joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406818
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x41559c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test edx, edx
je 0x4068bc
push 0x19c
lea eax, [ebp - 0x1a8]
push 0
push eax
call fcn.00411470
add esp, 0xc
mov dword [ebp - 0x1ac], edi
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenTraceW]
cmp eax, 0xffffffff
jne 0x40688c
mov eax, dword [0x41671c]
mov esi, dword [eax + 0x64]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, esi
call fcn.00405c2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40691b
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
mov cl, byte [ebp - 0x138]
cmp cl, 5
jae 0x4068b5
movzx edx, cl
mov ecx, dword [0x41671c]
mov ecx, dword [ecx + 0x68]
call fcn.00405c2a
push 0x32
pop eax
jmp 0x40691b
xor eax, eax
cmp cl, 5
jmp 0x406914
push 0x110
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00411470
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4068fa
mov eax, dword [0x41671c]
mov esi, dword [eax + 0x6c]
jmp 0x406872
cmp dword [ebp - 0x120], 5
jae 0x40690b
mov edx, dword [ebp - 0x120]
jmp 0x4068a2
xor eax, eax
cmp dword [ebp - 0x120], 5
sete al
mov dword [esi], eax
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0040734a
leave
ret 4

Function at 0x406ef3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
push 0
push dword [esi]
push 0x4050b0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x406f22
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x406f7b
movzx eax, ax
or eax, 0x80070000
jmp 0x406f7b
push ebx
xor ecx, ecx
lea eax, [edi + 0x15]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004074f3
mov dword [esi], eax
pop ecx
test eax, eax
jne 0x406f48
mov eax, 0x8007000e
jmp 0x406f7a
push edi
push eax
push 0x4050b0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x406f6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x406f7a
movzx eax, ax
or eax, 0x80070000
jmp 0x406f7a
push ecx
mov ecx, dword [esi]
lea edx, [edi + 0x15]
call fcn.00406e3f
xor eax, eax
pop ebx
pop edi
pop esi
ret

Function at 0x407a52
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00407a5d
Function at 0x4089c2
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
call fcn.0040880d
mov esi, eax
test esi, esi
je 0x408b3f
push 0x401944
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401950
push esi
mov dword [0x415f28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40195c
push esi
mov dword [0x415f2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401968
push esi
mov dword [0x415f30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x415f28], 0
mov dword [0x415f34], eax
je 0x408a38
cmp dword [0x415f2c], 0
je 0x408a38
cmp dword [0x415f30], 0
je 0x408a38
test eax, eax
jne 0x408a60
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x415f2c], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x415f30], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x415f28], 0x408580
mov dword [0x415f34], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x415574], eax
cmp eax, 0xffffffff
je 0x408b44
push dword [0x415f2c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x408b44
call fcn.00408d72
push dword [0x415f28]
call fcn.00408632
push dword [0x415f2c]
mov dword [0x415f28], eax
call fcn.00408632
push dword [0x415f30]
mov dword [0x415f2c], eax
call fcn.00408632
push dword [0x415f34]
mov dword [0x415f30], eax
call fcn.00408632
add esp, 0x10
mov dword [0x415f34], eax
call fcn.0040c94a
test eax, eax
je 0x408b3f
push 0x4086b0
push dword [0x415f28]
call fcn.004085bd
pop ecx
mov esi, eax
mov ecx, eax
call dword [0x418184]
call esi
mov dword [0x415570], eax
cmp eax, 0xffffffff
je 0x408b3f
push 0x214
push 1
call fcn.0040d41d
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x408b3f
push edi
push dword [0x415570]
push dword [0x415f30]
call fcn.004085bd
pop ecx
mov esi, eax
mov ecx, eax
call dword [0x418184]
call esi
test eax, eax
jne 0x408b49
push edi
call fcn.0040af8f
pop ecx
call fcn.00408b5c
xor eax, eax
pop edi
pop esi
ret
push 0
push edi
call fcn.004088e9
pop ecx
pop ecx
or dword [edi + 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x408b46
Function at 0x408fc1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov esi, ebx
cmp edi, dword [esi*8 + 0x401008]
je 0x408fe0
inc esi
cmp esi, 0x17
jb 0x408fd1
cmp esi, 0x17
jae 0x409120
push 3
call fcn.0040d9fe
pop ecx
cmp eax, 1
je 0x4090ea
push 3
call fcn.0040d9fe
pop ecx
test eax, eax
jne 0x409013
cmp dword [0x415560], 1
je 0x4090ea
cmp edi, 0xfc
je 0x409120
push 0x401f40
push 0x314
mov edi, 0x415f78
push edi
call fcn.0040d90f
add esp, 0xc
test eax, eax
je 0x409048
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040aaa0
add esp, 0x14
push 0x104
push 0x415f91
push ebx
mov byte [0x416095], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40908b
push 0x401f5c
push 0x2fb
push 0x415f91
call fcn.0040d90f
add esp, 0xc
test eax, eax
je 0x40908b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040aaa0
add esp, 0x14
push 0x401f74
push 0x314
push edi
call fcn.0040d97f
add esp, 0xc
test eax, eax
je 0x4090af
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040aaa0
add esp, 0x14
push dword [esi*8 + 0x40100c]
push 0x314
push edi
call fcn.0040d97f
add esp, 0xc
test eax, eax
je 0x4090d5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040aaa0
add esp, 0x14
push 0x12010
push 0x401f78
push edi
call fcn.0040da4a
add esp, 0xc
jmp 0x409120
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, eax
test edx, edx
je 0x409120
cmp edx, 0xffffffff
je 0x409120
mov esi, dword [esi*8 + 0x40100c]
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409109
push ebx
lea eax, [ebp - 4]
sub ecx, edi
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4098dd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x40993f
push ebx
xor ebx, ebx
push esi
mov esi, edi
cmp word [edi], bx
je 0x409913
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40990e
add esi, 2
movzx ecx, word [esi]
test cx, cx
jne 0x4098fb
sub esi, edi
add esi, 2
push esi
call fcn.0040ae7a
mov dword [ebp - 4], eax
pop ecx
test eax, eax
je 0x409934
push esi
push edi
push eax
call fcn.0040e7c0
mov ebx, dword [ebp - 4]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop esi
mov eax, ebx
pop ebx
pop edi
leave
ret
Function at 0x40bd1a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x41559c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea edi, [ebp - 0x10c]
xor esi, esi
mov eax, edi
mov ebx, esi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x104
jle 0x40bdaa
inc eax
push 1
push eax
mov dword [ebp - 0x110], eax
call fcn.0040e711
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40bd9a
call fcn.0040aa45
mov dword [eax], 0xc
call fcn.0040aa45
mov dword [eax], 0xc
test ebx, ebx
je 0x40bd89
push edi
call fcn.0040af8f
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040734a
leave
ret
push edi
push dword [ebp - 0x110]
xor ebx, ebx
inc ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40bd73
cmp byte [edi + 1], 0x3a
jne 0x40bd7e
movzx eax, byte [edi]
push eax
call fcn.00410bd3
pop ecx
lea esi, [eax - 0x40]
jmp 0x40bd7e
Function at 0x40d470
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40d4ae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40d4a6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40d4b0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40d496
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40d580
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40d5b1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40d5b1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40d5b1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40da4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41559c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x18], eax
call fcn.004086a7
xor esi, esi
mov ebx, eax
cmp dword [0x41663c], esi
jne 0x40db2a
push esi
push esi
push 0x4022e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40dc0c
push 0x402300
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40dc0c
push eax
call fcn.00408632
mov dword [esp], 0x40230c
push edi
mov dword [0x41663c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00408632
mov dword [esp], 0x40231c
push edi
mov dword [0x416640], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00408632
mov dword [esp], 0x402330
push edi
mov dword [0x416644], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00408632
pop ecx
mov ecx, eax
mov dword [0x41664c], ecx
test ecx, ecx
je 0x40db23
push 0x40234c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00408632
pop ecx
mov dword [0x416648], eax
jmp 0x40db2f
mov eax, dword [0x416648]
jmp 0x40db35
mov eax, dword [0x416648]
mov ecx, dword [0x41664c]
cmp eax, ebx
je 0x40db9b
cmp ecx, ebx
je 0x40db9b
push eax
call fcn.004085bd
push dword [0x41664c]
mov dword [ebp - 0x14], eax
call fcn.004085bd
mov edi, eax
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
test eax, eax
je 0x40db9b
test edi, edi
je 0x40db9b
mov ecx, eax
call dword [0x418184]
mov eax, dword [ebp - 0x14]
call eax
test eax, eax
je 0x40db92
lea ecx, [ebp - 0x20]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
mov ecx, edi
call dword [0x418184]
call edi
test eax, eax
je 0x40db92
test byte [ebp - 8], 1
jne 0x40db9b
or dword [ebp + 0x10], 0x200000
jmp 0x40dbe4
mov eax, dword [0x416640]
cmp eax, ebx
je 0x40dbe4
push eax
call fcn.004085bd
mov edi, eax
pop ecx
test edi, edi
je 0x40dbe4
mov ecx, edi
call dword [0x418184]
call edi
mov esi, eax
test esi, esi
je 0x40dbe4
mov eax, dword [0x416644]
cmp eax, ebx
je 0x40dbe4
push eax
call fcn.004085bd
mov edi, eax
pop ecx
test edi, edi
je 0x40dbe4
push esi
mov ecx, edi
call dword [0x418184]
call edi
mov esi, eax
push dword [0x41663c]
call fcn.004085bd
mov edi, eax
pop ecx
test edi, edi
je 0x40dc0c
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push esi
call dword [0x418184]
call edi
jmp 0x40dc0e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040734a
leave
ret
Function at 0x41096f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x41559c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x4109fc
push esi
call fcn.00413196
pop ecx
test eax, eax
jne 0x4109c1
call fcn.0040aa0f
mov dword [eax], 0xf
call fcn.0040aa45
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040734a
leave
ret
push 0x3a
lea eax, [esi + 0x40]
mov esi, 0x104
mov word [ebp - 0xc], ax
pop eax
push 0x2e
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x410a0f
lea eax, [ebp - 0x214]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4109b1
inc eax
cmp eax, esi
ja 0x4109b1
mov esi, dword [ebp + 0x10]
test edi, edi
jne 0x410a63
cmp eax, esi
jle 0x410a25
mov esi, eax
lea eax, [ebp - 0x218]
push eax
push 2
pop ecx
mov eax, esi
mul ecx
push edx
push eax
call fcn.004093ae
add esp, 0xc
test eax, eax
js 0x410a53
push dword [ebp - 0x218]
call fcn.0040ae7a
mov edi, eax
pop ecx
test edi, edi
jne 0x410a77
call fcn.0040aa45
mov dword [eax], 0xc
jmp 0x4109b1
cmp eax, esi
jle 0x410a77
call fcn.0040aa45
mov dword [eax], 0x22
jmp 0x4109b1
lea eax, [ebp - 0x214]
push eax
push esi
push edi
call fcn.0040e751
add esp, 0xc
mov eax, edi
jmp 0x4109b3
Function at 0x41267d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 1
push esi
push esi
push edi
mov ebx, esi
mov dword [ebp - 8], esi
call fcn.0040ee09
mov ecx, edx
mov dword [ebp - 0x18], eax
and eax, ecx
mov dword [ebp - 0x14], ecx
add esp, 0x10
cmp eax, 0xffffffff
je 0x412707
push 2
push esi
push esi
push edi
call fcn.0040ee09
mov ecx, eax
add esp, 0x10
and eax, edx
cmp eax, 0xffffffff
je 0x412707
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x41279e
jg 0x4126e1
test esi, esi
je 0x41279e
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x412713
call fcn.0040aa45
mov dword [eax], 0xc
call fcn.0040aa45
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.00407665
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
jl 0x41273b
jg 0x412734
cmp esi, 0x1000
jb 0x41273b
mov eax, 0x1000
jmp 0x41273d
mov eax, esi
push eax
push dword [ebp - 0xc]
push edi
call fcn.0040bfb2
add esp, 0xc
cmp eax, 0xffffffff
je 0x412764
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x41277f
jg 0x412726
test esi, esi
je 0x41277f
jmp 0x412726
call fcn.0040aa0f
cmp dword [eax], 5
jne 0x412779
call fcn.0040aa45
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.00407665
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x412804
test eax, eax
jg 0x412810
jl 0x4127a8
test esi, esi
jae 0x412810
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0040ee09
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x412707
push edi
call fcn.0040b32c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov ebx, eax
mov eax, edx
mov ecx, ebx
mov dword [ebp - 8], eax
and ecx, eax
cmp ecx, 0xffffffff
jne 0x412810
call fcn.0040aa45
mov dword [eax], 0xd
call fcn.0040aa0f
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x412707
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.0040ee09
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x412707
xor eax, eax
jmp 0x41270e
Function at 0x413196
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4131a8
xor eax, eax
inc eax
leave
ret
add al, 0x40
mov word [ebp - 3], 0x5c3a
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x4131ca
cmp eax, 1
jne 0x4131a3
xor eax, eax
leave
ret

Function at 0x41350e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x41559c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
xor esi, esi
pop eax
mov dword [ebp - 0xc], esi
call fcn.00410c50
mov eax, esp
lea ecx, [ebp - 0x34]
push 0x1c
push ecx
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41361d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x54]
push 0x401990
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41359f
push 0x4030a8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x41359f
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call dword [0x418184]
call edi
cmp eax, 1
jne 0x41359f
cmp dword [ebp - 0xc], esi
jbe 0x41359f
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push esi
call fcn.00409386
add esp, 0xc
test eax, eax
js 0x41361d
mov esi, dword [ebp - 8]
not edi
and esi, edi
mov dword [ebp - 8], esi
je 0x4135d5
lea eax, [ebp - 8]
push eax
push ebx
push esi
call fcn.00409386
add esp, 0xc
test eax, eax
js 0x41361d
mov esi, dword [ebp - 8]
lea eax, [ebx + ebx]
cmp esi, eax
jae 0x4135de
mov esi, eax
mov eax, dword [ebp - 0x14]
mov edi, ebx
neg edi
add eax, ebx
and edi, dword [ebp - 0x10]
sub edi, esi
cmp edi, eax
jb 0x41361d
push 4
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x41361d
lea ecx, [ebp - 0x18]
push ecx
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41361d
xor eax, eax
inc eax
jmp 0x41361f
xor eax, eax
lea esp, [ebp - 0x64]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040734a
leave
ret
Function at 0x40693a
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406962
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406954
pop edi
pop esi
pop ebp
ret 4

Function at 0x409c6c
Capabilities:
Encode data using xor

Disassembly:
arpl word [edx], sp
les ebx, [edi + edx*4 + 0x534e555]
jl 0x409c3a
int3
jmp 0x409bb5
push ebp
imul esi, dword [esi], 0xbaf1440b
mov dword [0x63366186], eax
sbb dh, ah
mov ch, 0xf
les ebx, [edi]
xor al, 0x98
pinsrw mm3, word [edi], 0x34
cwde
cmpsb byte [esi], byte es:[edi]
mov dl, 0xee
jbe 0x409bf0
iretd
invalid
xchg dword [esi - 0x1bdb0d79], ecx
lcall 0xe8a, 0xa3c47d0a
and al, 0x86
adc esp, dword [ecx]
inc edx
jl 0x409beb
xchg esi, eax
xor al, byte [ebx]
pop edx
pop ss
or al, 0xf
mov edx, 0xdb3077e
and dword [ecx], 4
mov ebx, 0xd29fa0ea
movsb byte es:[edi], byte [esi]
shr byte [edx + esi*4 - 0x67], 0x42
insb byte es:[edi], dx
mov dl, 0x99
inc edx
insb byte es:[edi], dx
mov dl, 0x99
inc edx
push esp
mov dword [0x9c310cdd], eax
les ecx, [eax]
push cs
xchg ebx, eax
mov dh, 0xca
salc
jo 0x409bff
and al, 0xc0
sub dh, byte [esi]
mov bl, 0xf1
xchg ebp, eax
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
loopne 0x409c9a
xchg esi, eax
pushfd
mov ebx, 0xf9bb95c3
adc eax, 0x650f0604
std
hlt
cmp byte [edi], dh
aaa
cdq
je 0x409c9b
cld
jne 0x409c42
adc dword [ebp - 0x485517ce], ebp
outsb dx, byte [esi]
xor bl, ch
fucom st(2)
fmul st(5)
add cl, cl
xor al, 0x13
adc esi, dword [esi - 0x16]
Function at 0x42e8c2
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x9c0609e2
jmp 0x42e8f4
out dx, al
bound ebp, qword [eax]
adc dh, byte [eax - 0x39]
xor al, 0x32
or byte [esi + 0x26], cl
js 0x42e914
sbb bh, 0x45
sti
je 0x42e87c
popal
fcomp qword [edi + 0x5e]
ljmp 0x9442
xor byte [ecx - 0x6b], 0xd6
inc esi
mov byte [0x624413cf], al
xor bl, byte [ebx + 0x52d24ac5]
push edx
xchg dword [ebp + 0x26c59da4], edx
push ss
shl byte [esi - 0x2155393d], 0x51
jecxz 0x42e931
sbb al, 0xe0
pop edx
loopne 0x42e971
xchg ecx, eax
repne outsd dx, dword [esi]
add esi, ecx
xor byte [esp - 6], al
and al, 0x6d
test dword [edi], ebx
pop es
jl 0x42e903
les edx, [ebx + eax*4 + 0x31c67382]
inc ecx
add dword [edx + 0x4131c673], 0xffffffe3
and bl, byte [edx]
xchg edi, eax
and dh, byte [ebp - 0x3b]
push edi
jecxz 0x42e955
sbb dl, byte [edi + 0x57c57522]
inc ebx
sbb dword [edx + 0x76], eax
pop esi
shl byte [edx - 0x3a], 0x92
adc dh, byte [edx + 7]
jmp 0x42e92b
les esp, [ecx]
fstp qword [ebx + 0x7f]
mov dword cs:[edi], 0x963c1301
mov cl, 0x87
mov cl, 0x3d
invalid
stosd dword es:[edi], eax
adc al, 0xa
test al, 0xda
inc edi
mov al, 0x73
pop ebp
cmc
invalid
Function at 0x44e6fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
test dword [esi + 0x28], 0x8001
jne 0x44e711
pop esi
leave
ret
test byte [esi + 0x28], 0x10
jne 0x44e70e
mov eax, dword [esi + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x14]
push edi
mov dword [ebp - 4], eax
xor eax, eax
push eax
push eax
push eax
call fcn.0044e7e4
test dword [esi + 0x28], 0x4000
jne 0x48d269
mov edi, 0x10000
push ebx
push edi
call fcn.00469129
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0044ea40
push edi
mov edi, dword [ebp - 0x10]
mov ecx, esi
push edi
call fcn.00452d5e
push 0
push dword [ebp - 4]
mov ecx, esi
mov ebx, eax
push dword [ebp - 8]
call fcn.0044e7e4
test ebx, ebx
je 0x48d277
mov edx, ebx
mov byte [ebp - 0x1c], 1
mov ecx, edi
mov dword [ebp - 0x18], 0x46
mov dword [ebp - 0x14], 0xa
call fcn.0044ea16
test eax, eax
jne 0x44e7b7
test dword [esi + 0x28], 0xff0
jne 0x48d286
push ebx
push edi
lea ecx, [ebp - 0x1c]
call fcn.0044e92e
mov dword [esi + 0x2c], eax
cmp eax, 2
jne 0x44e7ba
push 4
pop eax
mov dword [esi + 0x2c], eax
mov ecx, eax
call fcn.0044e90e
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 0xc]
pop ebx
sub dword [eax], 1
jne 0x44e7de
push 4
push eax
call fcn.004690eb
push edi
call fcn.00469132
add esp, 0xc
pop edi
jmp 0x44e70e
cmp dword [ecx], esi
ljmp 0x2aa4
invalid
cdq
sbb al, bh
add dword fs:[ebp - 0x53], esi
dec eax
xchg dword [esi + 0x3d], ebp
mov edx, 0xfab7be87
fldcw word [edi + ebx*2]
mov eax, 0x36b6fac4
cld
mov ebx, 0xda79db57
stc
jb 0x48d312
or edi, esi
inc esp
sti
mov bh, 0xa2
out 0x2a, eax
mov ch, 0x2c
add al, 0x99