joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x77002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5d075c
mov dword [ebp - 0x20], 0x5f0064
push edi
mov dword [ebp - 0x1c], 0x6f0070
mov edx, 0x10
mov dword [ebp - 0x18], 0x750070
sub esi, eax
mov dword [ebp - 0x14], 0x5f0070
mov dword [ebp - 0x10], 0x680073
mov dword [ebp - 0xc], 0x77006f
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x471fce
movzx ecx, word [esi + eax]
test cx, cx
je 0x471fce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x471fb0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5d075c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x471ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x720067
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5d092c
mov dword [ebp - 0x1c], 0x700061
mov dword [ebp - 0x18], 0x2e0068
mov edx, 0xe
mov dword [ebp - 0x14], 0x710071
sub esi, eax
mov dword [ebp - 0x10], 0x63002e
mov dword [ebp - 0xc], 0x6d006f
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x47205e
movzx ecx, word [esi + eax]
test cx, cx
je 0x47205e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x472040
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d092c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x472080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5d0970
mov dword [ebp - 0x34], 0x61004d
lea esi, [ebp - 0x34]
mov dword [ebp - 0x30], 0x6e0069
push edi
mov dword [ebp - 0x2c], 0x690057
mov edx, 0x19
mov dword [ebp - 0x28], 0x64006e
sub esi, eax
mov dword [ebp - 0x24], 0x77006f
mov dword [ebp - 0x20], 0x650057
mov dword [ebp - 0x1c], 0x570062
mov dword [ebp - 0x18], 0x6e0069
mov dword [ebp - 0x14], 0x6f0064
mov dword [ebp - 0x10], 0x2e0077
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x472114
movzx ecx, word [esi + eax]
test cx, cx
je 0x472114
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4720f6
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d0970
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x472330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0718
mov dword [ebp - 0x28], 0x63002f
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x740061
mov edx, 0x13
mov dword [ebp - 0x1c], 0x5f0065
sub esi, eax
mov dword [ebp - 0x18], 0x650064
mov dword [ebp - 0x14], 0x6b0073
mov dword [ebp - 0x10], 0x69005f
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x6e
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x4723ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x4723ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x472390
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0718
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x4723d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x72002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5d07d4
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x72006f
mov edx, 0xe
mov dword [ebp - 0x14], 0x5f0064
sub esi, eax
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6f0066
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x47243e
movzx ecx, word [esi + eax]
test cx, cx
je 0x47243e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x472420
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d07d4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x472460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5d06f4
mov dword [ebp - 0x24], 0x73002f
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6c0069
push edi
mov dword [ebp - 0x1c], 0x6e0065
mov edx, 0x11
mov dword [ebp - 0x18], 0x5f0074
sub esi, eax
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x4724de
movzx ecx, word [esi + eax]
test cx, cx
je 0x4724de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4724c0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d06f4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x40b96a
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x44f6b0], 0
je 0x40b977
or eax, 0xffffffff
ret
mov eax, dword [0x43f58c]
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
jg 0x40b9b5
mov ecx, dword [0x43f588]
jl 0x40b990
cmp ecx, ebp
ja 0x40b9b5
or ebx, 0xffffffff
mov dword [0x44f5d0], ebp
add ecx, ebx
mov dword [0x44f5d4], ebp
mov dword [0x43f588], ecx
adc eax, ebx
mov dword [0x43f58c], eax
mov eax, ebx
jmp 0x40babf
push esi
push edi
mov edi, dword [0x44f5d4]
or ebx, 0xffffffff
cmp edi, ebp
jg 0x40ba1a
jl 0x40b9d0
mov esi, dword [0x44f5d0]
cmp esi, ebp
ja 0x40ba20
mov esi, 0x2000
push esi
push dword [0x44f5c4]
call fcn.0040bc99
cdq
mov ecx, eax
mov dword [0x44f5d0], eax
or ecx, edx
mov dword [0x44f5d4], edx
je 0x40ba5c
and eax, edx
cmp eax, ebx
je 0x40ba4d
add dword [0x44f608], esi
mov eax, dword [0x44f5c4]
adc dword [0x44f60c], ebp
mov dword [0x44f5c8], eax
call fcn.0040b396
mov edi, dword [0x44f5d4]
mov esi, dword [0x44f5d0]
mov eax, dword [0x43f5b8]
test byte [eax + 0x70], 1
je 0x40ba9f
cmp byte [0x45076d], 0
mov eax, esi
je 0x40ba6c
or eax, edi
je 0x40ba9f
push esi
push dword [0x44f5c8]
push 0x450778
call fcn.0040f338
jmp 0x40ba93
push 0x46601a
mov ecx, 0x45bdac
call fcn.00401a13
mov dword [0x44f5d0], ebp
mov eax, ebx
mov dword [0x44f5d4], ebp
jmp 0x40babd
or eax, edi
mov ebp, dword [0x44f5c8]
je 0x40ba9f
add esi, ebx
adc edi, ebx
call fcn.0040f103
xor byte [ebp], al
movzx eax, byte [ebp]
push eax
call fcn.0040f22a
mov eax, esi
inc ebp
or eax, edi
jne 0x40ba76
mov esi, dword [0x44f5d0]
mov edi, dword [0x44f5d4]
mov eax, dword [0x44f5c8]
add esi, ebx
mov dword [0x44f5d0], esi
adc edi, ebx
mov dword [0x44f5d4], edi
movzx eax, byte [eax]
inc dword [0x44f5c8]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40f164
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43565c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
call fcn.0040f121
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00417a90
add esp, 0xc
xor esi, esi
call fcn.0040f103
xor byte [ebp + esi - 0x10], al
movzx eax, byte [ebp + esi - 0x10]
push eax
call fcn.0040f22a
inc esi
cmp esi, 0xc
jl 0x40f192
mov eax, dword [0x43f5b8]
movzx edx, byte [ebp - 5]
movzx ecx, byte [0x44f627]
test byte [eax + 0x70], 2
jne 0x40f1c9
movzx ecx, byte [0x44f62f]
cmp edx, ecx
je 0x40f1d2
or eax, 0xffffffff
jmp 0x40f21b
cmp byte [ebp + 0x10], 0
je 0x40f219
mov ecx, dword [0x44f5d0]
mov eax, ecx
cdq
cmp edx, dword [0x43f58c]
jl 0x40f1f5
mov esi, dword [0x43f588]
jg 0x40f1f7
cmp eax, esi
ja 0x40f1f7
mov esi, ecx
push edi
mov edi, dword [0x44f5c8]
test esi, esi
je 0x40f218
call fcn.0040f103
xor byte [edi], al
movzx eax, byte [edi]
push eax
call fcn.0040f22a
inc edi
sub esi, 1
jne 0x40f202
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00416329
leave
ret 0xc
Function at 0x40f22a
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x4506f0]
mov eax, dword [esp + 4]
mov edx, dword [0x4506f8]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x43f160]
movzx eax, cl
add eax, dword [0x4506f4]
mov dword [0x4506f0], ecx
imul ecx, eax, 0x8088405
mov eax, dword [esp + 4]
inc ecx
mov dword [0x4506f4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x43f160]
mov dword [0x4506f8], edx
ret 4

Function at 0x40f46e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x43565c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x18], esi
call fcn.0040f80d
test ebp, ebp
je 0x40f4bb
cmp byte [esi], 0
je 0x40f4bb
push 0x18
pop ecx
mov esi, ebp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
jmp 0x40f4df
lea edi, [ebx + 0x60]
push 0x40
mov eax, edi
pop ecx
xor byte [eax], 0x6a
inc eax
sub ecx, 1
jne 0x40f4c3
push ebx
call fcn.00406835
push 0x40
push edi
push ebx
call fcn.00406866
test ebp, ebp
je 0x40f4f4
cmp byte [esi], 0
jne 0x40f4f4
mov eax, dword [esp + 0x10]
mov esi, ebx
push 0x18
pop ecx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x14
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.00406866
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0040f80d
cmp dword [esp + 0x3c], 0
pop edi
pop esi
pop ebp
pop ebx
jbe 0x40f52c
push dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call fcn.00417a90
add esp, 0xc
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00416329
add esp, 0x20
ret 0x14

Function at 0x40f53d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
lea ebx, [esi + 0x60]
cmp edi, 0x40
jbe 0x40f56d
push esi
call fcn.00406835
push edi
push dword [esp + 0x18]
push esi
call fcn.00406866
push ebx
push esi
call fcn.0040f80d
push 0x14
pop edi
jmp 0x40f57b
push edi
push dword [esp + 0x18]
push ebx
call fcn.00417a90
add esp, 0xc
mov dword [esi + 0xa0], edi
test edi, edi
je 0x40f59d
push 0xffffffffffffffa0
pop edx
mov ecx, ebx
sub edx, esi
xor byte [ecx], 0x36
inc ecx
mov edi, dword [esi + 0xa0]
lea eax, [edx + ecx]
cmp eax, edi
jb 0x40f58c
push 0x40
pop eax
sub eax, edi
push eax
lea eax, [esi + 0x60]
add eax, edi
push 0x36
push eax
call fcn.00417460
add esp, 0xc
push esi
call fcn.00406835
push 0x40
push ebx
push esi
call fcn.00406866
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x411b42
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push edi
push 0x42b4ac
push dword [esp + 0x18]
push dword [0x457d84]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x411c5b
push esi
push dword [0x457d84]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x411c5b
push esi
push dword [0x457d84]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411c5b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411c5b
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x411c53
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x411c4c
push edi
push esi
push eax
call fcn.00417a90
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x411c45
push ebp
push dword [esp + 0x14]
call fcn.00411aa6
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x42a22c]
call esi
test edi, edi
je 0x411c45
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x411c33
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x411c33
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x42a22c]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
jmp 0x411c5d
xor eax, eax
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x412404
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0xfa8]
mov eax, 0x1028
call fcn.004163d0
mov eax, dword [0x43565c]
xor eax, ebp
mov dword [ebp + 0xfa4], eax
cmp word [0x458d92], 0
je 0x4124b5
push esi
push 6
push dword [0x435604]
mov esi, 0x458d92
push esi
call fcn.00403bbb
push eax
call fcn.00408283
test eax, eax
jne 0x4124b4
push 0x457d90
call fcn.004120a6
push 0x800
push esi
lea eax, [ebp - 0x60]
push eax
call fcn.00406d8c
lea eax, [ebp - 0x60]
push eax
call fcn.0041b003
pop ecx
lea eax, [eax*2 + 2]
cmp eax, 0x1002
jae 0x4124ca
xor ecx, ecx
push 0x1e
mov word [ebp + eax - 0x60], cx
lea eax, [ebp - 0x80]
push ecx
push eax
call fcn.00417460
add esp, 0xc
mov dword [ebp - 0x7c], 3
push 0x14
pop eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
mov ecx, dword [ebp + 0xfa4]
xor ecx, ebp
call fcn.00416329
add ebp, 0xfa8
leave
ret
call fcn.00416545
int3
Function at 0x4150c8
Capabilities:
Hide graphical window

Disassembly:
and dword [0x457d8c], 0
push 1
push dword [esp + 8]
mov byte [0x450965], 1
mov byte [0x450966], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004011b3
cmp dword [0x468238], 0
jne 0x415108
cmp byte [0x450973], 0
je 0x415111
cmp dword [0x45096c], 0
jne 0x415124
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x4152a0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004163d0
mov eax, dword [0x43565c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push esi
call fcn.00406a95
mov esi, eax
test esi, esi
je 0x415301
movzx ecx, word [esi]
push ecx
jmp 0x4152ec
add esi, 2
movzx eax, word [esi]
push eax
call fcn.00406bb1
test al, al
jne 0x4152e5
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00416329
leave
ret 4
Function at 0x4150ba
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00415139
jae 0x4150c6
xor ecx, ecx
call fcn.00415139
jae 0x4150f0
xor eax, eax
call fcn.00415139
jae 0x415101
mov al, 0x10
call fcn.00415139
adc al, al
jae 0x4150e2
jne 0x41512e
stosb byte es:[edi], al
jmp 0x4150c7
call fcn.00415145
dec ecx
loop 0x41510d
mov eax, ebp
call fcn.00415143
jmp 0x41512f
lodsb al, byte [esi]
shr eax, 1
je 0x415155
adc ecx, 2
mov ebp, eax
jmp 0x41512f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00415143
cmp eax, 0x7d00
jae 0x41512d
cmp eax, 0x500
jae 0x41512e
cmp eax, 0x7f
ja 0x41512f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4150c7
pop ebp
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x12297689
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x74790f03
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x431005
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4ee23366
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3d0d4bf7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100277d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009712e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100af00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x464
call fcn.10095760
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100a06f4
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0xf
mov byte [edi + 0x90], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xbc], 0xf
mov byte [edi + 0xa8], 0
mov byte [ebp - 4], 2
mov ecx, edi
mov word [edi + 0xc1], 0
mov byte [edi + 0xc3], 0
push eax
mov dword [edi + 0xc0], 0
mov dword [edi + 0x3fc], 0
mov dword [edi + 0x400], 0
mov dword [edi + 0x404], 0
mov byte [edi + 0x408], 0
mov dword [edi + 0x40c], 0
mov byte [edi + 0x410], 0
mov dword [edi + 0x414], 0
mov dword [edi + 0x418], 0
mov dword [edi + 0x41c], 0
mov dword [edi + 0x420], 0
mov dword [edi + 0x424], 0
mov dword [edi + 0x428], 0
mov byte [edi + 0x438], 0
mov byte [edi + 0x43a], 0
call fcn.1001f000
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100af00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002d9fc
cmp byte [esi + 0x3d], 0
je 0x1002d9fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002d9ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002d9b1
sub eax, 1
je 0x1002d9b5
sub eax, 2
jne 0x1002d9ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10095741
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002d9d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002d9ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10095741
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10095741
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10095741
mov esp, ebp
pop ebp
ret
Function at 0x1002fd50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100f2de4], 0
push ebx
push esi
push edi
je 0x1002fede
mov ecx, dword [0x100f5408]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002fede
mov ecx, dword [0x100f5490]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1002fede
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x1002fdb0
xor edx, edx
test ecx, ecx
je 0x1002fdd9
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1002fdc0
cmp edi, 0x5ff56dc5
je 0x1002fde8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1002fede
mov ecx, dword [ebp - 4]
jmp 0x1002fd94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1002fede
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1002fede
movss xmm1, dword [0x100a53c0]
xor ebx, ebx
cmp edx, 4
jl 0x1002feab
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fe4c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fe67
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fe82
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fe95
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1002fe31
cmp ebx, edx
jl 0x1002feaf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1002fede
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fed3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1002fec0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret