joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1026cf48
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1026cf62
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1026e4c3]
mov dh, byte [eax + 0x1026e494]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1026cf62
lea eax, [ebp - 0x24]
mov dword [0x102b8598], 0x1372
mov dword [ebp - 0x34], eax
call fcn.1026d649
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1026c385
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1026d076
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x102b8598]
add ecx, 0xffffdbc9
mov dword [0x102b8598], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1026c535
xor eax, eax
mov ecx, dword [0x102b8598]
add ecx, 0xffffe005
mov dword [0x102b859c], ecx
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], ecx
mov dword [0x102b8598], 0x19c4
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x38], ecx
add ecx, 0x1af2
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1026d06d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1026d198
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x102b85a0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [0x102b85a4], 0
mov dword [0x102b85b0], 0
mov ecx, dword [0x102b859c]
add ecx, 0xfffff338
mov dword [0x102b8598], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
je 0x1026d31b
jmp 0x1026d220
mov eax, dword [0x102b85a0]
mov ecx, dword [0x102b85a4]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x102b8598], 0x20d1
mov dword [0x102b859c], 0x7e7
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102b85a0], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x102b85a4], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x102b85a8], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x102b85a8]
mov edx, dword [0x102b85a4]
mov byte [edi + edx], cl
mov dword [0x102b859c], 0x2664
mov edx, dword [0x102b85a0]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102b85a4]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x102b85b0], ebx
mov dword [0x102b8598], 0x1fb1
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov byte [0x102b85b5], ch
mov byte [0x102b85b6], cl
xor ch, cl
mov byte [0x102b85b4], ch
mov dword [0x102b8598], 0x251f
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov dword [0x102b859c], 0x13d3
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x2c], ebx
jne 0x1026d209
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1026d457
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x102b8598], 0x1f19
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1026c7f2
lea ecx, [0x1026cdc3]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 0x11c400
mov edx, dword [0x102b8584]
mov dword [esp + 0x7c], edx
mov edx, dword [0x102b8588]
mov dword [esp + 0x5c], edx
mov edx, dword [0x102b858c]
mov dword [esp + 0x30], edx
mov edx, dword [0x102b8590]
mov dword [esp + 0x78], edx
mov edx, dword [0x102b8594]
mov dword [esp + 0x84], edx
mov dword [0x102b859c], 0x4bf
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1026d539
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1026d54d
jmp 0x1026d539
mov dword [0x102b859c], 0x341
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1026cf48
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 8], eax
jmp 0x1026d57d
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1026d4de
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [0x102b859c], 0xe73
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x64], edx
call fcn.1026ce0a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x1026d503
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x30031521
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x30053c20]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call fcn.300281b3
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.300123d7
leave
ret

Function at 0x300bbb54
Capabilities:
Encode data using xor

Disassembly:
jg 0x300bbbbf
or eax, 0x9a7716e4
push 0x5b7bc56d
out dx, eax
dec edx
mov dh, 0x3f
mov esp, 0x635e53b9
in al, 0x2c
push eax
jnp 0x300bbbdf
mov ecx, 0x7a160f66
jne 0x300bbb76
invalid
inc esp
sbb eax, 0xcf7f4d96
or edi, edi
stosd dword es:[edi], eax
sub al, 0x81
inc ebx
pushfd
out 0x7b, eax
xchg ebx, eax
invalid
mov ecx, 0xf87893ca
test eax, 0xf7dc6863
inc ebx
add dword [ecx - 0x3ad34f33], edi
sub al, 0xc5
cmp eax, 0x6dc1af0d
xor al, 0x51
ja 0x300bbba6
out 0xec, al
in al, dx
mov ecx, 0x66757289
dec esp
xchg ebp, eax
xlatb
sub eax, 0xca805a2c
add byte [esi], al
in al, dx
pushal
jbe 0x300bbbe2
push eax
jnp 0x300bbc4f
aaa
inc ebx
mov dword [eax], esi
loopne 0x300bbbb5
jae 0x300bbbff
std
pop ecx
jmp [eax - 0x381f8357]
out dx, al
invalid
invalid
wait
les esp, [eax - 0x4bd7787]
inc edx
sub dword [eax + edx*8 + 0x60], eax
inc esp
shl byte [eax + 7], 1
pop es
or ah, byte [ebp - 8]
pop esp
sub eax, 0xa56af470
ror dword [esi - 0xf00c3dd], 0x7b
push ss
or esi, dword [ecx + 0x2d]
inc esp
xor dword [esi + 0x3b], edi
mov fs, word [ebx]
cmp al, 0xff
invalid
sub eax, 0x3b7e3144
jno 0x300bbc5d
dec eax
sti
xchg esi, eax
mov ebx, 0x7df0ebe1
cmp edi, 0x771129f2
push cs
wait
cmp bh, dh
add ebx, dword [edx + 0x31]
mov dh, 0x93
loope 0x300bbc66
je 0x300bbc09
and byte [eax], cl
bound ebx, qword [ebp + 0xae442db]
jbe 0x300bbc46
fcomi st(7)
jbe 0x300bbc52
fisttp dword [ebp - 0x5b8e8f4a]
adc byte [0x4622478c], dh
mov word [ebp - 0x79f04b74], fs
cmp dword [ecx - 0x96], 0x17af7bf0
xor ah, byte [ebx - 0x62]
dec eax
invalid
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x136013bb
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7c565d90
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4024a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x124]
mov ecx, eax
lea eax, [ebp - 0x13c]
mov edx, eax
mov eax, 1
call fcn.00404c90
call fcn.00404d90
push eax
test eax, eax
jne 0x402685
mov eax, dword [ebp - 4]
test eax, eax
je 0x402504
jmp 0x40252c
push 0x105
lea eax, [ebp - 0x118]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x118]
lea eax, [ebp - 8]
call fcn.00405550
jmp 0x402685
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402850
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
call fcn.004028b0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x402559
jmp 0x40255b
jmp 0x402572
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, 0
jl 0x402572
jmp 0x402568
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x402572
jmp 0x402534
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.00404dc0
mov dword [ebp - 0x144], 0
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x10]
mov esi, 1
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.00404dc0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x10]
call fcn.00405590
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov ecx, ebx
mov edx, esi
call fcn.004055f0
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
call fcn.004056b0
lea edx, [ebp - 8]
mov eax, edx
call fcn.00404dc0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4025fd
mov eax, dword [eax - 4]
cmp eax, 2
jge 0x402607
jmp 0x402685
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x22
je 0x402612
jmp 0x402685
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40261f
mov eax, dword [eax - 4]
mov al, byte [edx + eax - 1]
cmp al, 0x22
je 0x402629
jmp 0x402685
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.00404dc0
mov dword [ebp - 0x148], 0
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40264a
mov ecx, dword [ecx - 4]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.004055f0
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
call fcn.004056b0
lea edx, [ebp - 8]
mov eax, edx
call fcn.00404dc0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 8], eax
call fcn.00404e90
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.00404dc0
mov dword [ebp - 0x148], 0
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.00404dc0
mov dword [ebp - 0x144], 0
pop eax
test eax, eax
je 0x4026cf
mov edx, str._t_nAnsiString
lea eax, [ebp - 8]
call fcn.00405120
call fcn.00404f20
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
leave
ret
Function at 0x4156e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x4156fe
jmp 0x415707
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x415718
jmp 0x415721
mov eax, dword [ebp - 4]
or eax, 8
mov dword [ebp - 4], eax
push 0x12
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x415732
jmp 0x41573b
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x1014cf20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
cmp dword [0x101de200], 0
je 0x1014cf73
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1014cf61
mov edx, dword [eax + 0x24]
xor ecx, ecx
test edx, edx
je 0x1014cf59
mov esi, dword [ebp + 8]
cmp dword [eax + 0x20], esi
jbe 0x1014cf59
mov ecx, dword [edx + esi*4]
mov eax, ecx
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1014cf45
call fcn.100745f0
jmp 0x1014cf30

Function at 0x1014dad1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1014dae0
pop dword [ebp - 0x38]
mov eax, 0x9a119bc7
add eax, 0x76033f19
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd519e780
sub dword [ebp - 0x48], 0x86c7a235
mov dword [ebp - 0x44], 0xe305188b
add dword [ebp - 0x44], 0x4f2e33ba
mov dword [ebp - 0x40], 0x75cc16fa
add dword [ebp - 0x40], 0xd6802d34
mov dword [ebp - 0x3c], 0x6c5b3fe
sub dword [ebp - 0x3c], 0x6c5b3fe
lea eax, [ebp - 0x48]
push eax
mov eax, 0x1b1292b3
add eax, 0xf50afe49
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9199b40e
add dword [ebp - 0x48], 0xe2d8b548
mov dword [ebp - 0x44], 0xa53b4ad8
sub dword [ebp - 0x44], 0x63cee963
mov dword [ebp - 0x40], 0xf977939f
sub dword [ebp - 0x40], 0x96082733
mov dword [ebp - 0x3c], 0x847a1f3a
sub dword [ebp - 0x3c], 0x847a1f3a
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36256
push 0
call eax
mov ecx, 0x46ad
mov esi, eax
mov edi, 0x101f2e00
add edi, dword [ebp - 0x38]
mov ebx, 0x5730f82c
mov edx, dword [edi]
xor dword [ebp - 0xc], esi
sub edx, ebx
sub dword [ebp - 0xc], edx
mov dword [esi], edx
sub dword [ebp - 0x2c], eax
add esi, 0x26dfa0a0
sub esi, 0x26dfa09c
add edi, 0xa50058d4
add edi, 0x5affa730
loop 0x1014dbeb
add eax, 0x10d87
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xed2a6f71
sub ecx, 0xdd2a6f71
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1014eb00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 8]
mov byte [ecx + 0x10], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push edx
push edx
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ecx
call fcn.1001a670
add esp, 0x1c
test ebx, ebx
jne 0x1014eb41
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push esi
call fcn.1001a670
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1014f350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014f360
Function at 0x1014f360
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 8], eax
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov esi, dword [esi + 0x1c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret

Function at 0x1015c720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
mov ecx, edx
call fcn.1000e2e0
cmp eax, 0x10
je 0x1015c837
mov esi, eax
test eax, eax
jne 0x1015c83e
xor esi, esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x110]
test eax, eax
jne 0x1015c83e
mov eax, dword [edi + 0x74]
cmp byte [eax + 8], 0
je 0x1015c7e0
movzx ecx, word [eax + 0x18]
add dword [ebp - 0x14], ecx
adc dword [ebp - 0x10], 0
movsx ecx, byte [edi + 0x44]
test ecx, ecx
je 0x1015c848
mov word [edi + 0x32], 0
and byte [edi + 1], 0xf9
movzx edx, word [edi + ecx*2 + 0x46]
mov word [edi + 0x46], dx
dec cl
mov byte [edi + 0x44], cl
movsx ecx, cl
mov ecx, dword [edi + ecx*4 + 0x78]
mov dword [edi + 0x74], ecx
mov ecx, dword [eax + 0x48]
call fcn.1014e440
movzx ecx, word [edi + 0x46]
mov eax, dword [edi + 0x74]
cmp cx, word [eax + 0x18]
jae 0x1015c780
inc ecx
mov word [edi + 0x46], cx
movzx ecx, word [edi + 0x46]
cmp cx, word [eax + 0x18]
jne 0x1015c7f3
mov ecx, dword [eax + 0x38]
movzx eax, byte [eax + 9]
add eax, ecx
add eax, 8
jmp 0x1015c818
cmp byte [eax + 2], 0
jne 0x1015c7c8
movzx ecx, word [eax + 0x18]
add dword [ebp - 0x14], ecx
adc dword [ebp - 0x10], 0
jmp 0x1015c7c8
mov dword [ebp - 0x1c], ebx
movzx ebx, word [eax + 0x1a]
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 0x40]
movzx eax, word [eax + ecx*2]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__byteswap_ushort
add esp, 4
and eax, ebx
mov ebx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
push dword [eax]
call sub.api_ms_win_crt_utility_l1_1_0.dll__byteswap_ulong
add esp, 4
mov ecx, edi
mov edx, eax
call fcn.1014e4c0
test eax, eax
je 0x1015c75b
mov esi, eax
jmp 0x1015c83e
xor esi, esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov ecx, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1000e2e0
Function at 0x100125e5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10012624
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10012624
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10012624
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10012624
cmp dword [ecx + 0x74], 0xe
jbe 0x10012624
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001533a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100153d7
push ebx
push esi
call fcn.10015303
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10015297
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10015384
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100153d6
push edi
push eax
call fcn.100162f5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100153a4
call fcn.10013e61
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100153d5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10015297
add esp, 0x20
test eax, eax
jne 0x100153c3
push edi
call fcn.10013e61
jmp 0x100153cb
push ebx
call fcn.10013e61
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10015644
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001d348
push 0x1001d340
push str.FlsAlloc
push 0x1f
call fcn.10015560
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015678
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b150]
call esi
jmp 0x1001567e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100156c2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001d358
push 0x1001d350
push str.FlsGetValue
push 0x21
call fcn.10015560
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100156f9
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10015701
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001d360
push 0x1001d358
push str.FlsSetValue
push 0x22
call fcn.10015560
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001573b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001b150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001ac60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ac8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ac8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219