joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110c4
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x1c
mov eax, 0x432fbb
call fcn.0042e724
push 0x438a10
push dword [ebp + 0xc]
call fcn.00401aa8
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
xor ebx, ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x411102
xor al, al
call fcn.0042e7fc
ret
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00411267
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x8003
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x411147
cmp dword [ebp - 0x14], ebx
je 0x41113a
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401053
jmp 0x4110fa
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
push ebx
push ecx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x41116d
cmp dword [ebp - 0x10], ebx
je 0x41112b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x41112b
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop eax
push ebx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
call esi
test eax, eax
je 0x41115d
push dword [ebp - 0x1c]
call fcn.0041b2b3
mov edi, eax
pop ecx
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x41115d
push ebx
lea eax, [ebp - 0x1c]
push eax
push edi
push 2
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x4111e5
push edi
call fcn.0041b196
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x4111c4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x14], ebx
je 0x4111d3
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401053
mov al, bl
jmp 0x4110fc
xor esi, esi
cmp dword [ebp - 0x1c], ebx
jbe 0x41123a
mov eax, dword [0x44970c]
mov ecx, 0x44970c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 1
movzx eax, byte [esi + eax]
push eax
push str._2.2x
lea eax, [ebp - 0x20]
call fcn.00401cd7
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
push dword [edi - 0xc]
push edi
call fcn.0041142b
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
call fcn.00401053
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x4111ec
push dword [ebp - 0x24]
call fcn.0041b196
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x411251
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x14], ebx
je 0x411260
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov bl, 1
jmp 0x4111d3
Function at 0x41175e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x43396c
call fcn.0042e724
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, dword [0x44970c]
mov ecx, 0x44970c
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
je 0x4117be
push 0x438a10
push dword [ebp + 8]
call fcn.00404084
lea eax, [ebx - 0x10]
call fcn.00401053
mov eax, dword [ebp + 8]
jmp 0x41184e
cmp dword [ebp - 0x18], 1
je 0x4117ca
cmp dword [ebp - 0x18], 2
jne 0x4117a1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041b18b
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x4117a1
push dword [ebp - 0x14]
push edi
push eax
call fcn.0041ca10
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push dword [ebp - 0x10]
test eax, eax
je 0x41181e
call fcn.0041a939
mov dword [esp], 0x438a10
jmp 0x4117a6
lea eax, [ebp - 0x1c]
push eax
call fcn.00401aa8
push dword [ebp - 0x10]
call fcn.0041a939
mov esi, dword [ebp - 0x1c]
add esi, 0xfffffff0
pop ecx
mov eax, esi
call fcn.0040482d
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.00401053
mov eax, edi
call fcn.0042e7fc
ret 0xc

Function at 0x411856
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x433949
call fcn.0042e724
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41191d
cmp dword [ebp - 0x14], 7
jne 0x41191d
mov edi, dword [ebp - 0x10]
shr edi, 1
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041b18b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41191d
push dword [ebp - 0x10]
push 0
push ebx
call fcn.0041ca10
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x411916
xor esi, esi
test edi, edi
jle 0x411916
lea eax, [ebx + esi*2]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00404084
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x4118ff
push eax
push dword [ebp + 0x10]
call fcn.00412fe4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
or dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lea esi, [esi + ecx + 1]
call fcn.00401053
cmp esi, edi
jl 0x4118d9
push ebx
call fcn.0041a939
pop ecx
call fcn.0042e7fc
ret 0xc
Function at 0x411fb6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
push edi
mov esi, eax
lea eax, [ebp - 0x10]
push 0x439fb8
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00413ad1
mov eax, dword [eax]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0xc
push edi
lea ecx, [ebp - 0xc]
push ecx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push SysReAllocString
call ebx
test eax, eax
mov eax, dword [ebp - 0x10]
setne byte [ebp - 1]
add eax, 0xfffffff0
call fcn.00401053
cmp byte [ebp - 1], 0
je 0x412017
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi]
push edi
lea ecx, [ebp - 8]
push ecx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push dword [ebp - 0xc]
call ebx
test eax, eax
je 0x412040
xor bl, bl
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x412012
push edi
lea eax, [ebp - 0x10]
push 0x438f14
push eax
call fcn.00413ad1
mov ecx, dword [esi + 4]
mov edx, dword [ecx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push dword [ebp - 8]
call edi
mov ebx, eax
mov eax, dword [ebp - 0x10]
neg ebx
sbb bl, bl
inc bl
add eax, 0xfffffff0
and bl, 1
call fcn.00401053
push 0
lea eax, [ebp - 0x10]
push 0x43a068
push eax
call fcn.00413ad1
mov ecx, dword [esi + 8]
mov edx, dword [ecx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push 0
push eax
push dword [ebp - 8]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [esi + 0xc]
cmp dword [eax - 0xc], 0
je 0x41210a
push 0
lea eax, [ebp - 0x10]
push 0x43a074
push eax
call fcn.00413ad1
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push 0
push eax
push dword [ebp - 8]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [esi + 0x10]
cmp dword [eax - 0xc], 0
je 0x412151
push 0
lea eax, [ebp - 0x10]
push 0x43a098
push eax
call fcn.00413ad1
mov esi, dword [esi + 0x10]
mov ecx, dword [esi - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ecx + ecx + 2]
push ecx
push esi
push 1
push 0
push eax
push dword [ebp - 8]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401053
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412033
Function at 0x412785
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x433cf3
call fcn.0042e724
mov esi, ecx
xor edi, edi
push edi
lea eax, [ebp - 0x14]
push 0x439fb8
push eax
mov dword [ebp - 0x10], edi
call fcn.00413ad1
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push edi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [ebp - 0x14]
setne bl
add eax, 0xfffffff0
call fcn.00401053
test bl, bl
je 0x4127de
xor eax, eax
inc eax
jmp 0x412868
push edi
lea eax, [ebp - 0x14]
push 0x43a044
push eax
call fcn.00413ad1
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [esi]
mov ecx, dword [ecx - 0xc]
mov ebx, dword [eax]
lea eax, [ecx + ecx + 2]
push eax
call fcn.00404273
push eax
xor esi, esi
inc esi
push esi
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
inc bl
add eax, 0xfffffff0
and bl, 1
call fcn.00401053
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x18]
push 0x43a2a0
push eax
call fcn.00413ad1
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [eax]
call fcn.00412e88
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401053
xor eax, eax
test bl, bl
sete al
call fcn.0042e7fc
ret 4
Function at 0x412e88
Capabilities:
Delete registry value

Disassembly:
push 0x20
mov eax, 0x433c8d
call fcn.0042e724
mov esi, ecx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1c]
push 0x43a630
push eax
call fcn.00413ad1
add esp, 0xc
mov edi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
push dword [eax]
mov ecx, dword [edi]
call fcn.004137ff
test eax, eax
mov eax, dword [ebp - 0x18]
setge byte [ebp - 0xd]
add eax, 0xfffffff0
call fcn.00401053
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401053
cmp byte [ebp - 0xd], bl
je 0x412f91
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412f91
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push ebx
mov esi, 0x43a644
lea eax, [ebp + 8]
push esi
push eax
mov dword [ebp - 4], 1
call fcn.00413ad1
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
push eax
push dword [ebp - 0x14]
call fcn.00411856
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401053
cmp dword [ebp - 0x28], ebx
je 0x412f80
push ebx
lea eax, [ebp + 8]
push esi
push eax
call fcn.00413ad1
add esp, 0xc
push dword [eax]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401053
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x2c]
call fcn.00413170
call fcn.0042e7fc
ret 4
Function at 0x41a7ff
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x449788], 0
push esi
jne 0x41a772
call fcn.0041a698
test eax, eax
je 0x41a7b5
mov eax, dword [0x449788]
cmp eax, 1
jne 0x41a793
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41a7b5
pop esi
ret
push eax
call dword [0x449790]
test eax, eax
jne 0x41a7fd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41a7b9
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x449788]
call dword [0x449790]
mov edi, eax
test edi, edi
je 0x41a7de
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41a7fa
mov edi, esi
add esi, 0xff0
push edi
push dword [0x449788]
call dword [0x44978c]
add edi, 0x10
cmp edi, esi
jb 0x41a7e6
mov eax, edi
pop edi
pop esi
ret
jmp 0x41a75f

Function at 0x41a944
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442080]
jne 0x41a94e
repz ret
jmp fcn.0041cc7c

Function at 0x41c534
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
jmp loc.004d1aa8
Function at 0x42a37b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004208e6
and dword [ebp - 4], 0
cmp dword [0x44a2a8], 0
mov ebx, eax
jne 0x42a42c
push 0x438798
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42a4dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43878c
push edi
call esi
test eax, eax
je 0x42a4dd
push eax
call fcn.00420874
mov dword [esp], 0x43877c
push edi
mov dword [0x44a2a8], eax
call esi
push eax
call fcn.00420874
mov dword [esp], 0x438768
push edi
mov dword [0x44a2ac], eax
call esi
push eax
call fcn.00420874
mov dword [esp], 0x43874c
push edi
mov dword [0x44a2b0], eax
call esi
push eax
call fcn.00420874
pop ecx
mov dword [0x44a2b8], eax
test eax, eax
je 0x42a42c
push 0x438734
push edi
call esi
push eax
call fcn.00420874
pop ecx
mov dword [0x44a2b4], eax
mov eax, dword [0x44a2b4]
cmp eax, ebx
je 0x42a484
cmp dword [0x44a2b8], ebx
je 0x42a484
push eax
call fcn.004208ef
push dword [0x44a2b8]
mov esi, eax
call fcn.004208ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42a484
test edi, edi
je 0x42a484
call esi
test eax, eax
je 0x42a47b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42a47b
test byte [ebp - 0xc], 1
jne 0x42a484
or dword [ebp + 0x10], 0x200000
jmp 0x42a4bd
mov eax, dword [0x44a2ac]
cmp eax, ebx
je 0x42a4bd
push eax
call fcn.004208ef
pop ecx
test eax, eax
je 0x42a4bd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42a4bd
mov eax, dword [0x44a2b0]
cmp eax, ebx
je 0x42a4bd
push eax
call fcn.004208ef
pop ecx
test eax, eax
je 0x42a4bd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44a2a8]
call fcn.004208ef
pop ecx
test eax, eax
je 0x42a4dd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42a4df
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1010cc71
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1010ccb0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1010ccb0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1010ccb0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1010ccb0
cmp dword [ecx + 0x74], 0xe
jbe 0x1010ccb0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1010f9c0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1010fa5d
push ebx
push esi
call fcn.1010f989
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1010f91d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1010fa0a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1010fa5c
push edi
push eax
call fcn.1010e340
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1010fa2a
call fcn.1010e38e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1010fa5b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1010f91d
add esp, 0x20
test eax, eax
jne 0x1010fa49
push edi
call fcn.1010e38e
jmp 0x1010fa51
push ebx
call fcn.1010e38e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1010fcca
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10117eb8
push 0x10117eb0
push str.FlsAlloc
push 0x1f
call fcn.1010fbe6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010fcfe
push dword [ebp + 8]
mov ecx, esi
call dword [0x10116124]
call esi
jmp 0x1010fd04
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1010fd48
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10117ec8
push 0x10117ec0
push str.FlsGetValue
push 0x21
call fcn.1010fbe6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010fd7f
push dword [ebp + 8]
mov ecx, esi
call dword [0x10116124]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1010fd87
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10117ed0
push 0x10117ec8
push str.FlsSetValue
push 0x22
call fcn.1010fbe6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010fdc1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10116124]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10115210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1011523d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1011523d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4e1214
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e130a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx esi, ax
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e1324
mov edx, 0x59
mov eax, esi
call fcn.00412e04
push dword [ebp - 4]
push 0x4e1338
lea eax, [ebp - 8]
push eax
mov ecx, 0x4e1348
mov edx, 0x5a
mov eax, esi
call fcn.00412e04
push dword [ebp - 8]
lea eax, [ebx + 0x18]
mov edx, 3
call fcn.00406184
call fcn.00444ee4
test al, al
je 0x4e1292
lea eax, [ebx + 0x1c]
mov edx, 0x4e135c
call fcn.00405be4
jmp 0x4e12b9
mov eax, dword [0x4ebc34]
mov eax, dword [eax]
add eax, eax
lea eax, [eax + eax*4]
mov edx, dword [0x4ec068]
add eax, dword [edx]
lea edx, [ebp - 0xc]
call fcn.0040c334
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x1c]
call fcn.00405be4
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, dword [ebx + 0xc]
call fcn.004ddb74
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
call fcn.00405be4
lea ecx, [ebp - 0x14]
mov edx, 1
mov eax, dword [ebx + 0xc]
call fcn.004ddb74
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x3c]
call fcn.00405be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1311
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405bdc
ret

Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
in al, 0x8b
in al, dx
sub esp, 0x10
wait
dec ebp
or al, 0x56
mov esi, dword [ebp + 0x10]
push 0
lea edx, [ebp - 8]
push 0
sbb al, 6
dec ebx
mov edx, dword [ebp + 8]
mov word [ebp - 0x10], es
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
mov edi, dword [ecx]
or eax, 0x6af04dc6
add dword [ecx + 0x50], edx
mov dword [ebp - 4], 0
mov dword [ebp + 0x1e], 0x8e0000
add byte [eax], al
mov es, word [eax]
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x408bb3
push edi
mov esp, dword [ebx - 0x28]
sal dword [ebx], 0
call edi
test eax, eax
jne 0x408b9e
leave
push es
jecxz 0x408bf6
mov esp, ebp
pop ebp
ret 0x1b0c
call edi
sbb eax, dword [esi]
add byte [eax], al
add byte [eax], al
pop edi
add eax, 0x910afc80
pop esi
mov esp, ebp
add dl, 0xc
add byte [ebx + 0x62bfc45], cl
mov eax, dword [ebp - 4]
sub eax, dword [esi]
mov ah, 0xf7
fcomp dword [ebx]
shl byte [0xfffeee82], 0x14
jle 0x408bd6
add dword [eax], eax
mov esp, ebp
pop ebp
ret 0xc
or byte [ebp + 0x6850fc45], cl
jle 0x408b78
add al, 0x80
push ecx
mov dword [ebp + 0x4e], 0x64
call ecx
mov ah, 0xc1
inc eax
add byte [ebx + 0x1e75fff8], al
push esi
invalid
fadd st(1)
add al, 0
call esi
test eax, eax
jne 0x408c05
pop esi
mov esp, ebp
pop ebp
ret
call dword [edx]
add eax, 0xa9080
pop esi
mov edx, dword [0x9633c65d]
mov esp, ebp
pop ebp
xchg dword [ecx - 0x70], edi
nop
nop
movsb byte es:[edi], byte [esi]
mov ah, 0x90
nop
nop
Function at 0x408954
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
add esi, 0x20a2d47
push esi
mov edx, dword [esp]
add esp, 4
call fcn.00408978
xor dword [edi], ecx
add edi, 1
cmp edi, ebx
jne fcn.00408954
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x38da1415
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x21d167ea
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219