joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov esi, dword [esp + 0xdc]
mov edi, dword [esp + 0xe0]
lea eax, [esp + 4]
push dword [esp + 0xd8]
push dword [esp + 0xd8]
push eax
call fcn.0040c550
add esp, 0xc
lea eax, [esp + 0xa0]
push edi
push esi
push eax
call fcn.0040c550
add esp, 0xc
lea ebp, [esp + 0x49]
lea esi, [esp + 0x60]
nop dword [eax]
movzx edx, byte [esp + 0xc]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edi, esi
cmp dl, 6
je 0x40c105
lea esi, [esp + 4]
mov ebx, dword [esi + 0x18]
movsd xmm0, qword [esi + 9]
movsd xmm1, qword [esi + 0x11]
mov dword [esp + 0x6f], ebx
movsd qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm0
mov dword [esp + 0x40], eax
movzx ebx, byte [esp + 0x20]
movsd xmm1, qword [esp + 0x68]
mov eax, dword [esp + 0x6f]
movzx esi, word [esp + 0x21]
movsd xmm0, qword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov byte [esp + 0x48], dl
movsd qword [ebp + 8], xmm1
mov dword [ebp + 0xf], eax
lea eax, [esp + 0x40]
test bl, bl
movsd qword [ebp], xmm0
setne byte [esp + 0x5c]
mov word [esp + 0x5d], si
push eax
mov esi, edi
push edi
call fcn.0040b4f0
add esp, 8
lea eax, [esp + 0xa0]
push eax
lea edi, [esp + 0x84]
push edi
call fcn.0040b4f0
add esp, 8
mov ecx, dword [esp + 0x80]
cmp dword [esp + 0x60], 5
je 0x40c1c5
cmp ecx, 5
je 0x40c1cc
mov ecx, esi
mov edx, edi
call fcn.00411020
test al, al
je 0x40c215
movsd xmm1, qword [esp + 0x48]
movsd xmm0, qword [esp + 0x40]
movsd xmm2, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm1
movsd xmm1, qword [esp + 0x58]
movsd qword [esp + 4], xmm0
movsd qword [esp + 0x14], xmm2
movsd qword [esp + 0x1c], xmm1
jmp 0x40c0d0
mov al, 2
cmp ecx, 5
jne 0x40c20d
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
movsd xmm0, qword [esp + 0x14]
movsd xmm1, qword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx eax, word [ecx + 0x1d]
movsd qword [esp + 0x34], xmm0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x2c], xmm1
mov word [esp], ax
mov al, byte [ecx + 0x1f]
movsd qword [esp + 0x24], xmm0
mov byte [esp + 2], al
mov eax, ebx
cmp al, 2
jne 0x40c21b
xor eax, eax
jmp 0x40c265
mov al, 2
cmp al, 2
je 0x40c211
mov ecx, dword [esp + 0x3c]
movsd xmm0, qword [esp + 0x34]
movsd xmm2, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x2c]
mov dword [esp + 0x78], ecx
movsd qword [esp + 0x70], xmm0
movsd qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm2
mov byte [esp + 0x7c], al
movzx eax, word [esp]
mov word [esp + 0x7d], ax
mov al, byte [esp + 2]
mov byte [esp + 0x7f], al
push esi
call fcn.0040af00
add esp, 4
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov dword [esi + 0x8c], esp
mov dword [esi + 0x98], 0xffffffff
mov dword [esi + 0x94], 0x417350
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x90]
mov edi, dword fs:[0]
mov dword [esi + 0x90], edi
lea edi, [esi + 0x14]
mov dword fs:[0], ecx
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov word [esi + 0x34], 0
mov dword [esi + 0x24], 7
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x18], 1
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0x2000000
lea ecx, [esi + 8]
push edi
push eax
call fcn.004115c0
add esp, 8
mov edx, dword [esi + 0xc]
cmp dword [esi + 8], 1
jne 0x40ca43
mov eax, dword [esi + 0x10]
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], eax
jmp 0x40ca66
lea ecx, [esi + 0x38]
mov dword [esi + 0x98], 0
mov dword [esi + 4], edx
call fcn.00411790
push dword [esi + 4]
call sub.KERNEL32.dll_CloseHandle
cmp dword [esi + 0x38], 1
jne 0x40cab3
cmp byte [esi + 0x3c], 3
jne 0x40caaf
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ecx + 4]
mov dword [esi + 0x98], 1
push eax
call dword [ecx]
add esp, 4
mov edi, dword [esi + 4]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40caa2
push dword [eax + 8]
push ecx
push dword [edi]
call fcn.004036f0
add esp, 0xc
push 4
push 0xc
push edi
call fcn.004036f0
add esp, 0xc
xor ecx, ecx
jmp 0x40cad5
mov ecx, dword [esi + 0x58]
test ecx, 0x400
sete dl
test dword [esi + 0x74], 0x20000000
sete al
and ecx, 0x10
shr ecx, 4
or al, dl
and al, cl
mov cl, 1
mov edx, dword [esi + 0x90]
and al, cl
mov dword fs:[0], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e8b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x417400
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x42b0f8
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov dword [ebp - 0x20], 0x42b0f8
mov esi, dword [edi]
test esi, esi
jne 0x40e955
mov ebx, dword [edi + 4]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40e970
mov esi, eax
test ebx, ebx
je 0x40e94d
push 4
push 0xc
call fcn.004036e0
add esp, 8
test eax, eax
je 0x40e9c1
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x42b124]
nop word cs:[eax + eax]
nop dword [eax + eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x42b124], ecx
jne 0x40e940
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x40e98d
push dword [ebp - 0x20]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x426298
push 0x2e
push 0x426238
call fcn.00422f10
add esp, 0xc
jmp 0x40e9bf
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x4258d0
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], str._rustc_53cb7b09b00cbea8754ffb78e7e3cb521cb8af4blibrarycore_src_strpattern.rs
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
call fcn.0040eac0
ud2
push 4
push 0xc
call fcn.00422e00
add esp, 8
ud2
Function at 0x410f20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x42b024]
test eax, eax
je 0x410f3b
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x410f53
jmp 0x410f62
push 0x42b024
call fcn.0040e8b0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x410f62
cmp dword [eax], 1
mov edi, eax
jne 0x410f62
add edi, 4
jmp 0x411009
mov eax, dword [0x42b024]
test eax, eax
je 0x410f84
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x410f9b
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x411009
jmp 0x410fd7
push 0x42b024
call fcn.0040e8b0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x410f75
push 4
push 0xc
call fcn.004036e0
add esp, 8
test eax, eax
je 0x411011
mov dword [eax], 0
mov dword [eax + 8], 0x42b024
mov esi, eax
mov eax, dword [0x42b024]
test eax, eax
jne 0x410fd0
push 0x42b024
call fcn.0040e8b0
add esp, 4
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov eax, dword [esi + 4]
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
test ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], eax
je 0x411009
test eax, eax
je 0x411009
lock dec dword [eax]
jne 0x411009
lea ecx, [esp + 4]
call fcn.00407650
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 4
push 0xc
call fcn.00422e00
add esp, 8
ud2

Function at 0x4110e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0xc
mov eax, dword [0x42b02c]
test eax, eax
je 0x4110fb
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x411113
jmp 0x411122
push 0x42b02c
call fcn.0040e8b0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x411122
cmp dword [eax], 1
mov edi, eax
jne 0x411122
add edi, 4
jmp 0x4111da
mov eax, dword [0x42b02c]
test eax, eax
je 0x411144
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41115b
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x4111da
jmp 0x411197
push 0x42b02c
call fcn.0040e8b0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x411135
push 4
push 0x10
call fcn.004036e0
add esp, 8
test eax, eax
je 0x4111e2
mov dword [eax], 0
mov dword [eax + 0xc], 0x42b02c
mov esi, eax
mov eax, dword [0x42b02c]
test eax, eax
jne 0x411190
push 0x42b02c
call fcn.0040e8b0
add esp, 4
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [esi + 8]
lea edi, [esi + 4]
mov dword [esp + 8], eax
movsd xmm0, qword [esi]
movsd qword [esp], xmm0
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
cmp dword [esp], 0
je 0x4111da
mov eax, dword [esp + 8]
test eax, eax
je 0x4111da
lock dec dword [eax]
jne 0x4111da
lea ecx, [esp + 8]
call fcn.00407690
mov eax, edi
add esp, 0xc
pop esi
pop edi
ret
push 4
push 0x10
call fcn.00422e00
add esp, 8
ud2
Function at 0x4118b0
Capabilities:
Create directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, edx
mov edx, ecx
mov ecx, esp
push eax
call fcn.00415e70
add esp, 4
mov ebp, dword [esp + 8]
mov ebx, dword [esp + 4]
cmp dword [esp], 1
jne 0x4118e3
mov esi, ebx
mov eax, ebx
shrd esi, ebp, 8
shr ebp, 8
mov edi, ebp
jmp 0x411930
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x411909
test ebp, ebp
mov al, 4
je 0x411907
add ebp, ebp
je 0x411907
push 2
push ebp
push ebx
call fcn.004036f0
mov al, 4
add esp, 0xc
jmp 0x411930
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov edi, eax
xor eax, eax
shr edi, 8
shl esi, 0x18
test ebp, ebp
je 0x411930
add ebp, ebp
je 0x411930
push 2
push ebp
push ebx
call fcn.004036f0
add esp, 0xc
xor eax, eax
shld edi, esi, 8
shl esi, 8
movzx eax, al
or eax, esi
mov edx, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x411950
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x24]
mov ecx, esp
push dword [esp + 0x28]
call fcn.00415e70
add esp, 4
mov ebp, dword [esp + 8]
mov ebx, dword [esp + 4]
cmp dword [esp], 1
jne 0x411986
mov esi, ebx
mov eax, ebx
shrd esi, ebp, 8
shr ebp, 8
mov edi, ebp
jmp 0x4119d1
push ebx
call sub.KERNEL32.dll_DeleteFileW
test eax, eax
je 0x4119aa
test ebp, ebp
mov al, 4
je 0x4119a8
add ebp, ebp
je 0x4119a8
push 2
push ebp
push ebx
call fcn.004036f0
mov al, 4
add esp, 0xc
jmp 0x4119d1
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov edi, eax
xor eax, eax
shr edi, 8
shl esi, 0x18
test ebp, ebp
je 0x4119d1
add ebp, ebp
je 0x4119d1
push 2
push ebp
push ebx
call fcn.004036f0
add esp, 0xc
xor eax, eax
shld edi, esi, 8
shl esi, 8
movzx eax, al
or eax, esi
mov edx, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4123d0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4174f0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x34]
add ecx, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], 0
call fcn.004050f0
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jne 0x41243c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
push 1
call fcn.004228a0
add esp, 4
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x28]
mov word [ebx + edx*2], 0
push ebx
call sub.KERNEL32.dll_SetCurrentDirectoryW
test eax, eax
je 0x41245a
mov cl, 4
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x412472
jmp 0x412486
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov esi, eax
xor ecx, ecx
shr esi, 8
shl edi, 0x18
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x412486
add eax, eax
je 0x412486
push 2
push eax
push ebx
mov ebx, ecx
call fcn.004036f0
mov ecx, ebx
add esp, 0xc
mov edx, dword [ebp - 0x18]
shld esi, edi, 8
shl edi, 8
movzx eax, cl
or eax, edi
mov dword fs:[0], edx
mov edx, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4124f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx + 0x10], 0
mov edi, edx
jne 0x4125c8
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x41251c
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, eax
neg ecx
cmp ecx, 0xf
jbe 0x412595
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x4125b1
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi]
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x412554
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x41256c
jmp 0x412578
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x412578
cmp eax, 0x3e5
jne 0x412587
mov ecx, 1
xor eax, eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
mov byte [esi + 1], 1
jmp 0x41257c
mov byte [esi + 1], 0
xor eax, eax
mov byte [esi], al
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov al, 1
jmp 0x41257e
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.004229e0
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x412527
mov ecx, ebx
push 1
call fcn.004229e0
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x412527
add edi, 0x10
mov edx, esp
mov dword [esp], 0
mov ecx, edi
call fcn.004227e0
ud2
Function at 0x415900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x415914
test eax, eax
jne 0x415a2e
mov edi, dword [0x42b124]
test edi, edi
je 0x415a2e
xor ebx, ebx
jmp 0x415937
mov edi, dword [edi + 8]
test edi, edi
je 0x415959
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x415930
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x415930
test bl, 1
je 0x415a2e
mov edi, dword [0x42b124]
test edi, edi
je 0x415a2e
xor ebx, ebx
jmp 0x415987
mov edi, dword [edi + 8]
test edi, edi
je 0x4159a9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x415980
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x415980
test bl, 1
je 0x415a2e
mov edi, dword [0x42b124]
test edi, edi
je 0x415a2e
xor ebx, ebx
jmp 0x4159c7
mov edi, dword [edi + 8]
test edi, edi
je 0x4159e9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x4159c0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x4159c0
test bl, 1
je 0x415a2e
mov edi, dword [0x42b124]
test edi, edi
je 0x415a2e
xor ebx, ebx
jmp 0x415a07
mov edi, dword [edi + 8]
test edi, edi
je 0x415a29
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x415a00
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x415a00
test bl, 1
jne 0x415a39
mov al, byte [0x428180]
pop esi
pop edi
pop ebx
ret 0xc
mov edi, dword [0x42b124]
jmp 0x415a44
mov edi, dword [edi + 8]
test edi, edi
je 0x415a2e
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x415a41
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
jmp 0x415a41
Function at 0x416730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x42b038]
test eax, eax
je 0x416747
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x41675f
jmp 0x416766
push 0x42b038
call fcn.0040e8b0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x416766
cmp dword [eax], 1
mov esi, eax
je 0x4167e4
mov eax, dword [0x42b038]
test eax, eax
je 0x416784
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x41679b
xor esi, esi
cmp eax, 1
je 0x4167e7
mov esi, eax
jmp 0x4167d7
push 0x42b038
call fcn.0040e8b0
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x416779
push 4
push 0xc
call fcn.004036e0
add esp, 8
test eax, eax
je 0x4167eb
mov dword [eax], 0
mov dword [eax + 8], 0x42b038
mov esi, eax
mov eax, dword [0x42b038]
test eax, eax
jne 0x4167d0
push 0x42b038
call fcn.0040e8b0
add esp, 4
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
push 4
push 0xc
call fcn.00422e00
add esp, 8
ud2
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4010c3
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push ebp
xor edi, edi
push esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebp
cmp byte [esi + eax - 1], 0x5c
jne 0x4010ea
push esi
mov edi, 1
call ebp
mov byte [eax + esi - 1], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
dec eax
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
je 0x401103
push esi
call ebp
mov byte [eax + esi], 0x5c
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4013a8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov ecx, dword [0x407230]
mov esi, dword [esp + 0xc]
mov eax, esi
dec esi
test eax, eax
je 0x4013db
mov edx, dword [esp + 8]
mov al, byte [edx]
inc edx
xor al, cl
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x406e30]
xor eax, ecx
mov ecx, eax
mov eax, esi
dec esi
test eax, eax
jne 0x4013be
pop esi
mov dword [0x407230], ecx
ret

Function at 0x401969
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x401986
mov al, 1
jmp 0x4019be
push dword [ebp + 8]
push eax
push 8
call fcn.0040107b
push eax
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x12c]
push 0
push str.WinZip_Self_Extractor
push ecx
push dword [0x4074e0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4019c2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x401a6f
push 0x105
lea eax, [ebp - 0x108]
push eax
push 0x4068f8
push 0x4068f4
push 0x12
call fcn.0040107b
push eax
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
je 0x401a6f
cmp byte [ebp - 0x108], 0
lea esi, [ebp - 0x108]
je 0x401a1f
cmp byte [esi], 0x20
je 0x401a24
inc esi
cmp byte [esi], 0
jne 0x401a14
cmp byte [esi], 0x20
jne 0x401a27
mov byte [esi], 0
lea eax, [ebp - 0x108]
push eax
call fcn.004013e3
push eax
push 0x11
call fcn.0040107b
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401a6f
push 0x406b78
mov byte [esi], 0x20
push str.__s_
inc esi
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.00401969
add esp, 4
jmp 0x401a8c
push 0
push str.WinZip_Self_Extractor
push 0x15
call fcn.0040107b
push eax
push dword [0x4074e0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402e44
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
cmp dword [0x40736e], eax
ja 0x402e5a
mov dword [0x40734c], eax
jmp 0x402edd
mov esi, 0x800
cmp dword [0x40736e], esi
ja 0x402e6d
mov esi, dword [0x40736e]
push esi
mov eax, dword [0x407348]
push eax
push dword [0x4067cc]
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [0x40734c], eax
cmp eax, esi
je 0x402e8e
call fcn.0040186a
mov eax, dword [0x40734c]
mov ecx, dword [0x407348]
sub dword [0x40736e], eax
mov dword [0x40737c], ecx
cmp dword [0x4067d0], 0
je 0x402ed2
mov esi, ecx
lea edi, [eax - 1]
test eax, eax
je 0x402ed2
call fcn.004044a6
xor byte [esi], al
movzx eax, byte [esi]
push eax
inc esi
call fcn.004044bf
add esp, 4
mov eax, edi
dec edi
test eax, eax
jne 0x402eb7
mov eax, dword [0x40734c]
dec dword [0x40734c]
pop edi
pop esi
ret
Function at 0x4044bf
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov edx, 0xff
xor eax, dword [0x406e00]
mov ecx, dword [0x406e00]
shr ecx, 8
and eax, edx
mov eax, dword [eax*4 + 0x406e30]
xor eax, ecx
mov dword [0x406e00], eax
and eax, edx
add dword [0x406e04], eax
mov eax, dword [0x406e04]
imul eax, eax, 0x8088405
inc eax
mov ecx, dword [0x406e08]
shr ecx, 8
mov dword [0x406e04], eax
shr eax, 0x18
xor eax, dword [0x406e08]
and eax, edx
mov eax, dword [eax*4 + 0x406e30]
xor eax, ecx
mov dword [0x406e08], eax
ret

Function at 0x4045b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, dword [0x4067d8]
mov ebp, esp
sub esp, 0xc
push esi
push edi
push eax
call fcn.00404523
add esp, 4
lea ecx, [ebp - 0xc]
xor edi, edi
push 0xc
push dword [ebp + 8]
push ecx
call section..text
add esp, 0xc
lea esi, [ebp + edi - 0xc]
call fcn.004044a6
inc edi
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.004044bf
add esp, 4
cmp edi, 0xc
jl 0x4045dd
cmp dword [0x4067d4], 0
movzx cx, byte [ebp - 1]
je 0x40461e
mov ax, word [0x407366]
shr ax, 8
cmp ax, cx
je 0x404630
mov eax, 0xffffffff
jmp 0x404632
mov eax, dword [0x40736a]
shr eax, 0x18
cmp ax, cx
mov eax, 0xffffffff
jne 0x404632
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b651
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
or edx, ecx
call fcn.0043b681
add ecx, 0x9142dded
and ecx, edx
xor dword [eax], ebx
dec ecx
and edx, ecx
add eax, 1
inc ecx
cmp eax, edi
jne fcn.0043b651
dec ecx
and edx, ecx
ret