joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013e2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401417
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x401414
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x401420
add edx, 0x28
cmp edx, esi
jne 0x401402
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x40141d

Function at 0x40185f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40189e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40189e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40189e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40189e
cmp dword [ecx + 0x74], 0xe
jbe 0x40189e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40b39e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b43b
push ebx
push esi
call fcn.0040b367
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b2fd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b3e8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b43a
push edi
push eax
call fcn.004081c0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b408
call fcn.004077e0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b439
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b2fd
add esp, 0x20
test eax, eax
jne 0x40b427
push edi
call fcn.004077e0
jmp 0x40b42f
push ebx
call fcn.004077e0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40fa1b
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x40fa35
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x40fa4c
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x40faa4
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.0040bad7
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x40faa4
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40faa4
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40faa4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x40fa9e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x40faa0
xor bl, bl
mov al, bl
jmp 0x40faa6
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x413800
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41382d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41382d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001e615
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e63c
push 0xb0b
push 0xc1f
push 1
push 0
push 0x17e0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x1001e653
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001e653
push 0x10f8
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10026465
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x36c
lea eax, [ecx + edx]
cmp dword [ebp - 4], 0x21a3
movzx eax, ax
cld
mov dword [0xf000021], eax
mov bh, 0xc0
jle 0x10026505
mov byte [ebp - 0x4b], 0x33
adc eax, 0xfd0ebdf0
adc ecx, ecx
mov dl, 0x9d
out 0xf0, eax
cmp byte [edx - 0x3aa3b370], al
jge 0x10026475
ret
and ecx, edx
mov dword [ebp - 4], 0x4a2
cmp dword [ebp - 4], 0x1838
movzx edx, cx
jle 0x10026583
clc
les ecx, [edx]
push edx
dec ebp
push esp
adc al, 0
xchg ebp, eax
jbe 0x10026548
and ch, byte [0x74b80410]
invalid
push esi
jb 0x10026573
int3
xor eax, 0xc4aa9e94
add byte [ecx], dh
dec ebx
ret 0x96e6
mov dword [ebp - 4], 0x122c
cmp dword [ebp - 4], 0x14d8
movzx ecx, cx
jle 0x10026685
arpl dx, sp
and dword [ecx + 0xc], 0x313c95d5
lcall 0xee75, 0x966be6d5
int 0x2d
rol byte [edx + 0xfcd0855], 0xb
lea ebp, [edi]
cmp byte [esi - 0x5c6c1e3f], dl
push esp
inc ebx
sbb eax, 0x8163b48d
cmp eax, 0x6be69243
cmpsb byte [esi], byte es:[edi]
sub ecx, edx
in al, 0xd8
mov ebx, 0x1e3ac96d
invalid
dec edi
in al, 0x65
sar byte [eax], 0x7a
push ecx
jmp 0x10026668
lodsb al, byte [esi]
inc ebp
outsd dx, dword [esi]
jbe 0x100265eb
scasd eax, dword es:[edi]
call 0x37264efa
sub ecx, dword [ebx]
and dl, dh
loopne 0x10026685
xchg edi, eax
les edx, [ecx]
xchg byte [ebx], dh
sub al, 0xc9
int 9
jnp 0x1002668c
and ch, ch
fldenv [ebp + 0xc]
xchg bh, bh
xchg ch, al
xor eax, dword [0x59be8120]
xor dword [edx - 0x5b], 0x73
inc esi
mov ebx, dword [ecx - 0x25]
sub ecx, dword [edx + ecx*8 + 0x76]
mov edi, ss
je 0x10026646
inc dword [esi + 0x200533c5]
cmp dword [esi - 0x5a8d7ca7], 0x598b4673
fld xword [ebx]
dec esp
retf 0x8c76
sbb al, 0x68
push esp
stc
sub eax, edx
mov dword [ebp - 4], 0xb60
add byte [eax], al
cmp dword [ebp - 4], 0x1b21
movzx eax, ax
jle 0x10026761
adc dh, byte [eax - 0x73]
nop
movsb byte es:[edi], byte [esi]
jae 0x10026709
jb 0x10026649
cmp eax, 0x92db29f4
cdq
aaa
wait
mov eax, dword [0x16186057]
das
push 0x3892ab91
fadd st(7), st(0)
adc dword [ecx - 0x1d], esi
out 0xa2, eax
push edi
cli
pushal
xlatb
push eax
shr dword [edx - 0x3ae5d968], 0xa7
fild word [edi]
xchg esi, eax
mov ebx, 0xbf6f1379
xchg dh, ah
add eax, 0xe3cb9d8d
dec ecx
xor dword [edx + 0x6e6edae5], esp
movsb byte es:[edi], byte [esi]
cmp ebp, edx
jae 0x100266ba
int1
jge 0x1002671c
invalid
iretd
sub dword [eax - 0x131e0e89], edx
mov dword [esi - 0x8d9f715], 0x11dc62b3
rol cl, 1
popal
and al, 0x74
hlt
sub eax, ecx
mov dword [ebp - 4], 0x9f6
cmp dword [ebp - 4], 0x142e
movzx eax, ax
jle 0x1002684c
scasd eax, dword es:[edi]
in eax, 0x14
movsd dword es:[edi], dword [esi]
les esp, [edx + 0x2c]
invalid
mov dword [ebp - 4], 0x7d0
cmp dword [ebp - 4], 0x1a1d
jle 0x100268cf
outsb dx, byte [esi]
ret
mov esp, ebp
pop ebp
ret
Function at 0x1002d849
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002d877
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002d875
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1002d8b7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [eax]
push 0x6e8c
mov eax, dword [ebp - 0x20]
push dword [eax]
push 0
call fcn.1002aeaa
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1002ff79
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ffc1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002ffe9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002ffe9
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esp, ebp
pop ebp
ret
Function at 0x1003047d
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
jmp 0x1003049f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x10030571
mov dword [ebp - 0xc], 0xf70a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100304cf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x100304ec
push 0x1887
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
and eax, 0x80000000
je 0x10030528
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0x51e2
push 0x7717
call fcn.10025a5f
pop ecx
pop ecx
call eax
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x1003055a
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
inc eax
inc eax
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0x51e2
push 0x7717
call fcn.10025a5f
pop ecx
pop ecx
call eax
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp dword [eax], 0
jne 0x1003056c
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x10030571
jmp 0x10030485
mov esp, ebp
pop ebp
ret
Function at 0x10030a98
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10030abc
xor eax, eax
jmp 0x10030bd8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10030ada
xor eax, eax
jmp 0x10030bd8
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.1003098f
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10030af9
xor eax, eax
jmp 0x10030bd8
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x6825
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
call fcn.10030852
add esp, 0x1c
push 1
lea eax, [ebp - 8]
push eax
push 0x59a9
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
call fcn.100309e9
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10030b58
push dword [ebp - 0x14]
push 0x4e30
push 1
push dword [ebp - 4]
call fcn.1002dc23
add esp, 0x10
push dword [ebp - 4]
call fcn.100305b0
pop ecx
test eax, eax
jne 0x10030b69
xor eax, eax
jmp 0x10030bd8
push 1
push 0xbd8
push dword [ebp - 4]
call fcn.1002b945
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10030bc0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10030b9a
xor eax, eax
jmp 0x10030bd8
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10030bb3
xor eax, eax
jmp 0x10030bd8
lea eax, [ebp - 4]
push eax
push 1
call fcn.10030a67
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10030bd1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10030bd5
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004454e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004456c
push 0x253e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x100445a2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100445a2
push 0
push 0xfa4
push 0x448
push 0
push 0x16ac
push 0x2529
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esp, ebp
pop ebp
ret

Function at 0x10044ccf
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10044d74
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
and dword [ebp - 8], 0
jmp 0x10044d2b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
jge 0x10044d72
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc]
add edx, dword [esi]
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
mov ax, word [ecx + eax]
mov word [esi + edx], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x10044d24
jmp 0x10044d91
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10044d91
push 0x845
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10044dde
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10044e4e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, ecx
push eax
mov ecx, dword [ebp - 0x28]
call fcn.1004a5b4
jmp 0x10044e59
push 0x10f8
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10080272
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006fa9a
mov dword [ebp - 0x14], eax
cmp dword [0x10677350], esi
jne 0x10080365
push 0x800
push esi
push 0x1000958c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100802f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10080445
push esi
push esi
push 0x1000958c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10080445
push 0x100095a4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10080445
push eax
call ebx
push 0x100095b0
push edi
mov dword [0x10677350], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100095c0
push edi
mov dword [0x10677354], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100095d4
push edi
mov dword [0x10677358], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10677360], eax
test eax, eax
je 0x10080362
push 0x100095f0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067735c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008038a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1008037d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1008039f
push 4
pop eax
jmp 0x10080447
cmp dword [ebp - 0x14], esi
je 0x1008039f
push dword [0x10677350]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10080384
mov eax, dword [0x1067735c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100803fd
cmp dword [0x10677360], edi
je 0x100803fd
push eax
call ebx
push dword [0x10677360]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100803fd
test eax, eax
je 0x100803fd
call ecx
test eax, eax
je 0x100803f2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100803f2
test byte [ebp - 8], 1
jne 0x100803fd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1008042d
mov eax, dword [0x10677354]
cmp eax, edi
je 0x1008042a
push eax
call ebx
test eax, eax
je 0x1008042a
call eax
mov esi, eax
test esi, esi
je 0x1008042a
mov eax, dword [0x10677358]
cmp eax, edi
je 0x1008042a
push eax
call ebx
test eax, eax
je 0x1008042a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10677350]
call ebx
test eax, eax
je 0x10080445
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10080447
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006b2bd
mov esp, ebp
pop ebp
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x43b646
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
or edi, edi
call fcn.0043b672
or ecx, edi
and ecx, edi
or ecx, edi
xor dword [edx], ebx
add ecx, 0x3f78a73e
add edi, edi
mov ecx, ecx
inc edx
and ecx, ecx
or ecx, edi
cmp edx, eax
jne fcn.0043b646
or edi, ecx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x75301a93
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0xfea616e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068c6
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40691d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068ff
pop edi
not eax
pop esi
ret 0xc

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219