joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001dc30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1009b01c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
push 0
mov dword [ebp - 0x30], esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_OffsetRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001dd41
test edi, edi
je 0x1001dd1e
test ebx, ebx
je 0x1001dd1e
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1001dd1e
mov ecx, dword [ebx]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
sub esi, ecx
mov ebx, dword [ebx + 0xc]
push edi
mov dword [ebp - 0x28], ecx
sub ebx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push esi
push dword [ebp - 0x1c]
mov edi, eax
mov dword [ebp - 0x2c], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push edi
call esi
push 0xcc0020
push ebx
mov edi, eax
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push ebx
mov ebx, dword [ebp - 0x2c]
push eax
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
push edi
push ebx
call esi
push ebx
mov esi, eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call ebx
mov edi, dword [ebp - 0x1c]
jmp 0x1001dd26
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
xor esi, esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call ebx
mov esi, dword [ebp - 0x30]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d19f
mov esp, ebp
pop ebp
ret 4
Function at 0x10027bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10027c01
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10027bf0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x10027fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x10028011
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10028000
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10030d90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x10030dbb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10030da4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x1004d156
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.10065fee
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x1004d195
sub eax, 1
je 0x1004d190
sub eax, 1
je 0x1004d18c
xor eax, eax
leave
ret
push 3
jmp 0x1004d197
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x10050080
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f16a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1009b01c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x44
mov dword [ebp - 4], 0
mov dword [ebx], vtable.boost::archive::detail::basic_iarchive.0
call fcn.1004d1de
mov edi, eax
mov dword [ebp - 0x14], edi
push edi
mov byte [ebp - 4], 1
call fcn.10051c00
mov ecx, dword [ebp + 8]
mov dword [edi + 4], ecx
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea esi, [edi + 0x24]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
push 0x18
mov byte [ebp - 4], 2
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1004d1de
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, ebx
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [ebx + 0x10], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100518f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f3ad
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x1009b01c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.10037d8e
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
push 0x1008193c
push eax
call fcn.10037c1c
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 8
push eax
call fcn.10037f94
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 9
push eax
call fcn.10037c67
add esp, 0x10
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x100519d0
push eax
call fcn.1005ce9c
add esp, 4
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x100519eb
push eax
call fcn.1005ce9c
add esp, 4
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x10051a06
push eax
call fcn.1005ce9c
add esp, 4
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x10051a21
push eax
call fcn.1005ce9c
add esp, 4
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x10051a3c
push eax
call fcn.1005ce9c
add esp, 4
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x10051a57
push eax
call fcn.1005ce9c
add esp, 4
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], 0
call fcn.10037de6
mov dword [esi], vtable.boost::archive::codecvt_null_wchar_t_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10069076
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100690b5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100690b5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100690b5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100690b5
cmp dword [ecx + 0x74], 0xe
jbe 0x100690b5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1006c10b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100861ec
push 0x100861e4
push str.FlsAlloc
push 0x1f
call fcn.1006bf36
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c13f
push dword [ebp + 8]
mov ecx, esi
call dword [0x10080390]
call esi
jmp 0x1006c145
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1006c189
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100861fc
push 0x100861f4
push str.FlsGetValue
push 0x21
call fcn.1006bf36
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c1c0
push dword [ebp + 8]
mov ecx, esi
call dword [0x10080390]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1006c1c8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10086204
push 0x100861fc
push str.FlsSetValue
push 0x22
call fcn.1006bf36
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c202
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10080390]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10070f5c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10070ff9
push ebx
push esi
call fcn.10070f25
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1006f83d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10070fa6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10070ff8
push edi
push eax
call fcn.1006bbe6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10070fc6
call fcn.1006bbac
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10070ff7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1006f83d
add esp, 0x20
test eax, eax
jne 0x10070fe5
push edi
call fcn.1006bbac
jmp 0x10070fed
push ebx
call fcn.1006bbac
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10070ffc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1007100d
pop esi
ret
push ebx
push edi
push esi
call fcn.10070f25
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1006bbe6
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10071035
push ebx
push esi
push edi
call fcn.10053010
add esp, 0xc
push 0
call fcn.1006bbac
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10071405
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007104a

Function at 0x1007361d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1006a1fc
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1007368c
cmp esi, dword [ebp - 4]
je 0x10073687
cmp dword [ebp + 0xc], 0
je 0x10073687
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10073664
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1007316f
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1007368e
xor eax, eax
inc eax
jmp 0x1007368e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100736f3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1009b01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1006a1fc
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1006a1fc
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1007376a
cmp word [ecx], dx
je 0x1007376a
mov eax, dword [0x100868dc]
push edi
dec eax
push eax
push 0x100867c8
call fcn.10073692
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100737dd
cmp word [eax], dx
je 0x100737dd
mov eax, dword [edi]
test eax, eax
je 0x1007378e
cmp word [eax], dx
je 0x1007378e
lea eax, [ebp - 0x10]
push eax
call fcn.10073075
jmp 0x10073797
lea eax, [ebp - 0x10]
push eax
call fcn.10073110
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10073807
mov eax, dword [0x100867c4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100864b8
call fcn.10073692
add esp, 0xc
test al, al
je 0x10073807
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100737d2
cmp word [eax], di
je 0x100737d2
lea eax, [ebp - 0x10]
push eax
call fcn.10073075
pop ecx
jmp 0x10073809
lea eax, [ebp - 0x10]
push eax
call fcn.10073110
jmp 0x100737cf
mov eax, dword [edi]
test eax, eax
je 0x100737f4
cmp word [eax], dx
je 0x100737f4
lea eax, [ebp - 0x10]
push eax
call fcn.1007302a
pop ecx
jmp 0x10073807
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100738d2
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10073517
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100738d2
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100738d2
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100738d2
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1007385f
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1006c3a4
test ebx, ebx
je 0x100738cd
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1006c3a4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100738d2
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100738d2
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1007751e
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100738d4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d19f
leave
ret
Function at 0x100797e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1007980d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1007980d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4d294536
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x41411b39
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402ba6
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x34], 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov esi, eax
push 0x403204
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.DnsGetCacheDataTable
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
call eax
mov esi, dword [esi]
test esi, esi
je 0x40167b
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], 1
mov edx, dword [esi + 4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], eax
mov eax, edx
mov dword [ebp - 0x3c], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x30], ecx
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4015e0
sub eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x50]
sar eax, 1
push eax
push edx
call fcn.004017f0
movups xmm0, xmmword [ebp - 0x50]
movzx eax, word [esi + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
movups xmmword [ebp - 0x2c], xmm0
push ecx
movq xmm0, qword [ebp - 0x40]
movq qword [ebp - 0x1c], xmm0
cmp eax, dword [edi + 8]
je 0x40162f
mov edx, eax
call fcn.004019c0
add esp, 4
add dword [edi + 4], 0x1c
jmp 0x401637
push eax
mov ecx, edi
call fcn.00401ac0
mov esi, dword [esi]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x401673
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401669
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016b2
push edx
push ecx
call fcn.00401e3e
add esp, 8
test esi, esi
jne 0x4015a0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [edi]
add esp, 4
cmp ecx, dword [edi + 4]
je 0x4016b8
push ecx
call fcn.004011b0
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401e00
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x401240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4272c8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x432ea8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40128d
mov eax, dword [eax]
jmp 0x40128f
xor eax, eax
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x6c]
push esi
call eax
test eax, eax
jge 0x4012ad
push 0x42caa8
push esi
push eax
call fcn.004254c0
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebx
call fcn.004100ce
mov esi, dword [esp + 0x44]
xor edx, edx
add esp, 0x10
mov word [esp + 0xc], dx
test esi, esi
je 0x401306
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x401306
test esi, esi
je 0x401306
mov eax, dword [esi]
test eax, eax
je 0x4012ed
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x4012fd
push eax
call fcn.00403b56
add esp, 4
push esi
call fcn.00403b56
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4

Function at 0x401320
Capabilities:
Encode data using xor

Disassembly:
mov eax, str.abc123
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401328
sub eax, edx
xor ecx, ecx
push esi
mov esi, eax
test ebx, ebx
jbe 0x401355
lea ebx, [ebx]
mov eax, ecx
xor edx, edx
div esi
inc ecx
mov al, byte [edx + str.abc123]
xor byte [ecx + edi - 1], al
cmp ecx, ebx
jb 0x401340
pop esi
ret
Function at 0x4100bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432ea8]
jne 0x4100c9
repz ret
jmp fcn.00413a2f

Function at 0x41e920
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413f17
and dword [ebp - 4], 0
cmp dword [0x436e60], 0
mov ebx, eax
jne 0x41e9d1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41ea82
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41ea82
push eax
call fcn.00413ea5
mov dword [esp], 0x42c5b8
push edi
mov dword [0x436e60], eax
call esi
push eax
call fcn.00413ea5
mov dword [esp], 0x42c5a4
push edi
mov dword [0x436e64], eax
call esi
push eax
call fcn.00413ea5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x436e68], eax
call esi
push eax
call fcn.00413ea5
pop ecx
mov dword [0x436e70], eax
test eax, eax
je 0x41e9d1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413ea5
pop ecx
mov dword [0x436e6c], eax
mov eax, dword [0x436e6c]
cmp eax, ebx
je 0x41ea29
cmp dword [0x436e70], ebx
je 0x41ea29
push eax
call fcn.00413f20
push dword [0x436e70]
mov esi, eax
call fcn.00413f20
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ea29
test edi, edi
je 0x41ea29
call esi
test eax, eax
je 0x41ea20
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41ea20
test byte [ebp - 0xc], 1
jne 0x41ea29
or dword [ebp + 0x10], 0x200000
jmp 0x41ea62
mov eax, dword [0x436e64]
cmp eax, ebx
je 0x41ea62
push eax
call fcn.00413f20
pop ecx
test eax, eax
je 0x41ea62
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ea62
mov eax, dword [0x436e68]
cmp eax, ebx
je 0x41ea62
push eax
call fcn.00413f20
pop ecx
test eax, eax
je 0x41ea62
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436e60]
call fcn.00413f20
pop ecx
test eax, eax
je 0x41ea82
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41ea84
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret