joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012cae
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov edi, esi
mov dword [ecx], esi
mov ebp, esi
mov dword [esp + 0xc], esi
cmp ebx, dword [0x100433f0]
jne 0x10012ce7
mov ebp, dword [0x10043eb0]
jmp 0x10012d24
cmp ebx, 0x800
je 0x10012d24
push 6
lea eax, [esp + 0x1c]
push eax
push 0x1004
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x10012d14
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.msvcr100.dll_atoi]
pop ecx
mov ebp, eax
mov eax, dword [esp + 0x10]
mov dword [0x10043eb0], ebp
mov dword [0x100433f0], ebx
push ebp
lea edx, [esp + 0x10]
mov ecx, eax
call fcn.1000477c
test eax, eax
jns 0x10012d3f
push eax
call fcn.1000d7f1
jmp 0x10012dde
mov eax, dword [esp + 0xc]
mov ecx, esi
test eax, eax
je 0x10012d4c
mov ecx, dword [eax - 4]
push esi
push esi
push ecx
push eax
push dword [esp + 0x38]
push ebx
call dword [sym.imp.kernel32.dll_LCMapStringA]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x10012d72
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10012ddc
cmp dword [eax - 4], esi
je 0x10012dc4
jmp 0x10012da7
push eax
push esi
call dword [sym.imp.oleaut32.dll_DllRegisterServer]
mov edi, eax
test edi, edi
jne 0x10012d84
push 0xe
jmp 0x10012da9
mov eax, dword [esp + 0xc]
mov ecx, esi
test eax, eax
je 0x10012d91
mov ecx, dword [eax - 4]
push dword [esp + 0x10]
push edi
push ecx
push eax
push dword [esp + 0x38]
push ebx
call dword [sym.imp.kernel32.dll_LCMapStringA]
test eax, eax
jne 0x10012dac
push 5
pop esi
jmp 0x10012dc4
mov edx, dword [esp + 0x14]
push ebp
mov ecx, edi
call fcn.10004713
test eax, eax
jns 0x10012dc4
push eax
call fcn.1000d7f1
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10012dd2
push eax
call sub.oleaut32.dll_SysStringLen
test edi, edi
je 0x10012ddc
push edi
call sub.oleaut32.dll_SysStringLen
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10029dae
add esp, 0x18
ret 8
Function at 0x10016940
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.msvcr100.dll__read]
add esp, 0xc
ret 0xc

Function at 0x10017236
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100436e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 2
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.1000b93e
push 2
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.1000b93e
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcr100.dll_rename]
pop ecx
pop ecx
pop esi
test eax, eax
je 0x100172bb
call dword [sym.imp.msvcr100.dll__errno]
mov eax, dword [eax]
dec eax
dec eax
je 0x100172b2
sub eax, 0xb
je 0x100172ae
sub eax, 4
je 0x100172aa
dec eax
je 0x100172a6
push 5
jmp 0x100172b4
push 0x4a
jmp 0x100172b4
push 0x3a
jmp 0x100172b4
push 0x4b
jmp 0x100172b4
push 0x35
pop eax
push eax
call fcn.1000c0de
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029dae
leave
ret 8
Function at 0x1001742e
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x100436e0]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
xor ecx, ecx
push edi
mov word [ebp - 0x80], cx
lea ecx, [ebp - 0x80]
push ecx
push eax
call fcn.10010227
mov esi, eax
cmp word [esi], 1
jne 0x10017471
push 0x5e
call fcn.1000c0de
movzx ecx, word [esi]
cmp ecx, 8
je 0x100174a4
mov eax, ecx
test eax, eax
js 0x10017489
cmp eax, 0xe
jle 0x1001749d
cmp eax, 0x11
je 0x1001749d
test ecx, 0x2000
jne 0x1001749d
cmp ecx, 0x24
je 0x1001749d
push 0x1ca
jmp 0x1001749f
push 0xd
call fcn.1000c0de
push dword [esi + 8]
lea eax, [ebp + 0xbc]
push eax
call fcn.10016883
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xbc]
push eax
call dword [sym.imp.msvcr100.dll__findfirst64i32]
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x100174d4
push 0x35
call fcn.1000c0de
mov edi, dword [sym.imp.msvcr100.dll__findclose]
jmp 0x100174f8
lea eax, [ebp - 0x6c]
push eax
push esi
call dword [sym.imp.msvcr100.dll__findnext64i32]
pop ecx
pop ecx
test eax, eax
je 0x100174f8
push esi
call edi
pop ecx
push 0x35
call fcn.1000c0de
test byte [ebp - 0x6c], 0x16
jne 0x100174dc
lea eax, [ebp + 0xbc]
push 0x5c
push eax
call dword [sym.imp.msvcr100.dll__mbsrchr]
pop ecx
lea ebx, [eax + 1]
pop ecx
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017517
sub ecx, edx
jne 0x1001752d
push esi
call edi
pop ecx
push 0x35
call fcn.1000c0de
test byte [ebp - 0x6c], 0x16
jne 0x100175b7
lea ecx, [ebp - 0x48]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001753d
sub ecx, edx
lea eax, [ecx + ebx]
lea ecx, [ebp + 0x1c0]
cmp eax, ecx
jbe 0x1001755e
push esi
call edi
pop ecx
push 0x35
call fcn.1000c0de
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1c1]
sub eax, ebx
push eax
push ebx
call dword [sym.imp.msvcr100.dll_strcpy_s]
add esp, 0xc
push 7
lea eax, [ebp + 0xbc]
push eax
call fcn.100150ff
test eax, eax
je 0x10017592
push esi
call edi
pop ecx
push 0x37
call fcn.1000c0de
lea eax, [ebp + 0xbc]
push eax
call dword [sym.imp.msvcr100.dll_remove]
pop ecx
test eax, eax
je 0x100175b7
push esi
call edi
pop ecx
call fcn.100152e5
test eax, eax
je 0x100175b7
push eax
call fcn.1000c0de
lea eax, [ebp - 0x6c]
push eax
push esi
call dword [sym.imp.msvcr100.dll__findnext64i32]
pop ecx
pop ecx
test eax, eax
je 0x1001752d
push esi
call edi
pop ecx
mov ecx, 0x10043888
call sym.EXPSRV.dll___vbaFreeVar
mov ecx, dword [ebp + 0x1c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029dae
add ebp, 0x1c8
leave
ret 4
Function at 0x10017979
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100436e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x35
pop edi
test esi, esi
je 0x100179b4
cmp word [esi], 0
je 0x100179b4
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100179a3
sub ecx, edx
cmp ecx, 0x104
jbe 0x100179ba
push edi
call fcn.1000c0de
push 1
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.1000b93e
mov esi, dword [ebp + 0xc]
mov eax, esi
or eax, 0x27
cmp eax, 0x27
je 0x100179dd
push 5
call fcn.1000c0de
test esi, esi
jne 0x100179e6
mov esi, 0x80
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x10017a29
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
cmp eax, 5
je 0x10017a19
call esi
cmp eax, edi
je 0x10017a19
call esi
cmp eax, 0x57
je 0x10017a19
call esi
cmp eax, 0x13
jne 0x10017a1c
push 0x4b
pop edi
movzx eax, di
test eax, eax
je 0x10017a29
push eax
call fcn.1000c0de
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10029dae
leave
ret 8
Function at 0x1001d8c4
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [esp + 0x24]
push esi
push eax
call sub.msvcr100.dll_memset
mov eax, dword [esp + 0x78]
add esp, 0xc
mov dword [esp + 0x20], edi
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], ax
cmp ax, 9
jbe 0x1001d8ff
push 5
call fcn.1000c0de
mov eax, dword [esp + 0x68]
push ebx
push ebp
test eax, eax
je 0x1001d91e
cmp word [eax], 8
jne 0x1001d91e
cmp dword [eax + 8], esi
jne 0x1001d91e
push esi
push esi
call dword [sym.imp.oleaut32.dll_SysReAllocStringLen]
jmp 0x1001d924
push eax
call fcn.1000b93e
mov ebx, eax
test ebx, ebx
jne 0x1001d931
push 5
call fcn.1000c0de
cmp dword [0x10043820], esi
je 0x1001d9af
test ebx, ebx
jne 0x1001d941
mov eax, esi
jmp 0x1001d946
mov eax, dword [ebx - 4]
shr eax, 1
push esi
push esi
push esi
push esi
inc eax
push eax
push ebx
push esi
push esi
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x1001d967
push ebp
call fcn.10008870
mov edi, eax
test edi, edi
jne 0x1001d971
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x1001d9c9
test ebx, ebx
jne 0x1001d979
mov eax, esi
jmp 0x1001d97e
mov eax, dword [ebx - 4]
shr eax, 1
push esi
push esi
push ebp
push edi
inc eax
push eax
push ebx
push esi
push esi
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.kernel32.dll_CreateProcessA]
push edi
mov esi, eax
call fcn.100088c0
jmp 0x1001d9c9
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
mov edi, eax
call dword [sym.imp.oleaut32.dll_SysStringLen]
pop ebp
pop ebx
test esi, esi
jne 0x1001da0d
dec edi
dec edi
je 0x1001d9f1
dec edi
je 0x1001d9f8
sub edi, 5
je 0x1001d9ff
sub edi, 6
je 0x1001d9ff
jmp 0x1001da06
push 0x35
call fcn.1000c0de
push 0x4c
call fcn.1000c0de
push 7
call fcn.1000c0de
push 5
call fcn.1000c0de
push 0x2710
push dword [esp + 0x14]
call dword [sym.imp.user32.dll_WaitForInputIdle]
push dword [esp + 0x14]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
fild dword [esp + 0x18]
pop edi
pop esi
fstp qword [esp]
fld qword [esp]
add esp, 0x5c
ret 8
Function at 0x1001dbc4
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x100], eax
test ecx, ecx
je 0x1001dd3f
mov eax, dword [ecx - 4]
shr eax, 1
push eax
push ecx
call fcn.1001dd54
mov eax, dword [0x10043ef0]
test eax, eax
je 0x1001dd3f
push ebx
push eax
call fcn.1001e3a3
xor ebx, ebx
cmp dword [0x10043ec4], ebx
jne 0x1001dd1b
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
mov al, byte [esp + 0xa1]
mov dl, byte [esp + 0x24]
mov cl, byte [esp + 0xa0]
mov byte [0x10043eea], al
mov ax, word [0x10043a18]
mov ebp, 0x3ff
and ax, bp
push 0x11
pop ebp
mov byte [0x10043ee8], dl
mov byte [0x10043ee9], cl
cmp ax, bp
jne 0x1001dc5e
mov al, byte [esp + 0x25]
mov byte [0x10043eeb], al
cmp dword [0x10043820], ebx
jne 0x1001dcea
mov esi, dword [sym.imp.user32.dll_keybd_event]
push 2
pop ebp
test dl, dl
je 0x1001dc8b
push ebx
push ebx
push ebx
push 0x14
call esi
push ebx
push ebp
push ebx
push 0x14
call esi
mov cl, byte [0x10043ee9]
test cl, cl
je 0x1001dca0
push ebx
push ebx
push ebx
mov edi, 0x90
push edi
call esi
push ebx
push ebp
push ebx
push edi
call esi
cmp byte [0x10043eea], bl
je 0x1001dcb9
push ebx
push ebx
push ebx
mov edi, 0x91
push edi
call esi
push ebx
push ebp
push ebx
push edi
call esi
mov ax, word [0x10043a18]
mov edi, 0x3ff
push 0x11
and ax, di
pop ecx
cmp ax, cx
jne 0x1001dce5
cmp byte [0x10043eeb], bl
je 0x1001dce5
push ebx
push ebx
push ebx
push 0x15
call esi
push ebx
push ebp
push ebx
push 0x15
call esi
push 0x11
pop ebp
jmp 0x1001dcef
mov edi, 0x3ff
mov ax, word [0x10043a18]
and ax, di
pop edi
pop esi
cmp ax, bp
mov byte [esp + 0x1c], bl
mov word [esp + 0x98], bx
pop ebp
jne 0x1001dd10
mov byte [esp + 0x19], bl
lea eax, [esp + 4]
push eax
call dword [sym.imp.user32.dll_SetKeyboardState]
call fcn.1001e696
test eax, eax
jne 0x1001dd29
call fcn.1001e9da
mov eax, dword [0x10043ef0]
test eax, eax
je 0x1001dd3e
push eax
call fcn.100088c0
mov dword [0x10043ef0], ebx
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.10029dae
add esp, 0x104
ret
Function at 0x1001e9da
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x278
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
push 1
call dword [0x10043ebc]
mov edi, dword [0x10043edc]
mov ebp, dword [sym.imp.user32.dll_GetKeyboardState]
sub edi, dword [0x10043ed8]
mov esi, eax
lea eax, [esp + 0x84]
push eax
mov dword [esp + 0x14], esi
call ebp
xor eax, eax
inc eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x68], eax
xor eax, eax
xor edx, edx
mov word [esp + 0x6c], ax
mov eax, dword [0x10043ed8]
mov ebx, edx
mov dword [esp + 0x70], 6
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x78], edx
mov dword [esp + 0x74], edx
cmp eax, dword [0x10043edc]
jge 0x1001eaf5
mov ecx, eax
shl ecx, 4
add ecx, dword [0x10043ed0]
inc eax
mov dword [esp + 0x54], edx
cmp dword [ecx], 0x102
mov dword [0x10043ed8], eax
jne 0x1001ea9e
xor esi, esi
inc esi
xor eax, eax
mov word [esp + 0x50], ax
mov ax, word [ecx + 4]
mov word [esp + 0x52], ax
mov dword [esp + 0x54], 4
mov ax, word [ecx + 4]
mov word [esp + 0x6e], ax
jmp 0x1001eac8
xor eax, eax
mov word [esp + 0x52], ax
cmp dword [ecx], 0x101
mov esi, edx
je 0x1001eab7
cmp dword [ecx], 0x105
jne 0x1001eabf
mov dword [esp + 0x54], 2
mov ax, word [ecx + 4]
mov word [esp + 0x50], ax
push 0x1c
lea eax, [esp + 0x50]
push eax
lea eax, [esi + 1]
push eax
call dword [0x10043eb8]
sub eax, esi
add ebx, eax
mov eax, dword [0x10043ed8]
push 0
pop edx
cmp eax, dword [0x10043edc]
jl 0x1001ea5b
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x184]
push eax
call ebp
push 0x34
xor ebp, ebp
lea eax, [esp + 0x1c]
push ebp
push eax
call sub.msvcr100.dll_memset
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], eax
mov al, byte [esp + 0xa4]
add esp, 0xc
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x38], 2
cmp al, byte [esp + 0x198]
je 0x1001eb54
push 0x14
pop eax
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10043eb8]
mov al, byte [esp + 0x114]
cmp al, byte [esp + 0x214]
je 0x1001eb82
mov eax, 0x90
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10043eb8]
mov al, byte [esp + 0x115]
cmp al, byte [esp + 0x215]
je 0x1001ebb0
mov eax, 0x91
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10043eb8]
mov ax, word [0x10043a18]
mov ecx, 0x3ff
and ax, cx
push 0x11
pop ecx
cmp ax, cx
jne 0x1001ebf2
mov al, byte [esp + 0x99]
cmp al, byte [esp + 0x199]
je 0x1001ebf2
push 0x15
pop eax
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10043eb8]
mov dword [0x10043ec8], 1
mov dword [0x10043ed8], ebp
mov dword [0x10043edc], ebp
mov dword [0x10043ec4], ebp
test esi, esi
je 0x1001ec19
push ebp
call dword [0x10043ebc]
cmp ebx, edi
pop edi
pop esi
pop ebp
pop ebx
je 0x1001ec2e
call dword [sym.imp.kernel32.dll_GetLastError]
push 0x11
call fcn.1000c0de
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.10029dae
add esp, 0x278
ret
Function at 0x10023608
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x1a8], eax
mov eax, dword [esp + 0x1b4]
push ebp
mov ebp, dword [esp + 0x1b4]
lea ecx, [esp + 4]
push ecx
push eax
push ebp
mov dword [esp + 0x24], eax
call fcn.1000b93e
test eax, eax
je 0x10023647
push 5
pop eax
jmp 0x1002373e
push ebx
push esi
push edi
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x18]
push eax
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
push eax
push eax
push eax
xor edi, edi
push edi
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0xdc]
push eax
push dword [esp + 0x3c]
mov dword [esp + 0x50], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [esp + 0x18]
push 1
push edi
mov esi, eax
lea eax, [esp + 0x44]
push eax
lea ecx, [ecx*2 + 2]
push ecx
push edi
push 0x78
lea ecx, [esp + 0x40]
call fcn.1000b93e
mov ebx, dword [esp + 0x2c]
test esi, esi
jne 0x10023718
test ebx, ebx
jne 0x100236c4
push 7
jmp 0x1002371a
push ebx
push dword [esp + 0x14]
call fcn.1000a463
test eax, eax
jne 0x10023718
mov eax, dword [esp + 0x18]
push edi
push edi
push edi
inc eax
push edi
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push ebx
push edi
push dword [esp + 0x2c]
call fcn.1000a5df
test eax, eax
je 0x100236b6
cmp eax, 0x103
jne 0x10023718
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10023708
lea ecx, [esp + 0x28]
call fcn.100089b8
push 5
pop eax
jmp 0x1002373b
push dword [esp + 0x24]
push ebp
call fcn.1000b93e
test eax, eax
je 0x10023730
jmp 0x1002372d
push 5
pop edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10023730
test edi, edi
jne 0x10023730
push 5
pop edi
lea ecx, [esp + 0x28]
call fcn.100089b8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1ac]
pop ebp
xor ecx, esp
call fcn.10029dae
add esp, 0x1ac
ret 8

Function at 0x10029dae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100436e0]
jne 0x10029db8
repz ret
jmp fcn.1002a2cf
Function at 0x401060
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, ebx
mov esi, ebx
mov ebx, eax
xor eax, ebx
mov esi, eax
xor eax, ebx
mov ebx, esi
xor eax, esi
mov esi, ebx
dec edi
or edx, 0x88
inc eax
inc eax
add esi, 0x2d
rcr ebx, 0x87
or esi, 0xa7
inc esi
sub ebx, 0x4e
and edx, 0xea
not eax
or eax, 0x7b
bswap edi
add esi, 0xf8
or ebx, 0x4c
inc ebx
mov edx, 0xb2
sbb ebx, 3
sbb esi, 0xb4
imul esi
bswap esi
neg esi
or edx, 0x5f
sbb esi, 0x91
rol edx, 5
add edx, 0xb9
mov edx, 0x5d
not edx
rol eax, 3
mov esi, 0xaa
bswap esi
not ebx
mov ebx, 0xd0
neg edi
inc esi
inc edx
dec edi
or esi, 0x7f
not ebx
sbb ebx, 0x4c
rcl edx, 0x82
neg edx
rcl edi, 0x90
mov ebx, 0x5d
not ebx
dec esi
add edx, 0x67
rcr ebx, 0xfd
rol edx, 0x94
mov esi, 0x73
xor ecx, ecx
xor edi, edi
mov eax, eax
mov esi, ebx
xor ebx, ebx
xor ebx, esi
mov esi, esi
mov esi, eax
not edi
sbb edi, 0x1c
rcl ebx, 0x74
ror esi, 0xcd
ror ebx, 0xc5
rcr edx, 0xa2
neg eax
rcl esi, 0xf1
bswap edi
bswap esi
and eax, 0x4b
dec edi
inc esi
sbb esi, 0xde
sub eax, 0xec
rcl ebx, 0xde
imul eax
dec edi
or eax, 0xdc
bswap edi
sbb edi, 0xb6
or edx, 0x28
bswap eax
ror eax, 0xed
sbb eax, 0x40
dec eax
add edx, 0xd8
or eax, 0x52
imul edi
add esi, 0x2e
and edi, 0x3f
and esi, 0x26
dec esi
bswap edx
or edx, 0x6a
add eax, 0xe3
rcr ebx, 0x38
sbb esi, 0xa3
mov edi, 0x19
dec esi
dec edi
sbb ebx, 0xd9
inc eax
imul esi
inc edi
dec ebx
rcl eax, 0x2a
rol eax, 0xde
neg eax
add esi, 0xc0
mov eax, esi
xor esi, eax
xor eax, esi
mov esi, ebx
xor eax, ebx
mov eax, ebx
xor eax, esi
mov ebx, eax
xor eax, ebx
mov ecx, dword [ebp + 0xc]
bswap ebx
mov edi, 0x5c
bswap edx
imul edi
imul edx
sub edi, 0xbe
inc edi
rcl esi, 0x74
neg edx
inc edi
not ebx
imul edx
or esi, 0xb9
imul eax
bswap edx
inc edi
and eax, 0x29
imul esi
and esi, 0x5e
imul eax
and ebx, 0xbe
bswap eax
or edi, 0x8d
mov ebx, 3
not edi
mov edi, 0xa5
not esi
neg esi
neg eax
ror ebx, 0xe4
or edi, 0x94
sub edx, 0xc2
not edi
neg eax
dec esi
mov edi, 0x45
sbb edi, 0x9d
add edx, 0x2a
bswap esi
bswap edx
neg eax
rcl esi, 0xed
rol esi, 0x61
ror esi, 0xc2
add esi, 0xa3
or ebx, 0xa4
dec eax
ror esi, 0x11
sbb esi, 0xa8
sub edi, 0x1b
mov edi, dword [ebp + 8]
mov eax, esi
mov ebx, esi
xor eax, ebx
mov ebx, esi
mov esi, esi
xor eax, eax
mov ebx, eax
xor eax, esi
mov eax, eax
not byte [edi]
xor esi, esi
xor eax, esi
mov eax, ebx
xor esi, esi
mov esi, ebx
xor eax, ebx
xor ebx, ebx
xor esi, eax
mov esi, esi
mov eax, eax
mov esi, esi
xor ebx, ebx
add byte [edi], 0xff
sub byte [edi], 0x4a
xor eax, esi
mov eax, eax
mov eax, esi
mov eax, ebx
xor esi, ebx
mov ebx, esi
xor eax, eax
mov ebx, eax
xor eax, eax
imul byte [edi]
inc edi
loop 0x401273
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4041d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40420f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40420f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40420f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40420f
cmp dword [ecx + 0x74], 0xe
jbe 0x40420f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409d63
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x409e00
push ebx
push esi
call fcn.00409d2c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409cc0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x409dad
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409dff
push edi
push eax
call fcn.0040a980
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x409dcd
call fcn.00408821
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409dfe
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409cc0
add esp, 0x20
test eax, eax
jne 0x409dec
push edi
call fcn.00408821
jmp 0x409df4
push ebx
call fcn.00408821
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b0fd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b040
push 0x41b038
push str.FlsAlloc
push 0x1f
call fcn.0040afbc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b131
push dword [ebp + 8]
mov ecx, esi
call dword [0x413154]
call esi
jmp 0x40b137
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b17b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b050
push 0x41b048
push str.FlsGetValue
push 0x21
call fcn.0040afbc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b1b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x413154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b1ba
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b058
push 0x41b050
push str.FlsSetValue
push 0x22
call fcn.0040afbc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b1f4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x413154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410650
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41067d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41067d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret