joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036180
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003627a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10036273
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10036259
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10036259
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10036259
mov edx, dword [esi]
test edx, edx
jne 0x10036222
push 0x200
push edx
push dword [0x100d3d40]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10036273
jmp 0x1003624d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1003624d
shl eax, 3
push eax
push edx
push 0
push dword [0x100d3d40]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10036273
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100361e1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100362bf
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100362bf
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100362b9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10036010
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10036286
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c6ff
mov esp, ebp
pop ebp
ret
Function at 0x100362d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x100d3f40]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10036331
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c6ff
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10036352
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10036373
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10036373
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1003636d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10036373
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1003c6ff
mov esp, ebp
pop ebp
ret
Function at 0x100363d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x100d3f48]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x100364c1
mov eax, dword [0x100d3f40]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10036415
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x100363f8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100364c1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10036180
mov ecx, dword [0x100d3f48]
add esp, 4
cmp esi, ecx
jae 0x10036475
imul edi, esi, 0x2c
mov eax, dword [0x100d3f40]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1003646a
mov edx, ebx
mov ecx, esi
call fcn.100362d0
mov dword [ebp - 4], eax
test eax, eax
jne 0x10036472
mov ecx, dword [0x100d3f48]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10036441
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100364c1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x100364b2
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100364a6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10036485
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x100d3d40]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036860
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, 1
mov ecx, 0x100d3d3c
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
je 0x100368b5
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp esi, 0x20
jae 0x10036899
push 0
jmp 0x1003689b
push 1
call ebx
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x100d3d3c
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10036890
mov ebx, dword [ebp - 4]
cmp dword [0x100d3d40], 0
je 0x10036988
test ebx, ebx
jne 0x100368d4
mov ecx, edi
call fcn.100363d0
mov edi, eax
jmp 0x1003698d
mov ecx, dword [0x100d3f48]
xor esi, esi
test ecx, ecx
je 0x100368f4
mov edx, dword [0x100d3f40]
mov eax, edx
cmp ebx, dword [eax]
je 0x100368fe
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x100368e8
mov edi, 4
jmp 0x1003698d
cmp esi, 0xffffffff
je 0x100368f4
imul eax, esi, 0x2c
movzx eax, byte [eax + edx + 0x14]
shr eax, 1
and eax, 1
cmp eax, edi
je 0x1003697f
push 1
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.10036180
add esp, 4
mov edx, edi
mov ecx, esi
call fcn.100362d0
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
test eax, eax
je 0x1003698d
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1003696e
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10036962
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10036941
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x100d3d40]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003698d
neg edi
sbb edi, edi
add edi, 6
jmp 0x1003698d
mov edi, 2
xor eax, eax
mov ecx, 0x100d3d3c
xchg dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1004600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x27
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100378f5
mov eax, dword [0x100d3e64]
xor edx, edx
sub eax, dword [0x100d3e60]
xor edi, edi
mov ebx, dword [0x100d3dd8]
xor esi, esi
sar eax, 2
add ebx, 0x61370c
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
test eax, eax
je 0x100377f4
push eax
lea ecx, [ebp - 0x10]
call fcn.100371f0
mov eax, dword [0x100d3e60]
mov esi, dword [0x100d3e64]
mov edi, dword [ebp - 0x10]
sub esi, eax
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [ebp - 0x10]
add esp, 0xc
sar esi, 2
lea edi, [edi + esi*4]
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
sub edi, edx
xor ecx, ecx
sar edi, 2
test edi, edi
je 0x1003780c
nop
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [ebx]
mov ebx, eax
cmp ecx, edi
jb 0x10037800
test edx, edx
je 0x1003783f
sub esi, edx
mov eax, edx
and esi, 0xfffffffc
cmp esi, 0x1000
jb 0x10037835
mov edx, dword [eax - 4]
add esi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10037835
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push esi
push edx
call fcn.1003c79d
add esp, 8
mov dword [ebx], 0xffff
xor edx, edx
mov eax, dword [0x100d3e94]
xor edi, edi
sub eax, dword [0x100d3e90]
xor esi, esi
mov ebx, dword [0x100d3dd8]
sar eax, 2
add ebx, 0x61370c
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
test eax, eax
je 0x100378a5
push eax
lea ecx, [ebp - 0x10]
call fcn.100371f0
mov eax, dword [0x100d3e90]
mov esi, dword [0x100d3e94]
mov edi, dword [ebp - 0x10]
sub esi, eax
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [ebp - 0x10]
add esp, 0xc
sar esi, 2
lea edi, [edi + esi*4]
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
sub edi, edx
xor ecx, ecx
sar edi, 2
test edi, edi
je 0x100378bc
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [ebx]
mov ebx, eax
cmp ecx, edi
jb 0x100378b0
test edx, edx
je 0x100378ef
sub esi, edx
mov eax, edx
and esi, 0xfffffffc
cmp esi, 0x1000
jb 0x100378e5
mov edx, dword [eax - 4]
add esi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100378e5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push esi
push edx
call fcn.1003c79d
add esp, 8
mov dword [ebx], 0xffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c6ff
mov esp, ebp
pop ebp
ret
Function at 0x10038600
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003dd15
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1004600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x38], edi
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
mov dword [ebp - 0x38], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x38], esi
cmp esi, 0xffffffff
jne 0x1003867d
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
jmp 0x100387c1
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], 0x100387e0
mov dword [ebp - 0x24], esi
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 8
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x1c], 0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100386f3
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
mov byte [edi], al
jmp 0x100387b6
mov esi, dword [ebp - 0x2c]
push esi
call fcn.1003cc60
push esi
push 0
push eax
mov dword [ebp - 0x3c], eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x3c]
add esp, 0x10
mov dword [ebp - 0x34], eax
push 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
push esi
mov esi, dword [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xorps xmm0, xmm0
test eax, eax
jne 0x1003875b
push dword [ebp - 0x3c]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
mov byte [edi], al
call fcn.1003cc5b
add esp, 4
jmp 0x100387b6
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x18]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
test ecx, ecx
jne 0x1003878d
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0xf
push eax
mov byte [edi], cl
call fcn.1003cc5b
add esp, 4
jmp 0x100387b6
lea edx, [ecx + eax]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x38], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038798
sub ecx, dword [ebp - 0x38]
push ecx
push edx
mov ecx, edi
call fcn.10037100
push dword [ebp - 0x3c]
call fcn.1003cc5b
add esp, 4
test esi, esi
je 0x100387c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c6ff
mov esp, ebp
pop ebp
ret
Function at 0x1003b700
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0xaaaaaaab
mov dword [ebp - 8], edx
mov ebx, ecx
push edi
push ecx
mov esi, dword [esi]
add esi, 2
mov dword [ebp - 0x14], ebx
mul esi
shr edx, 1
shl edx, 2
push edx
call fcn.1003c190
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x1003b736
mov edi, dword [ebx]
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp + 8], 3
xor esi, esi
mov ecx, dword [eax]
mov eax, ecx
div dword [ebp + 8]
mov eax, edx
sub ecx, eax
mov dword [ebp + 8], eax
mov dword [ebp - 4], ecx
je 0x1003b7ed
mov ecx, dword [ebp - 8]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
dec ecx
mul ecx
mov eax, edx
mov edx, dword [ebp - 0xc]
shr eax, 1
inc eax
mov ebx, eax
nop dword [eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 3]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x1003b780
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
test eax, eax
je 0x1003b86a
mov edx, dword [ebp - 8]
sub eax, 1
mov dword [ebp + 8], eax
movzx eax, byte [ecx + edx]
je 0x1003b80c
movzx edx, byte [ecx + edx + 1]
shl eax, 8
or edx, eax
jmp 0x1003b80e
mov edx, eax
mov eax, edx
mov ecx, edx
shr eax, 2
shr ecx, 0xa
cmp dword [ebp + 8], 0
cmove ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
je 0x1003b854
mov eax, edx
shr eax, 4
and eax, 0x3f
and edx, 0xf
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi + 1], al
mov al, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and edx, 3
shl edx, 4
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi + 1], al
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x76254996
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1a087b0d
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x409650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5131f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x580b30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x409691
xor eax, eax
jmp 0x40982a
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
xor eax, eax
cmp edx, eax
je 0x4096bf
mov ecx, dword [esi + 0x34]
mov ebx, dword [ecx]
lea ebx, [edx + ebx*2]
cmp edx, ebx
jae 0x4096bf
dec dword [ecx]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x40982a
cmp dword [esi + 0x54], eax
je 0x409825
mov edx, dword [esi + 0x10]
lea ebx, [esi + 0x48]
cmp dword [edx], ebx
jne 0x4096e8
mov ecx, dword [esi + 0x40]
mov ebx, dword [esi + 0x3c]
mov dword [edx], ebx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov edx, dword [esi + 0x30]
sub ecx, ecx
sar ecx, 1
mov dword [edx], ecx
cmp dword [esi + 0x44], eax
jne 0x409712
mov esi, dword [esi + 0x54]
push esi
push edi
call fcn.004d3c0a
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x40982a
mov eax, ecx
jmp 0x40982a
movzx edx, di
mov ecx, 0xf
mov dword [ebp - 0x30], edx
mov edx, eax
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x40973a
lea edx, [ebp - 0x2c]
mov byte [edx + 8], al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x409752
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push edx
push eax
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x2e]
push edx
mov edx, dword [edi + 0x14]
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call edx
test eax, eax
js 0x40981d
cmp eax, 1
jg 0x4097e5
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x409792
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, ecx
je 0x4097bb
cmp ebx, 0x10
jae 0x4097a1
lea eax, [ebp - 0x2c]
mov ecx, dword [esi + 0x54]
push ecx
push edi
push 1
push eax
call fcn.004d3a09
add esp, 0x10
cmp edi, eax
jne 0x40981d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
mov byte [esi + 0x4a], 1
cmp dword [ebp - 0x38], edx
jne 0x40980f
test edi, edi
jne 0x409746
cmp dword [ebp - 0x1c], 0x20
lea ecx, [ebp - 0x2c]
jae 0x409820
push edi
push 8
call fcn.00409a00
jmp 0x409740
cmp eax, 3
jne 0x40981d
mov eax, dword [esi + 0x54]
mov ecx, dword [ebp - 0x30]
call fcn.00409630
movzx esi, word [ebp + 8]
test al, al
jne 0x409802
mov esi, 0xffff
lea ecx, [ebp - 0x2c]
call fcn.00409f30
mov ax, si
jmp 0x40982a
lea ecx, [ebp - 0x2c]
call fcn.00409f30
mov ax, word [ebp + 8]
jmp 0x40982a
lea ecx, [ebp - 0x2c]
call fcn.00409f30
mov eax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d31b7
mov esp, ebp
pop ebp
ret 4
Function at 0x409ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x580b30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x409bdb
cmp byte [edi + 0x4a], bl
je 0x409bdb
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
mov ecx, edi
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x409bcf
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x409b2f
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x409b47
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
mov edx, dword [esi + 0x18]
push eax
lea eax, [edi + 0x4c]
push eax
call edx
sub eax, 0
je 0x409b70
dec eax
je 0x409b74
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x409bca
jmp 0x409bd6
mov byte [edi + 0x4a], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x409b84
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x409bad
cmp ebx, 0x10
jae 0x409b93
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004d3a09
add esp, 0x10
cmp esi, eax
jne 0x409bc7
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x409bd3
test esi, esi
jne 0x409b3b
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00409a00
jmp 0x409b35
lea ecx, [ebp - 0x2c]
call fcn.00409f30
xor al, al
jmp 0x409bdd
lea ecx, [ebp - 0x2c]
call fcn.00409f30
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d31b7
mov esp, ebp
pop ebp
ret

Function at 0x40b2a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b2e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 8], edi
call fcn.004be240
mov dword [esp + 0xc], eax
test edi, edi
je 0x40b2e0
lea eax, [esp + 8]
push eax
mov ecx, 0x533944
call fcn.0040b110
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret