], edx
push 0
call dword [ebp - 0x199c]
mov dword [ebp - 0x20b4], 0xa
push ebx
push eax
add esp, 4
call 0x1000cef0
add byte [edx + esi], dh
xor bh, byte [0x4e4b3f33]
inc esp
add esp, 4
or ebx, 0x14b50
or ebx, 0x13f57
sub ebx, 0x7e3d
pop ebx
push ebx
add ebx, 0x12064
pop ebx
mov eax, dword [ebp - 0x3e4]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ed], cl
mov edx, dword [ebp - 0xac4]
sub edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x169c], edx
mov dword [ebp - 0xcec], 0
push ebx
push ebx
add esp, 4
sub ebx, 0x3afc
sub ebx, 0x3b46
pop ebx
push ecx
push edi
add esp, 4
or ecx, 0x61a5
pop ecx
push esi
sub esi, 0xdde5
add esi, 0xaf80
sub esi, 0x8208
pop esi
mov byte [ebp - 0x9d8], 0x56
mov byte [ebp - 0x9d7], 0x69
mov byte [ebp - 0x9d6], 0x72
mov byte [ebp - 0x9d5], 0x74
mov byte [ebp - 0x9d4], 0x75
mov byte [ebp - 0x9d3], 0x61
mov byte [ebp - 0x9d2], 0x6c
mov byte [ebp - 0x9d1], 0x50
mov byte [ebp - 0x9d0], 0x72
mov byte [ebp - 0x9cf], 0x6f
mov byte [ebp - 0x9ce], 0x74
mov byte [ebp - 0x9cd], 0x65
mov byte [ebp - 0x9cc], 0x63
mov byte [ebp - 0x9cb], 0x74
mov byte [ebp - 0x9ca], 0
push edx
push edi
add esp, 4
call 0x1000cfe9
add byte [esi + 0x3e], al
dec ebx
inc esi
dec edx
dec esi
dec edx
inc esp
cmp eax, 0x8104c483
ljmp 0xc281
Function at 0x1000cfe9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
and edx, 0x39e9
and edx, 0x6920
or edx, 0x8cb7
and edx, 0x1246a
pop edx
push eax
push esi
add esp, 4
xor eax, 0xb1d7
add eax, 0xdcb0
and eax, 0xc06b
pop eax
mov ecx, dword [ebp - 0x3e4]
add ecx, 0xe
mov dword [ebp - 0x19e8], ecx
push edi
sub edi, 0x152b5
add edi, 0x12116
sub edi, 0x11e73
pop edi
push eax
push edi
add esp, 4
sub eax, 0xcf3e
add eax, 0x12816
xor eax, 0x1db6
sbb eax, 0xf0810000
jg 0x1000cecc
add byte [eax], al
pop eax
cmp dword [ebp - 0x3e4], 0
je 0x1000ce8c
cmp dword [ebp - 0xac4], 0
jne 0x1000ced2
push edi
push edx
add esp, 4
jmp 0x1000ce97
sub edi, 0x4f6c
call 0x1000ceab
add byte [ebp + 0x48], cl
aaa
dec esi
inc esp
cmp ecx, dword [edi + esi - 0x7d]
les eax, [ebx + ebp*8]
add eax, 0x394f3d50
push eax
cmp eax, 0x5f46394f
push edx
jmp 0x1000cebd
pop edx
mov edx, dword [ebp - 0x7a0]
mov dword [ebp - 0x199c], edx
push 0
call dword [ebp - 0x199c]
mov dword [ebp - 0x20b4], 0xa
push ebx
push eax
add esp, 4
call 0x1000cef0
add byte [edx + esi], dh
xor bh, byte [0x4e4b3f33]
inc esp
add esp, 4
or ebx, 0x14b50
or ebx, 0x13f57
sub ebx, 0x7e3d
pop ebx
push ebx
add ebx, 0x12064
pop ebx
mov eax, dword [ebp - 0x3e4]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ed], cl
mov edx, dword [ebp - 0xac4]
sub edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x169c], edx
mov dword [ebp - 0xcec], 0
push ebx
push ebx
add esp, 4
sub ebx, 0x3afc
sub ebx, 0x3b46
pop ebx
push ecx
push edi
add esp, 4
or ecx, 0x61a5
pop ecx
push esi
sub esi, 0xdde5
add esi, 0xaf80
sub esi, 0x8208
pop esi
mov byte [ebp - 0x9d8], 0x56
mov byte [ebp - 0x9d7], 0x69
mov byte [ebp - 0x9d6], 0x72
mov byte [ebp - 0x9d5], 0x74
mov byte [ebp - 0x9d4], 0x75
mov byte [ebp - 0x9d3], 0x61
mov byte [ebp - 0x9d2], 0x6c
mov byte [ebp - 0x9d1], 0x50
mov byte [ebp - 0x9d0], 0x72
mov byte [ebp - 0x9cf], 0x6f
mov byte [ebp - 0x9ce], 0x74
mov byte [ebp - 0x9cd], 0x65
mov byte [ebp - 0x9cc], 0x63
mov byte [ebp - 0x9cb], 0x74
mov byte [ebp - 0x9ca], 0
push edx
push edi
add esp, 4
call 0x1000cfe9
add byte [esi + 0x3e], al
dec ebx
inc esi
dec edx
dec esi
dec edx
inc esp
cmp eax, 0x8104c483
ljmp 0xc281
Function at 0x100102f0
Capabilities:
Encode data using xor

Disassembly:
mov byte [ebp - 0xf], dh
add al, byte [edx]
mov esp, 0x303036f
imul ecx, dword [eax + edx*4 + 0x202f177], 0x30331bd
add eax, dword [ebx]
nop
ja 0x100102dd
add al, byte [edx]
mov ebp, 0x3030331
add eax, dword [ebx]
add ebp, dword [ecx - 0x74]
cwde
jns 0x100102e9
add al, byte [edx]
mov ebx, 0x3030367
invalid
invalid
add eax, dword [ebx]
add ebp, dword [ecx - 0x74]
cwde
jns 0x100102e9
add al, byte [edx]
mov ebx, 0x3030367
imul ecx, dword [eax + ecx*4 + 0x202f17b], 0x3036fbc
add ebp, dword [ecx - 0x74]
mov byte [ebx - 0xf], bh
add al, byte [edx]
mov esp, 0x303036f
imul ecx, dword [eax + edx*4 + 0x202f17d], 0x3036fbd
add ebp, dword [ecx - 0x74]
cwde
jg 0x1001030d
nop
jge 0x10010301
add al, byte [edx]
mov ebp, 0x303036f
imul ecx, dword [eax + ebx*4 + 0x202f17f], 0x8c69c336
mov byte [ecx + 0x560202f1], al
push esp
xchg bh, al
pop es
jmp 0x10010339
add al, byte [edx]
ret
add edi, dword [edi + edi]
push ebx
dec edx
xor eax, 0xc786443c
xchg bh, al
pop es
test dh, ah
sar byte [ecx + 4], 3
test dh, ah
or dword [esi + 0x9ee0304], eax
inc eax
dec ebp
add al, 3
out dx, al
or dword [eax + 0x4d], eax
inc ebx
cmp cl, byte [edi + esi + 0x5e]
push ebx
test bl, al
enter 0x321, 3
pop ebx
leave
mov bl, bl
test dword [edx], 0x88c95502
fdivr st(7), st(0)
add al, byte [edx]
ja 0x10010331
mov ch, bl
test dword [edx], 0x88c96f02
fdivrp st(7)
add al, byte [edx]
dec esp
leave
mov bh, bl
test dword [edx], 0x88c97102
fcompi st(7)
add al, byte [edx]
jno 0x10010346
mov al, ah
test dword [edx], 0x88c96c02
loopne 0x10010377
add al, byte [edx]
insb byte es:[edi], dx
leave
mov cl, ah
test dword [edx], 0x88c97702
loope 0x1001037e
add al, byte [edx]
ja 0x10010354
mov dl, ah
test dword [edx], 0x88c95802
jecxz 0x1001038c
loop 0x10010385
add al, byte [edx]
pop eax
leave
mov bl, ah
test dword [edx], 0x88c97102
in al, 0xf7
add al, byte [edx]
insb byte es:[edi], dx
leave
mov ch, ah
test dword [edx], 0x88c96602
out 0xf7, al
add al, byte [edx]
jb 0x10010377
add al, byte [edx]
jno 0x10010362
mov ah, ah
test dword [edx], 0x88c96c02
in eax, 0xf7
add al, byte [edx]
leave
mov dh, ah
test dword [edx], 0x88c97202
out 0xf7, eax
add al, byte [edx]
leave
mov al, ch
test dword [edx], 0x88c96802
jmp 0x660306b9
mov bh, ah
test dword [edx], 0x88c96702
call 0x780306b2
leave
mov cl, ch
test dword [edx], 0x88c95602
ljmp 0x88c9
Function at 0x10010b60
Capabilities:
Encode data using xor

Disassembly:
push 0xe3840303
test bl, ah
mov cl, 0x74
add eax, dword [ebx]
test bl, al
xchg ebx, eax
xor eax, 0x5a5b0304
push esi
xchg bh, al
pop es
test dl, ch
jnp 0x10010b63
add eax, dword [ebx]
test dl, dh
cmpsb byte [esi], byte es:[edi]
add ax, word [ebx]
bound eax, qword [esi + 0x2f5d3c0]
add al, byte [ebx]
js 0x10010b9d
retf 0x3b88
cmc
add al, byte [edx]
mov word [eax + 0x202fdc7], ds
push ebx
jmp 0x10010bb6
xchg bh, al
pop es
test bl, ch
sahf
push ebp
add eax, dword [ebx]
test bl, al
salc
push edx
add eax, dword [ebx]
pop ebx
push esp
push ebp
xchg bh, al
pop es
test ah, ch
mov ebp, 0xee0303d6
pop es
inc edx
xor eax, 0x88905c47
sub ebp, ebx
add al, byte [edx]
mov word [eax + 0x202f5d7], cs
mov ss, word [eax + 0x202fdc7]
mov ss, word [ebx + esi - 0x74]
cwde
fcomi st(5)
add al, byte [edx]
ret

Function at 0x10011080
Capabilities:
Encode data using xor

Disassembly:
push es
nop
push edi
add dword [edx], eax
add dl, byte [edx]
rcl dword [esi + ecx*4], 0x88
push edi
add dword [edx], eax
add dl, byte [edx]
ror dword [edi + 0x2fa3b08], 2
aam 0x77
daa
mov ds, word [eax + 0x202fb2f]
push es
cwde
push edi
add dword [edx], eax
add dl, byte [edx]
rol dword [0x8e23f386], 0x90
push edi
add dword [edx], eax
add dl, byte [edx]
rcl dword [edi + 0x2fa3b10], 2
lds edi, ds:[eax + 0xa]
in al, dx
dec ebx
add al, byte [edx]
add ch, dh
add eax, 0x42ec08ee
add al, byte [edx]
add dl, byte [ebp - 0x7c]
invalid

Function at 0x1003e5a1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003e23b
Function at 0x1004844a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
call fcn.1003d3a7
cmp eax, 2
sete bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1004847d
cmp dword [ebp + 8], 0
je 0x10048474
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, bl
je 0x100484bc
push 4
pop eax
jmp 0x100484cb
test bl, bl
je 0x100484bc
call fcn.1003f026
test al, al
je 0x100484bc
call fcn.1003f135
test al, al
jne 0x100484ab
mov eax, dword [ebp + 0x10]
or eax, 0x200000
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call fcn.1003efdd
jmp 0x100484cb
call fcn.1003f090
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
jmp 0x100484a4
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
add eax, 3
pop ebx
pop ebp
ret

Function at 0x100484ce
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004844a

Function at 0x10048d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10048d8c
push eax
push eax
push eax
push eax
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x10048db4
test esi, esi
je 0x10048dd8
push 0
push 0
push 0
push 0
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
pop esi
pop ebp
ret 0xc
test esi, esi
je 0x10048dd8
cmp esi, 0xffff
jbe 0x10048dd8
push 0
push 0
push 0
push 0
push 0xffffff36
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
pop esi
pop ebp
ret 0xc
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10048e1d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100091d0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
test edi, edi
je 0x10048e45
test esi, esi
je 0x10048e45
push 0
lea eax, [ebp + 8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10048e6e
mov eax, dword [ebp + 8]
test eax, eax
je 0x10048e5b
add edi, eax
sub esi, eax
jne 0x10048e25
xor esi, esi
test ebx, ebx
je 0x10048e52
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffff9c
call sym.NBUidai.dll_NBErrorsSetLastA
mov esi, eax
jmp 0x10048e47
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100091d0
mov esi, eax
jmp 0x10048e47