joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c0eb
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov eax, 0x60cc8a
call fcn.0060bd28
sub esp, 0xc
push esi
push ecx
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov dword [ebp - 0x18], esi
call fcn.0047c3f4
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47c135
mov ecx, dword [ebp + 0xc]
push 0x693da4
call fcn.00406173
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov eax, dword [ebp + 0xc]
jmp 0x47c197
push edi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
push esi
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
lea eax, [ebp - 0x14]
push 0x6950ec
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
push esi
call fcn.004067cf
mov edi, dword [ebp + 0xc]
add esp, 0x10
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00404ea9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x47cc30
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x611c0a
call fcn.0060bd28
push ecx
push esi
push edi
xor edi, edi
xor esi, esi
push str.DownLoadFileFromAdder
inc edi
push 0x6c8880
mov dword [ebp - 4], edi
call fcn.0048de60
push 0x12c
push esi
push esi
lea edx, [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.0047341c
add esp, 0x14
test eax, eax
jne 0x47cc7b
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
cmovne esi, edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47d4ca
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x611e35
call fcn.0060bd28
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor ebx, ebx
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
push edi
call fcn.004067cf
pop ecx
mov dword [ebp - 0x14], eax
lea edx, [eax + 0x10]
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040b0eb
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00404ea9
test esi, esi
je 0x47d55a
push ecx
mov esi, esp
mov dword [ebp - 0x10], esp
push edi
mov dword [ebp - 0x1c], esi
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov esi, esp
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
pop ecx
mov byte [ebp - 4], 2
call fcn.0047cc30
pop ecx
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x14]
call fcn.00404ea9
mov ecx, edi
call fcn.00404ea9
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48564b
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x612160
call fcn.0060bd28
sub esp, 0x210
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x485766
push 3
push dword [edi + 0x60]
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], eax
call fcn.004066f6
and dword [ebp - 4], 0
lea eax, [edi + 0x4c]
mov edx, dword [ebp - 0x118]
mov ecx, dword [edi + 8]
push 0x69ec70
push eax
call fcn.00486529
or dword [ebp - 4], 0xffffffff
mov dword [edi + 4], eax
lea eax, [ebp - 0x114]
pop ecx
pop ecx
cmp dword [ebp - 0x118], eax
je 0x4856c3
push dword [ebp - 0x118]
call fcn.005f0033
pop ecx
mov eax, dword [edi + 0x64]
cmp dword [eax - 0xc], 0
je 0x485763
push esi
mov edx, 0x400000
lea ecx, [ebp - 0x14]
call fcn.0040b184
push str.data_skin_skincfg.ini
mov edx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0040aec1
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push 3
push dword [edi + 0x64]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], eax
call fcn.004066f6
push dword [esi]
push 0xff
push dword [ebp - 0x21c]
push str.alpha
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x30], eax
lea eax, [ebp - 0x218]
pop esi
cmp dword [ebp - 0x21c], eax
je 0x48574d
push dword [ebp - 0x21c]
call fcn.005f0033
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x490731
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x60cbef
call fcn.0060bd28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x49084f
mov ecx, dword [ecx + 0xc]
cmp ecx, ebx
jne 0x490763
mov ecx, esi
call fcn.00491c6f
mov eax, ebx
jmp 0x490858
cmp ecx, 2
jne 0x490784
cmp byte [esi + 0x5f2], 0
jne 0x490777
mov byte [esi + 0x5f2], bl
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49075c
cmp ecx, 0x65
jne 0x490792
mov ecx, esi
call fcn.00491d8d
jmp 0x49075c
cmp ecx, 0x66
jne 0x4907ac
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x584], eax
sete al
push eax
call fcn.00492cd5
jmp 0x49075c
cmp ecx, 0x191
jne 0x4907bd
mov ecx, esi
call fcn.00491e81
jmp 0x49075c
cmp ecx, 0x96
jne 0x4907e7
push dword [esi + 0x5b0]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
mov ecx, esi
call fcn.004917d9
jmp 0x49075c
cmp ecx, 0x1f5
jne 0x4907fb
mov ecx, esi
call fcn.00491eed
jmp 0x49075c
cmp ecx, 0xa0
jne 0x49080d
call fcn.00491fdb
jmp 0x49075c
cmp ecx, 0x68
jne 0x49081e
mov ecx, esi
call fcn.00492a48
jmp 0x49075c
cmp ecx, 0x2bf
jne 0x49084f
push str.https:__www.ijinshan.com_privacy_dubaPrivacy.html
lea ecx, [ebp + 8]
call fcn.00406173
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00470c0f
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x49075c
and dword [esi + 0x5b4], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x25814700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x2581470f
pop dword [ebp - 0x40]
mov eax, 0xe5fb4be0
sub eax, 0xc07a04d1
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xdb2e90f4
sub dword [ebp - 0x50], 0x8cdc4ba9
mov dword [ebp - 0x4c], 0x4a543228
add dword [ebp - 0x4c], 0xe7df1a1d
mov dword [ebp - 0x48], 0x52377fd5
sub dword [ebp - 0x48], 0x5eb3ba7
mov dword [ebp - 0x44], 0x9ffae508
add dword [ebp - 0x44], 0x60051af8
lea eax, [ebp - 0x50]
push eax
mov eax, 0x5bc57aea
add eax, 0xc9bc555a
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc635b1c0
sub dword [ebp - 0x50], 0x51c3486a
mov dword [ebp - 0x4c], 0xd0d807c0
sub dword [ebp - 0x4c], 0x8f6ba64b
mov dword [ebp - 0x48], 0xcacc9a2a
add dword [ebp - 0x48], 0x98a2d242
mov dword [ebp - 0x44], 0x14e3add
add dword [ebp - 0x44], 0xfeb1c523
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x295582d0
add eax, 0xfc2c4db0
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x41595
push 0
call eax
mov ecx, 0x8fbd697e
add ecx, 0x7042f1c0
mov edi, eax
mov esi, 0xee6868e1
add esi, 0x371a2d1f
add esi, dword [ebp - 0x40]
mov ebx, 0x351e3bf8
add ebx, 0xd87122de
sub dword [ebp - 0xc], esi
mov edx, dword [esi]
xor dword [ebp - 0x38], edx
sub edx, ebx
xor dword [ebp - 0x14], eax
mov dword [edi], edx
add dword [ebp - 0x2c], 0x53bbdea2
add edi, 0x13e208d2
sub edi, 0x13e208ce
add esi, 4
loop 0x25814831
add eax, 0x3c0d9e29
add eax, 0xc3f3c1a2
xor ebx, ebx
add ebx, eax
add eax, 0x9490dc30
add eax, 0x6b6f23d5
mov ecx, 0x25800000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x404b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x404b33
pop dword [ebp - 0x14]
mov eax, 0xc41f6b4c
add eax, 0x3c20dfe7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x47a0e893
sub dword [ebp - 0x24], 0xf94ea348
mov dword [ebp - 0x20], 0xc33542b8
add dword [ebp - 0x20], 0x6efe098d
mov dword [ebp - 0x1c], 0xb9729796
add dword [ebp - 0x1c], 0x92d9ac98
mov dword [ebp - 0x18], 0x107dd56f
add dword [ebp - 0x18], 0xef822a91
lea eax, [ebp - 0x24]
push eax
mov eax, 0x274bd7bc
add eax, 0xd8f658b8
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x6faf240e
sub dword [ebp - 0x24], 0xfb3cbab8
mov dword [ebp - 0x20], 0x26a79eca
sub dword [ebp - 0x20], 0xe53b3d55
mov dword [ebp - 0x1c], 0xc68da0ab
add dword [ebp - 0x1c], 0x9ce1cbc1
mov dword [ebp - 0x18], 0xbec4f600
sub dword [ebp - 0x18], 0xbec4f600
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x5df7bb84
sub eax, 0x5db58a60
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3f300
push 0
call eax
mov ecx, 0x9080d165
sub ecx, 0x90808389
xor esi, esi
add esi, eax
mov edx, 0xa20d5c83
add edx, 0x5e35e77d
add edx, dword [ebp - 0x14]
mov ebx, 0xdfdc185b
add dword [ebp - 0xc], 0xb8e631ac
mov edi, dword [edx]
add dword [ebp - 0xc], 0x38dfbb84
add edi, ebx
xor dword [ebp - 0xc], esi
mov dword [esi], edi
mov dword [ebp - 4], 0x3f6e1116
add esi, 0x2b78a1d5
add esi, 0xd4875e2f
add edx, 0xd5051bb6
add edx, 0x2afae44e
loop 0x404c51
add eax, 0xda238230
add eax, 0x25dda813
xor ebx, ebx
add ebx, eax
add eax, 0x1c588465
add eax, 0xe3a77ba0
mov ecx, 0xe00feebe
sub ecx, 0xdfcfeebe
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40a60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40a61a
pop dword [ebp - 0x18]
mov eax, 0x41d095ff
sub eax, 0x418fefe5
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x388ad924
add dword [ebp - 0x28], 0x15c76c27
mov dword [ebp - 0x24], 0xa5b5c740
add dword [ebp - 0x24], 0x8c7d8505
mov dword [ebp - 0x20], 0xbad01ad9
sub dword [ebp - 0x20], 0x6e83d6ab
mov dword [ebp - 0x1c], 0xaeac990d
add dword [ebp - 0x1c], 0x515366f3
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd10c997a
add eax, 0x2f3436da
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xb6f2e45b
add dword [ebp - 0x28], 0xbd7f84fb
mov dword [ebp - 0x24], 0x80dfb3b7
add dword [ebp - 0x24], 0xc08cadbe
mov dword [ebp - 0x20], 0x8e030d27
add dword [ebp - 0x20], 0xd56c5f45
mov dword [ebp - 0x1c], 0xa7facc4e
add dword [ebp - 0x1c], 0x580533b2
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x5820f084
add eax, 0xa81fdfc8
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3dec4
push 0
call eax
mov ecx, 0x65b8a181
add ecx, 0x9a47b6b5
mov esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x18]
mov edx, 0x3f672fe9
mov dword [ebp - 8], 0x1d19ef9
mov ebx, dword [edi]
xor dword [ebp - 4], 0x249ebba
xor ebx, edx
xor dword [ebp - 4], 0x4a93c569
mov dword [esi], ebx
xor dword [ebp - 4], 0xa7bf9d2d
add esi, 0xd6b32d80
sub esi, 0xd6b32d7c
add edi, 0x1ef22655
add edi, 0xe10dd9af
loop 0x40a730
add eax, 0x1914d576
add eax, 0xe6ec7e35
mov ebx, eax
add eax, 0xa374af02
add eax, 0x5c8b5103
mov ecx, 0x8796543c
add ecx, 0x78a9abc4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10061430
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100615cc
pushal
mov esi, section.UPX1
lea edi, [esi - 0x41000]
push edi
or ebp, 0xffffffff
jmp 0x1006145a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10061461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10061450
mov eax, 1
add ebx, ebx
jne 0x10061473
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10061484
jne 0x10061494
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10061494
dec eax
add ebx, ebx
jne 0x10061490
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10061468
xor ecx, ecx
sub eax, 3
jb 0x100614ac
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1006151e
sar eax, 1
mov ebp, eax
jmp 0x100614b7
add ebx, ebx
jne 0x100614b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100614c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100614e8
inc ecx
add ebx, ebx
jne 0x100614d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100614c9
jne 0x100614e5
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100614c9
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10061508
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100614f9
jmp 0x10061456
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10061508
add edi, ecx
jmp 0x10061456
pop esi
mov edi, esi
mov ecx, 0x2505
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10061526
cmp byte [edi], 0x13
jne 0x10061526
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x1006152b
lea edi, [esi + 0x5d000]
mov eax, dword [edi]
or eax, eax
je 0x1006159a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x61000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x61050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10061558
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x61054]
or eax, eax
je 0x10061594
mov dword [ebx], eax
add ebx, 4
jmp 0x10061575
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100615cb
cmp al, 0xef
ja 0x100615be
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100615a0
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100615ad
popal
jmp 0x10035608
Function at 0x41b539
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x41b548
pop dword [ebp - 8]
mov eax, 0x41b548
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x512e9
push 0
mov eax, 0x4d44b1a7
sub eax, 0x4cfffef7
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xb5aca55e
add ecx, 0x4a53a6d8
xor edi, edi
add edi, eax
mov esi, 0xba0a0086
sub esi, 0xb9c2a286
add esi, dword [ebp - 8]
mov ebx, 0x895e3b1f
add ebx, 0xc8521a32
xor dword [ebp - 4], 0xfd96ed4
mov edx, dword [esi]
sub dword [ebp - 4], ebx
add edx, ebx
mov dword [edi], edx
add edi, 0xd90f6980
sub edi, 0xd90f697c
add esi, 0xbc0e2db2
sub esi, 0xbc0e2dae
loop 0x41b5a4
add eax, 0xe6643213
add eax, 0x199cf198
mov ebx, eax
add eax, 0x789f5c7f
sub eax, 0x789f5c7a
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x10063c0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10063c1a
pop dword [ebp - 0x18]
mov eax, 0xb3df5303
sub eax, 0xa3d916e9
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x256603b
add dword [ebp - 0x28], 0x4bfbe510
mov dword [ebp - 0x24], 0x85be585d
sub dword [ebp - 0x24], 0x538b0c18
mov dword [ebp - 0x20], 0x6a00eec
sub dword [ebp - 0x20], 0xba53cabe
mov dword [ebp - 0x1c], 0xd0f8f548
add dword [ebp - 0x1c], 0x2f070ab8
lea eax, [ebp - 0x28]
push eax
mov eax, 0xe6e32a78
sub eax, 0xd6dc296c
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xeeb0719b
add dword [ebp - 0x28], 0x85c1f7bb
mov dword [ebp - 0x24], 0xb1d722d
add dword [ebp - 0x24], 0x364eef48
mov dword [ebp - 0x20], 0xfc9c934b
sub dword [ebp - 0x20], 0x992d26df
mov dword [ebp - 0x1c], 0x7bcdf90b
sub dword [ebp - 0x1c], 0x7bcdf90b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x346974d3
add eax, 0xdb9d8b6d
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x67e02
push 0
call eax
mov ecx, 0x5f08396a
sub ecx, 0x5f07ef57
xor ebx, ebx
add ebx, eax
mov edi, 0xdb6b468c
add edi, 0x349d0574
add edi, dword [ebp - 0x18]
mov edx, 0xddef7bf1
add edx, 0xc1339944
sub dword [ebp - 0xc], 0xe885d630
mov esi, dword [edi]
sub dword [ebp - 0xc], eax
xor esi, edx
mov dword [ebx], esi
mov dword [ebp - 4], 0xa6889b25
add ebx, 4
add edi, 0xa4a4210b
add edi, 0x5b5bdef9
loop 0x10063d3e
add eax, 0x90ca1008
sub eax, 0x90c8f4e9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x868ddea9
add ecx, 0x89722157
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40945d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414acc
push 0x414ac4
push str.FlsAlloc
push 0x1e
call fcn.0040939a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409491
push dword [ebp + 8]
mov ecx, esi
call dword [0x413144]
call esi
jmp 0x409497
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4094db
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414adc
push 0x414ad4
push str.FlsGetValue
push 0x20
call fcn.0040939a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409512
push dword [ebp + 8]
mov ecx, esi
call dword [0x413144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x409ddf
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x409e2a
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0040a000
test al, al
jne 0x409e24
sub edx, 2
cmp edx, edi
jne 0x409e0a
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x409e4c
lea eax, [edi + 2]
cmp edx, eax
je 0x409e4c
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00409d2b
add esp, 0x10
jmp 0x409f46
push esi
lea ecx, [ebp - 0x255]
call fcn.0040a000
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409e8f
push dword [ebp - 0x25c]
jmp 0x409e3c
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x409ecc
cmp word [ebp - 0x226], 0
je 0x409eed
cmp word [ebp - 0x226], ax
jne 0x409ecc
cmp word [ebp - 0x224], 0
je 0x409eed
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00409d2b
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x409f39
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x409ea6
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x409f21
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x409f46
push 0x409b5b
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040ed90
add esp, 0x10
jmp 0x409f16
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040133a
leave
ret
Function at 0x408b3a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x408b4b
add byte [ebx], dh
inc ebx
cmp dword [eax + eax*2], edi
push eax
aas
add esp, 4
or ecx, 0x8833
pop ecx
jmp 0x408d56
push esi
push eax
add esp, 4
or esi, 0x4c3c
xor esi, 0x4214
sub esi, 0x7ea9
sub esi, 0x12b13
pop esi
push edi
or edi, 0x16e0d
xor edi, 0x3aaa
sub edi, 0x14714
pop edi
mov dword [ebp - 0x614], 0
push ecx
xor ecx, 0x467f
pop ecx
push eax
push edi
add esp, 4
sub eax, 0x935f
jmp 0x408daa
pop eax
push ecx
push edi
add esp, 4
and ecx, 0x16446
jmp 0x408dbd
sub ecx, 0x13c10
pop ecx
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
mov byte [ebp - 0x490], 0x50
mov byte [ebp - 0x48f], 0x72
mov byte [ebp - 0x48e], 0x6f
mov byte [ebp - 0x48d], 0x63
mov byte [ebp - 0x48c], 0x65
mov byte [ebp - 0x48b], 0x73
mov byte [ebp - 0x48a], 0x73
mov byte [ebp - 0x489], 0
push ebx
sub ebx, 0x6ec1
call 0x408e2b
add byte [eax + 0x44], dl
inc ecx
inc esp
xor dh, byte [edi]
add esp, 4
sub ebx, 0x13aa4
pop ebx
push edx
call 0x408e46
add byte [esi + 0x47], al
cmp al, 0x3c
cmp dh, byte [edi]
dec eax
dec esp
inc esp
cmp eax, 0x5a04c483
mov edx, 0x6b
mov word [ebp - 0xc50], dx
mov eax, 0x65
mov word [ebp - 0xc4e], ax
mov ecx, 0x72
mov word [ebp - 0xc4c], cx
mov edx, 0x6e
mov word [ebp - 0xc4a], dx
mov eax, 0x65
mov word [ebp - 0xc48], ax
mov ecx, 0x6c
mov word [ebp - 0xc46], cx
mov edx, 0x33
mov word [ebp - 0xc44], dx
mov eax, 0x32
mov word [ebp - 0xc42], ax
mov ecx, 0x2e
mov word [ebp - 0xc40], cx
mov edx, 0x64
mov word [ebp - 0xc3e], dx
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push esi
and esi, 0x61ad
add esi, 0xc3b9
pop esi
push eax
push ebx
add esp, 4
add eax, 0x14671
sub eax, 0x13ec5
add eax, 0x175d0
pop eax
push eax
push ecx
add esp, 4
xor eax, 0x737b
pop eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xe2c], edx
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xb54], eax
push ebx
push ebx
add esp, 4
call fcn.00408f50
add byte [eax + 0x3d], cl
xor al, 0x3d
aaa
inc ebp
xor esi, dword [ebx]
inc ebx