joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ed4ca
Capabilities:
Get disk information

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x6d15dc]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x48
mov eax, 0x623f7b
call fcn.0057938a
mov esi, dword [ebp + 0x24c]
push str.determineFilesystemType
push dword [0x6d4ccc]
lea ecx, [ebp - 0x10]
call fcn.00567f08
lea eax, [ebp]
push esi
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.005ad451
pop ecx
pop ecx
cmp dword [ebp + 0x18], 0x10
mov ecx, dword [ebp + 4]
mov byte [ebp - 4], 1
jae 0x5ed528
lea ecx, [ebp + 4]
mov eax, 0x104
push eax
lea edx, [ebp + 0x13c]
push edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x18]
push edx
push eax
lea eax, [ebp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x5ed58c
push 2
pop esi
push edi
push 1
lea ecx, [ebp]
call fcn.00414e93
lea ecx, [ebp - 0x10]
call fcn.00566b7e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0057937b
add ebp, 0x244
leave
ret
lea eax, [ebp + 0x13c]
push eax
lea ecx, [ebp - 0x38]
call fcn.0041466e
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.005a8c69
pop ecx
pop ecx
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.00414e93
push str.NTFS
lea ecx, [ebp + 0x1c]
call fcn.0041951a
test eax, eax
lea ecx, [ebp + 0x1c]
jne 0x5ed5df
push edi
push esi
call fcn.00418ad9
jmp 0x5ed554
push 3
push edi
lea eax, [ebp - 0x54]
push eax
call fcn.004188a2
push 0x653264
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0041951a
mov ebx, eax
neg ebx
push edi
sbb bl, bl
push esi
lea ecx, [ebp - 0x54]
inc bl
call fcn.00418ad9
push edi
lea ecx, [ebp + 0x1c]
push esi
call fcn.00418ad9
test bl, bl
je 0x5ed551
xor esi, esi
jmp 0x5ed554
Function at 0x5ed7f1
Capabilities:
Get disk information

Disassembly:
push 0x30
mov eax, 0x624039
call fcn.005793f3
mov ebx, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x38], esi
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.Ghost::Filesystem::Win32LfoFilesystem.0
call fcn.0041f289
lea edi, [esi + 0xc]
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00418815
push str.constructor
push dword [0x6d4ccc]
lea ecx, [ebp - 0x30]
call fcn.00567f08
lea eax, [ebp - 0x2c]
push edi
push eax
mov byte [ebp - 4], 3
call fcn.005ad451
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 4
jae 0x5ed85c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
sete al
push edi
mov byte [esi + 0x28], al
call fcn.005ed4ca
cmp dword [ebp - 0x14], 0x10
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 0x28]
pop ecx
mov byte [esi + 0x29], 0
jae 0x5ed886
lea eax, [ebp - 0x28]
xor edi, edi
push edi
push edi
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push edi
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x5ed8ae
cmp dword [esi + 0x2c], 2
jne 0x5ed8ae
mov al, byte [ebp - 0x34]
and al, 1
mov byte [esi + 0x29], al
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00414e93
lea ecx, [ebp - 0x30]
call fcn.00566b7e
mov eax, esi
call fcn.00579476
ret 8
Function at 0x100047a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100047cc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x10003fa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100047dc
cmp dword [ebp + 0xc], 0
jne 0x100047dc
mov ecx, 0x100227ec
call fcn.10001550
mov eax, 1
pop ebp
ret 0xc

Function at 0x100054c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100054ec
mov dword [ebp - 4], 1
jmp 0x100054f3
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10005500
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
ret

Function at 0x1000b6f0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000b72f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000b72f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000b72f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000b72f
cmp dword [ecx + 0x74], 0xe
jbe 0x1000b72f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000e04e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019b90
push 0x10019b88
push str.FlsAlloc
push 0x1f
call fcn.1000df6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e082
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001813c]
call esi
jmp 0x1000e088
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000e0cc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019ba0
push 0x10019b98
push str.FlsGetValue
push 0x21
call fcn.1000df6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e103
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001813c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000e10b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019ba8
push 0x10019ba0
push str.FlsSetValue
push 0x22
call fcn.1000df6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e145
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001813c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000faeb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000fb88
push ebx
push esi
call fcn.1000fab4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000fa48
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000fb35
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000fb87
push edi
push eax
call fcn.1000cba1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000fb55
call fcn.1000cb67
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000fb86
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000fa48
add esp, 0x20
test eax, eax
jne 0x1000fb74
push edi
call fcn.1000cb67
jmp 0x1000fb7c
push ebx
call fcn.1000cb67
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10017000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001702d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001702d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4039d0
pop dword [ebp - 8]
mov eax, 0x700f9169
sub eax, 0x6fcf5799
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x76390bf3
add dword [ebp - 0x18], 0xd8193958
mov dword [ebp - 0x14], 0xcd3e5b17
sub dword [ebp - 0x14], 0x9b0b0ed2
mov dword [ebp - 0x10], 0x8423c054
sub dword [ebp - 0x10], 0x37d77c26
mov dword [ebp - 0xc], 0x985f2ad
sub dword [ebp - 0xc], 0x985f2ad
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x9c4b578d
add dword [ebp - 0x18], 0xd82711c9
mov dword [ebp - 0x14], 0xda941667
add dword [ebp - 0x14], 0x66d84b0e
mov dword [ebp - 0x10], 0x9e02d9c1
sub dword [ebp - 0x10], 0x3a936d55
mov dword [ebp - 0xc], 0xedc6491c
sub dword [ebp - 0xc], 0xedc6491c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x9fc6c716
sub eax, 0x9f86868e
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x384b8
push 0
call eax
mov ecx, 0x11e38405
sub ecx, 0x11e335b0
mov esi, eax
mov edi, 0xd66dda2e
sub edi, 0xd62d522e
add edi, dword [ebp - 8]
mov ebx, 0xf7f03bab
add dword [ebp - 4], 0x5e2b8cb7
mov edx, dword [edi]
sub dword [ebp - 4], eax
add edx, ebx
sub dword [ebp - 4], ecx
mov dword [esi], edx
xor dword [ebp - 4], 0x9cb48538
add esi, 0x4bbda05a
sub esi, 0x4bbda056
add edi, 4
loop 0x403ae7
add eax, 0x8c3a2f5
sub eax, 0x8c276ce
mov ebx, eax
add eax, 5
mov ecx, 0xf490e69
sub ecx, 0xf090e69
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40e063
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004097cf
mov dword [ebp - 0x14], eax
cmp dword [0x814064], esi
jne 0x40e156
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e0e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e236
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e236
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e236
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x814064], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x814068], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x81406c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x814074], eax
test eax, eax
je 0x40e153
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x814070], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e17b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e16e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e190
push 4
pop eax
jmp 0x40e238
cmp dword [ebp - 0x14], esi
je 0x40e190
push dword [0x814064]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e175
mov eax, dword [0x814070]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e1ee
cmp dword [0x814074], edi
je 0x40e1ee
push eax
call ebx
push dword [0x814074]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e1ee
test eax, eax
je 0x40e1ee
call ecx
test eax, eax
je 0x40e1e3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e1e3
test byte [ebp - 8], 1
jne 0x40e1ee
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e21e
mov eax, dword [0x814068]
cmp eax, edi
je 0x40e21b
push eax
call ebx
test eax, eax
je 0x40e21b
call eax
mov esi, eax
test esi, esi
je 0x40e21b
mov eax, dword [0x81406c]
cmp eax, edi
je 0x40e21b
push eax
call ebx
test eax, eax
je 0x40e21b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x814064]
call ebx
test eax, eax
je 0x40e236
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e238
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040419b
mov esp, ebp
pop ebp
ret
Function at 0x6d7b364a
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d4c]
test eax, eax
je 0x6d7b36b9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d4c]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.6d7ba65b
pop ecx
pop edi
pop esi
ret

Function at 0x6d7b3d88
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x6d7b3dbd
push edi
mov edi, 0x120
cmp dword [esp + 0x10], edi
jae 0x6d7b3db0
push eax
call fcn.6d7b4838
push 2
call fcn.6d7b4827
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
pop edi
pop esi
ret

Function at 0x6d7be17a
Capabilities:
Read file on windows

Disassembly:
cmp byte [esi], 0
push ebx
push edi
jne 0x6d7be200
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
mov ebx, dword [sym.imp.MSVCR100.dll_fread]
test ecx, ecx
je 0x6d7be1a0
push 1
push esi
push edi
call ecx
add esp, 0xc
jmp 0x6d7be1ad
push dword [eax + 0x38]
push 1
push 1
push esi
call ebx
add esp, 0x10
cmp eax, 1
je 0x6d7be1c0
mov dword [0x6d7d9e8c], 0x66
xor eax, eax
jmp 0x6d7be215
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
lea edi, [esi + 1]
test ecx, ecx
je 0x6d7be1dd
movzx eax, byte [esi]
push eax
push edi
push dword [esp + 0x14]
call ecx
add esp, 0xc
jmp 0x6d7be1ec
push dword [eax + 0x38]
movzx eax, byte [esi]
push eax
push 1
push edi
call ebx
add esp, 0x10
movzx ecx, byte [esi]
cmp eax, ecx
jne 0x6d7be1b2
mov al, byte [edi]
mov ecx, dword [esp + 0x10]
mov byte [ecx], al
mov byte [edi], 2
jmp 0x6d7be210
movzx eax, byte [esi + 1]
mov al, byte [eax + esi]
mov ecx, dword [esp + 0x10]
mov byte [ecx], al
inc byte [esi + 1]
dec byte [esi]
xor eax, eax
inc eax
pop edi
pop ebx
ret
Function at 0x6d7c335e
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x6d7c338c
push esi
call fcn.6d7c7b5a
cmp dword [esi + 0x40], 0
pop ecx
je 0x6d7c3385
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x6d7c33fc
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x6d7c33ee
mov eax, dword [esi + 8]
test eax, eax
je 0x6d7c33ad
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x6d7c33ea
cmp eax, 2
je 0x6d7c33ee
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x6d7c33a2
cmp eax, 3
je 0x6d7c33d1
cmp eax, 1
jne 0x6d7c33a2
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x6d7c33a2
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x6d7c33a2
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x6d7c341a
cmp eax, 0xcc
je 0x6d7c341a
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.6d7c3229
pop esi
ret

Function at 0x6d7cd236
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d7d7070]
jne 0x6d7cd240
repz ret
jmp fcn.6d7cd70c
Function at 0x1008450
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1002c50
call fcn.01004858
xor esi, esi
cmp dword [0x1009d48], esi
jne 0x1008494
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100847f
mov dword [0x1009d48], edi
jmp 0x1008494
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1008494
mov dword [0x1009d48], 2
mov eax, dword [0x1009d48]
cmp eax, 2
je 0x1008575
cmp eax, esi
je 0x1008575
cmp eax, 1
jne 0x10084d9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x10084c2
mov eax, dword [0x1009c2c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x10084e0
xor eax, eax
jmp 0x1008587
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.010048b0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x1008516
cmp edi, esi
jne 0x1008531
lea eax, [ebx + ebx]
push eax
call fcn.010058fe
pop ecx
mov edi, eax
cmp edi, esi
je 0x10084d9
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1008564
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x100854e
push esi
push esi
jmp 0x1008554
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1008570
push edi
call fcn.01005543
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x1008587
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.01004891
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x63d41feb
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, eax
sub esp, 0x4c
mov eax, dword [0x63d4b004]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov edx, eax
jne 0x63d4205e
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
sub esp, 0x10
test eax, eax
jne 0x63d42044
xor eax, eax
jmp 0x63d420df
mov dword [esp + 4], eax
mov dword [ebp - 0x44], eax
mov eax, dword [0x63d4b004]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [ebp - 0x44]
push eax
push eax
lea ebx, [ebp - 0x2c]
xor eax, eax
mov ecx, 5
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, esi
call fcn.63d41f94
test eax, eax
jne 0x63d420da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x63d4203d
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], 1
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
sub esp, 0x10
test eax, eax
je 0x63d4203d
cmp dword [ebp + 0x10], 0
je 0x63d420da
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp + 0x10]
mov dword [edi], eax
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x63d4355b
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
test byte [ebp + 0x76180844], 0x23

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4078f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4078ff
pop dword [ebp - 8]
mov eax, 0xaa95b720
sub eax, 0xaa553e21
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x68c58c95
sub dword [ebp - 0x18], 0x1a73474a
mov dword [ebp - 0x14], 0xf6f1b1fb
add dword [ebp - 0x14], 0x3b419a4a
mov dword [ebp - 0x10], 0xebd9ef3c
add dword [ebp - 0x10], 0x607254f2
mov dword [ebp - 0xc], 0x9330c409
sub dword [ebp - 0xc], 0x9330c409
lea eax, [ebp - 0x18]
push eax
mov eax, 0x64f402f4
add eax, 0x9b4e2d80
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x1ac10db2
sub dword [ebp - 0x18], 0xa64ea45c
mov dword [ebp - 0x14], 0xe99a78a5
add dword [ebp - 0x14], 0x57d1e8d0
mov dword [ebp - 0x10], 0x4321ee46
sub dword [ebp - 0x10], 0xdfb281da
mov dword [ebp - 0xc], 0x47cfb1bd
sub dword [ebp - 0xc], 0x47cfb1bd
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3b8f6
push 0
call eax
mov ecx, 0x3f80
mov edi, eax
mov ebx, 0xe8089ad8
sub ebx, 0xe7c556d8
add ebx, dword [ebp - 8]
mov esi, 0x668672f4
add esi, 0xa36048d7
xor dword [ebp - 4], eax
mov edx, dword [ebx]
add edx, esi
mov dword [ebp - 4], 0xa8ee7293
mov dword [edi], edx
sub dword [ebp - 4], ebx
add edi, 4
add ebx, 4
loop 0x407a16
add eax, 0xf0d3
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c