joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf51b58
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0xf51b9d
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0xf51b8c
cmp eax, dword [ebp + 0x10]
jle 0xf51c26
mov dword [0x109d36c], 8
xor eax, eax
jmp 0xf51c91
cmp dword [0x10a2708], 1
jne 0xf51be2
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0xf51c26
xor eax, eax
jmp 0xf51c91
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0xf51c22
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0xf51c26
xor eax, eax
jmp 0xf51c91
lea edx, [ebp - 0x10c]
push edx
call fcn.00f4f464
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0xf51c46
mov dword [0x109d36c], 0x22
xor eax, eax
jmp 0xf51c91
test edi, edi
jne 0xf51c68
mov edx, dword [ebp + 0x10]
push edx
call fcn.00f4e4a4
pop ecx
mov edi, eax
test eax, eax
jne 0xf51c68
mov dword [0x109d36c], 8
xor eax, eax
jmp 0xf51c91
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf52284
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
dec eax
je 0xf522b2
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0xf522ab
push 5
call fcn.00f51f54
pop ecx
pop ebp
ret
call fcn.00f51fb8
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xf53f08
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
dec eax
je 0xf53f25
call fcn.00f51fb8
jmp 0xf53fa0
lea edx, [ebp - 0x210]
push edx
push 0x208
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
jne 0xf53f41
call fcn.00f51fb8
jmp 0xf53fa0
cmp dword [0x10a2708], 1
je 0xf53f9e
mov bx, word [ebp - 0x210]
push ebx
call fcn.00f56afc
pop ecx
cmp ax, 0x41
jb 0xf53f9e
cmp ax, 0x5a
ja 0xf53f9e
cmp word [ebp - 0x20e], 0x3a
jne 0xf53f9e
mov word [ebp - 8], 0x3d
mov word [ebp - 6], ax
lea ecx, [ebp - 0x210]
mov word [ebp - 4], 0x3a
mov word [ebp - 2], 0
push ecx
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetEnvironmentVariableW
dec eax
je 0xf53f9e
call fcn.00f51fb8
jmp 0xf53fa0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf54174
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x208
call fcn.00f4e4a4
pop ecx
mov ebx, eax
test eax, eax
jne 0xf54198
xor eax, eax
jmp 0xf54233
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameW
mov esi, eax
test esi, esi
je 0xf541b9
cmp esi, 0x104
jb 0xf541c4
push ebx
call fcn.00f4e4b4
pop ecx
xor eax, eax
jmp 0xf54233
cmp word [ebx + 2], 0x3a
jne 0xf541fd
mov dx, word [ebx]
lea ecx, [ebp - 0xc]
mov word [ebp - 0xc], dx
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], 0x5c
mov word [ebp - 6], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 2
jae 0xf541fd
push ebx
call fcn.00f4e4b4
pop ecx
xor eax, eax
jmp 0xf54233
inc esi
test edi, edi
je 0xf54227
cmp esi, dword [ebp + 0x10]
jbe 0xf54212
push ebx
call fcn.00f4e4b4
pop ecx
xor eax, eax
jmp 0xf54233
push ebx
push edi
call fcn.00f4f78c
add esp, 8
push ebx
call fcn.00f4e4b4
pop ecx
mov eax, edi
jmp 0xf54233
add esi, esi
push esi
push ebx
call fcn.00f4e4c4
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf54254
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0xf54299
lea eax, [ebp - 0x214]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
je 0xf54288
cmp eax, dword [ebp + 0x10]
jle 0xf54330
mov dword [0x109d36c], 8
xor eax, eax
jmp 0xf54384
cmp dword [0x10a2708], 1
jne 0xf542e4
mov edx, ebx
lea ecx, [ebp - 0x214]
add dx, 0x40
add ecx, 3
mov word [ebp - 0x214], dx
mov dl, bl
mov word [ebp - 0x212], 0x3a
mov word [ebp - 0x210], 0x5c
mov word [ebp - 0x20e], 0
mov esi, ecx
mov ah, 0x47
int 0x21
jae 0xf54330
xor eax, eax
jmp 0xf54384
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0xf5432c
add bx, 0x40
lea eax, [ebp - 0xc]
mov word [ebp - 8], bx
lea edx, [ebp - 0x214]
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0x2e
mov word [ebp - 2], 0
push eax
push edx
lea ecx, [ebp - 8]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameW
jmp 0xf54330
xor eax, eax
jmp 0xf54384
lea edx, [ebp - 0x214]
push edx
call fcn.00f4f774
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0xf54350
mov dword [0x109d36c], 0x22
xor eax, eax
jmp 0xf54384
test edi, edi
jne 0xf54372
mov edx, dword [ebp + 0x10]
push edx
call fcn.00f4e4a4
pop ecx
mov edi, eax
test eax, eax
jne 0xf54372
mov dword [0x109d36c], 8
xor eax, eax
jmp 0xf54384
lea edx, [ebp - 0x214]
push edx
push edi
call fcn.00f4f78c
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf5438c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
dec eax
je 0xf543ba
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0xf543b3
push 5
call fcn.00f51f54
pop ecx
pop ebp
ret
call fcn.00f51fb8
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0xf543fc
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x22
push 0
push ebx
call fcn.00f4f330
add esp, 0xc
mov word [ebx + 6], 1
lea eax, [ebp - 0x254]
push eax
push edi
call sub.KERNEL32.DLL_FindFirstFileW
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0xf54509
push 0x109c6c4
push edi
call fcn.00f4f7cc
add esp, 8
test eax, eax
je 0xf544ab
push 0
push edi
push 0
call fcn.00f54174
add esp, 0xc
mov esi, eax
test eax, eax
je 0xf544ab
push esi
call fcn.00f4f774
pop ecx
cmp eax, 3
jne 0xf544ab
push esi
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 2
jae 0xf54482
call fcn.00f51fb8
jmp 0xf54601
mov word [ebx + 4], 0x4000
mov di, word [esi]
push edi
call fcn.00f56afc
add ax, 0xffc0
pop ecx
mov word [ebx + 0x10], ax
mov word [ebx], ax
push esi
call fcn.00f4e4b4
pop ecx
xor eax, eax
jmp 0xf54601
test esi, esi
je 0xf544b6
push esi
call fcn.00f4e4b4
pop ecx
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push edi
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0xf544dd
call fcn.00f51fb8
jmp 0xf54601
mov si, 0x1000
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileType
cmp eax, 3
je 0xf544f5
add esi, 0x1000
mov word [ebx + 4], si
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0xf54601
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_FindClose
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x240]
push ecx
push eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x250]
push edx
push ecx
mov eax, dword [ebp - 0x254]
push eax
push ebx
call fcn.00f5b9ec
add esp, 0x18
test byte [ebx + 5], 0x40
jne 0xf545a2
push 0x2e
push edi
call fcn.00f4f800
add esp, 8
mov esi, eax
test eax, eax
je 0xf545a2
push str..bat
push esi
call fcn.00f4f82c
add esp, 8
test eax, eax
je 0xf5459d
push str..cmd
push esi
call fcn.00f4f82c
add esp, 8
test eax, eax
je 0xf5459d
push str..com
push esi
call fcn.00f4f82c
add esp, 8
test eax, eax
je 0xf5459d
push str..exe
push esi
call fcn.00f4f82c
add esp, 8
test eax, eax
jne 0xf545a2
or word [ebx + 4], 0x40
cmp word [edi + 2], 0x3a
jne 0xf545ae
mov ax, word [edi]
jmp 0xf545d0
lea edx, [ebp - 0x45c]
push edx
push 0x208
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
jne 0xf545c9
mov ax, 0x41
jmp 0xf545d0
mov ax, word [ebp - 0x45c]
cmp ax, 0x61
jb 0xf545e5
cmp ax, 0x7a
ja 0xf545e5
add ax, 0xff9f
mov word [ebx], ax
jmp 0xf545f8
cmp ax, 0x41
jb 0xf545f8
cmp ax, 0x5a
ja 0xf545f8
add ax, 0xffbf
mov word [ebx], ax
mov dx, word [ebx]
xor eax, eax
mov word [ebx + 0x10], dx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf55fec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00f4f3d4
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00f4f464
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.00f4f464
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x109cc9d
lea ecx, [ebp - 0x200]
push ecx
call fcn.00f4f3d4
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.00f4f464
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00f57814
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0xf560fd
push esi
call fcn.00f4f464
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00f4f464
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00f4e4a4
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0xf560d4
xor eax, eax
jmp 0xf56184
push esi
call fcn.00f4f464
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00f4f464
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00f4f330
add esp, 0xc
jmp 0xf5613d
mov edi, dword [ebx + 0x24]
push edi
call fcn.00f4f464
pop ecx
push eax
push esi
call fcn.00f4f464
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00f4f464
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00f4e4c4
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0xf5613d
xor eax, eax
jmp 0xf56184
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00f4f3d4
add esp, 8
push 0x109cc9f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00f4f3d4
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00f4f3d4
add esp, 8
push 0x109cca1
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00f4f3d4
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf5a034
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0xf5a096
call fcn.00f59fe4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00f4f464
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00f4f464
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0xf5a0f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x109d374], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0xf5a1ce
cmp dword [0x109d370], 0
jne 0xf5a1ce
cmp dword [0x109d508], 0
je 0xf5a188
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00f59e70
add esp, 8
mov ebx, eax
test eax, eax
jne 0xf5a16e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00f59e70
add esp, 8
mov ebx, eax
test eax, eax
jne 0xf5a16e
lea ebx, [ebp - 0x84]
jmp 0xf5a16f
inc ebx
call fcn.00f5a0b0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0xf5a209
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x109d378
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00f4f464
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x109d37b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0xf5a209
cmp dword [0x109d370], 0
je 0xf5a1e8
cmp dword [0x109d370], 0xffffffff
je 0xf5a209
push esi
call dword [0x109d370]
pop ecx
mov eax, dword [0x109d374]
test eax, eax
je 0xf5a209
cmp dword [0x109d374], 0xffffffff
je 0xf5a209
cmp byte [eax], 0
je 0xf5a209
push esi
push eax
call fcn.00f5a034
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf5b10c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
cmp edi, 1
jne 0xf5b192
mov eax, dword [0x10a2770]
inc dword [0x10a2770]
test eax, eax
jne 0xf5b192
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x10a2740], eax
mov edx, dword [ebp + 0x10]
mov dword [0xf9ae43], edx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.00f513fc
pop ecx
cmp dword [0x109d3f8], 0
je 0xf5b17d
call fcn.00f5afc4
mov ebx, eax
test eax, eax
je 0xf5b17d
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0xf5b17d
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], esi
jmp 0xf5b192
xor eax, eax
lea edx, [ebp - 8]
push 0
push edx
mov dword [0x109d3f8], eax
call fcn.00f5afcc
add esp, 8
mov ecx, dword [ebp + 0x18]
push ecx
push edi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.00f5b2a0
mov ebx, eax
test edi, edi
jne 0xf5b201
test edi, edi
jne 0xf5b1d2
dec dword [0x10a2770]
jne 0xf5b1d2
cmp dword [0x10a2740], 0
je 0xf5b1d2
mov eax, dword [0x10a2740]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
xor edx, edx
mov dword [0x10a2740], edx
cmp dword [0x10a2770], 0
jne 0xf5b201
cmp dword [0x109d3f8], 0
jne 0xf5b201
cmp dword [0x109d3e8], 0
je 0xf5b1f3
call dword [0x109d3e8]
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.00f5afcc
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0xf63a78
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0xca
jne 0xf63aab
push ebx
call fcn.00f68fdc
cmp dword [ebx + 0x40], 0
pop ecx
je 0xf63aa4
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
pop ebp
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0xf63b1d
mov edx, dword [ebx + 0x1b0]
cmp dword [edx + 0x10], 0
je 0xf63b0f
cmp dword [ebx + 8], 0
je 0xf63acd
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
push ebx
mov eax, dword [ebx + 0x1b0]
call dword [eax]
pop ecx
test eax, eax
jne 0xf63ae0
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 2
je 0xf63b0f
cmp dword [ebx + 8], 0
je 0xf63ac0
cmp eax, 3
je 0xf63af3
dec eax
jne 0xf63ac0
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0xf63ac0
mov edx, dword [ebx + 0x13c]
add dword [eax + 8], edx
jmp 0xf63ac0
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0xf63b3b
cmp dword [ebx + 0x10], 0xcc
je 0xf63b3b
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
pop ecx
push ebx
call fcn.00f63b48
pop ecx
pop ebx
pop ebp
ret

Function at 0xf63b48
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0xcc
je 0xf63be3
push ebx
mov eax, dword [ebx + 0x1a0]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x8c], edx
mov dword [ebx + 0x10], 0xcc
jmp 0xf63be3
mov eax, dword [ebx + 8]
test eax, eax
je 0xf63b91
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x74]
mov dword [eax + 8], edx
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
mov esi, dword [ebx + 0x8c]
lea eax, [ebx + 0x8c]
push 0
push eax
push 0
push ebx
mov edx, dword [ebx + 0x1a4]
call dword [edx + 4]
add esp, 0x10
cmp esi, dword [ebx + 0x8c]
jne 0xf63bbb
xor eax, eax
jmp 0xf63c09
mov edx, dword [ebx + 0x8c]
cmp edx, dword [ebx + 0x74]
jb 0xf63b7a
push ebx
mov ecx, dword [ebx + 0x1a0]
call dword [ecx + 4]
pop ecx
push ebx
mov eax, dword [ebx + 0x1a0]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x8c], edx
mov ecx, dword [ebx + 0x1a0]
cmp dword [ecx + 8], 0
jne 0xf63bbb
cmp dword [ebx + 0x44], 0
je 0xf63bfc
mov eax, 0xce
jmp 0xf63c01
mov eax, 0xcd
mov dword [ebx + 0x10], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001225d
pop dword [ebp - 0x48]
mov eax, 0xe3908f5c
sub eax, 0xd38f6cff
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xfc428e42
add dword [ebp - 0x58], 0x520fb709
mov dword [ebp - 0x54], 0x67e78711
add dword [ebp - 0x54], 0xca4bc534
mov dword [ebp - 0x50], 0x752e056a
sub dword [ebp - 0x50], 0x28e1c13c
mov dword [ebp - 0x4c], 0x46712ee2
sub dword [ebp - 0x4c], 0x46712ee2
lea eax, [ebp - 0x58]
push eax
mov eax, 0x9f9bbd7
add eax, 0x60794c1
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x95881d5f
sub dword [ebp - 0x58], 0x2115b409
mov dword [ebp - 0x54], 0x81ac79cd
add dword [ebp - 0x54], 0xbfbfe7a8
mov dword [ebp - 0x50], 0x95cb33d0
sub dword [ebp - 0x50], 0x325bc764
mov dword [ebp - 0x4c], 0xf71bce44
add dword [ebp - 0x4c], 0x8e431bc
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x380be
push 0
call eax
mov ecx, 0x50e8dcc4
add ecx, 0xaf17691d
xor edi, edi
add edi, eax
mov esi, 0x729fa766
sub esi, 0x629b8b66
add esi, dword [ebp - 0x48]
mov ebx, 0x6dbd8b0a
add dword [ebp - 0x1c], 0x9de7af2c
mov edx, dword [esi]
add dword [ebp - 0x2c], ebx
add edx, ebx
add dword [ebp - 8], 0x2664dae2
mov dword [edi], edx
xor dword [ebp - 0x44], eax
add edi, 4
add esi, 4
loop 0x10012376
add eax, 0x10a57
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc092e976
sub ecx, 0xb092e976
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x41dbea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41dc29
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dc29
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dc29
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41dc29
cmp dword [ecx + 0x74], 0xe
jbe 0x41dc29
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x423bdf
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4db0a8
push 0x4db0a0
push str.FlsAlloc
push 0x1f
call fcn.00423a9e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423c13
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c144]
call esi
jmp 0x423c19
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x423c5d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4db0b8
push 0x4db0b0
push str.FlsGetValue
push 0x21
call fcn.00423a9e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423c94
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x423c9c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4db0c0
push 0x4db0b8
push str.FlsSetValue
push 0x22
call fcn.00423a9e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423cd6
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42c144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42548e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42552b
push ebx
push esi
call fcn.00425457
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004253eb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4254d8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42552a
push edi
push eax
call fcn.00423ea1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4254f8
call fcn.00423eef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425529
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004253eb
add esp, 0x20
test eax, eax
jne 0x425517
push edi
call fcn.00423eef
jmp 0x42551f
push ebx
call fcn.00423eef
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42b770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42b79d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42b79d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret