joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103b062
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x103b17f
mov esi, dword [ebp + 8]
push str.OleTest.ini
push 4
lea eax, [ebp - 4]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x104dc74
mov dword [esi], 0
push str.DisableDropSource
push edi
call ebx
test eax, eax
je 0x103b0b7
push 0x104c2a0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x103b0b7
or byte [esi], 8
push str.OleTest.ini
lea eax, [ebp - 4]
push 4
push eax
push 0x104dc74
push str.UseDefCursors
push edi
call ebx
test eax, eax
je 0x103b0e9
push 0x104c2a0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x103b0e9
or byte [esi], 0x20
push str.OleTest.ini
lea eax, [ebp - 4]
push 4
push eax
push 0x104dc74
push str.FailSourceQI
push edi
call ebx
test eax, eax
je 0x103b11b
push 0x104c2a0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x103b11b
or byte [esi], 1
push str.OleTest.ini
lea eax, [ebp - 4]
push 4
push eax
push 0x104dc74
push str.FailQueryContinueDrag
push edi
call ebx
test eax, eax
je 0x103b14d
push 0x104c2a0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x103b14d
or byte [esi], 2
push str.OleTest.ini
lea eax, [ebp - 4]
push 4
push eax
push 0x104dc74
push str.FailGiveFeedback
push edi
call ebx
test eax, eax
je 0x103b17f
push 0x104c2a0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x103b17f
or byte [esi], 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x103cabe
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x10566c0]
test eax, eax
je 0x103cad8
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x10566c0], 0
cmp dword [0x1051400], 0
je 0x103cae6
jmp fcn.01015be0
ret
Function at 0x103d76c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x103d7bd
push 0x353
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..gendoc.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call ebx
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call edi
push str.Null_Doc
call edi
push 0x104c08c
call edi
jmp 0x103d7c9
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1056420]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov eax, 0x80000000
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x103d836
cmp eax, 1
je 0x103d83f
cmp eax, 2
je 0x103d848
push 0x36d
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..gendoc.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call ebx
add esp, 0x14
push 0x1056c90
call edi
push str.Illegal_case
call edi
push 0x104c08c
call edi
mov dword [ebp - 0x24], str.CSDocClass
jmp 0x103d84f
mov dword [ebp - 0x24], str.CSDocClass
jmp 0x103d84f
mov dword [ebp - 0x24], str.ClDocClass
jmp 0x103d84f
mov dword [ebp - 0x24], str.SrDocClass
mov eax, 0
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], 1
adc eax, 0xffffffff
push 0
and eax, 0x20000000
push 0x220
push dword [0x1056430]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x103d885
xor eax, eax
jmp 0x103d897
cmp dword [esi + 8], 1
je 0x103d897
mov ecx, dword [esi + 0xa8]
mov dword [ecx + 0x12c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x103dee2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov edi, 0x104e9c8
push edi
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
mov esi, dword [ebp + 0x10]
shr ecx, 2
repe cmpsd dword [esi], dword es:[edi]
jne 0x103df10
mov ecx, eax
and ecx, 3
repe cmpsb byte [esi], byte es:[edi]
je 0x103df56
push 0x619
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..gendoc.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Error_Delimeter_not_correct
call esi
push 0x104c08c
call esi
mov eax, 0x80004005
jmp 0x103df9a
push 0x104e9c8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push esi
add ecx, eax
push ecx
call fcn.0102bad4
mov edi, eax
mov eax, 0x80004005
test edi, edi
je 0x103df9a
push 0x104e9c8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 6
mov ecx, dword [ebp + 0x14]
push ebx
push 4
push 2
mov dword [ecx], eax
push esi
push edi
call fcn.0102cff4
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x103dfa1
Capabilities:
Print debug messages

Disassembly:
push ebp
mov eax, dword [esp + 0x18]
mov ebp, esp
sub esp, 4
mov dword [eax], 0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
call fcn.0102bad4
mov edi, eax
test edi, edi
jne 0x103dfd0
mov eax, 0x80004005
jmp 0x103e076
movzx ebx, word [edi]
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x103e07f
cmp eax, 2
jb 0x103dfed
cmp eax, 3
jbe 0x103e09b
push 0x68d
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..gendoc.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Illegal_case
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push edi
call fcn.0102b16a
mov dword [ebp - 4], eax
test eax, 0x80000000
jne 0x103e073
cmp ebx, 2
jne 0x103e073
mov eax, dword [edi + 0x14]
cmp dword [eax + 0xe0], 0
jne 0x103e073
mov dword [eax + 0xe0], 1
push 1
push esi
call fcn.0103de42
push 1
push 1
push esi
call fcn.010443d3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp ebx, 1
jne 0x103e030
mov eax, dword [edi + 0x14]
push dword [eax + 0x18]
call dword [sym.imp.ole32.dll_OleRun]
test eax, eax
je 0x103e030
mov eax, 0x80004005
jmp 0x103e076
cmp ebx, 1
jne 0x103e030
mov eax, dword [edi + 0x14]
push dword [eax + 0x18]
call dword [sym.imp.ole32.dll_OleIsRunning]
test eax, eax
jne 0x103e030
mov eax, 0x80004005
jmp 0x103e076
Function at 0x103e231
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], esi
je 0x103e2bd
cmp dword [edi + 0xc8], esi
je 0x103e2bd
push dword [edi + 0x110]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x103e277
push esi
push dword [edi + 0x110]
push 0x223
push dword [0x1056430]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x1056430]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x103e299
push 5
mov eax, dword [0x1056430]
push eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
call ebx
jmp 0x103e29f
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [edi + 0x108]
call ebx
push 1
push dword [edi + 0x110]
call ebx
push 1
push 1
push edi
call fcn.0103e430
mov dword [edi + 0xd4], 0
cmp dword [edi + 0xf4], 0
je 0x103e2d7
xor eax, eax
jmp 0x103e357
mov dword [edi + 0xf4], 1
cmp dword [edi + 8], 2
je 0x103e344
test byte [0x1056808], 0x20
jne 0x103e344
cmp dword [edi + 0xcc], 0
jne 0x103e344
lea eax, [edi + 0x1c]
push eax
push dword [edi + 0x108]
call dword [sym.imp.ole32.dll_RegisterDragDrop]
test eax, eax
jne 0x103e319
mov dword [edi + 0xcc], 1
jmp 0x103e344
mov esi, eax
push eax
push dword [edi + 0x108]
push str.HRESULT_not_S_OK_on_RegisterDragDrop_hwnd__x__lX
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x1051400], 0
je 0x103e355
push 1
push edi
call fcn.0103e5ac
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x103e360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x108]
call edi
push 0
push dword [esi + 0x110]
call edi
push 0
push dword [esi + 0x110]
push 0x224
push dword [0x1056430]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
ret 4

Function at 0x103e53a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
push esi
mov eax, dword [eax + 8]
test eax, eax
je 0x103e594
cmp eax, 1
je 0x103e59b
cmp eax, 2
je 0x103e5a2
push 0x88d
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..gendoc.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Illegal_case
call esi
push 0x104c08c
call esi
xor eax, eax
jmp 0x103e5a7
mov eax, dword [0x104ed4c]
jmp 0x103e5a7
mov eax, dword [0x104ed48]
jmp 0x103e5a7
mov eax, dword [0x104ed50]
pop esi
pop ebp
ret 4
Function at 0x104012b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x10517e4], edi
jne 0x1040152
cmp dword [0x104ed60], edi
jne 0x1040152
call fcn.0103cabe
xor eax, eax
jmp 0x1040244
push str.RevokeServers__
call fcn.01033bb1
cmp dword [0x10517ec], 0
je 0x104016c
xor eax, eax
jmp 0x1040244
mov eax, dword [ebp + 8]
mov dword [0x10517ec], 1
lea esi, [eax + 4]
cmp dword [esi], 0
jne 0x104018d
call fcn.0103cabe
xor eax, eax
jmp 0x1040244
push 0
push eax
call fcn.010403d6
mov dword [ebp - 4], 1
cmp dword [0x104d850], 1
jl 0x1040242
mov eax, dword [esi]
cmp dword [eax + 0xc8], 0
mov ebx, dword [eax + 0xc]
je 0x1040214
push eax
call fcn.01042cb6
mov eax, dword [esi]
push dword [eax + 0x24]
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
test eax, 0x80000000
mov edi, eax
je 0x1040214
push 0xfa
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._srvr.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Error_in_CoRevokeClassObject
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test ebx, ebx
je 0x104022d
push 0
push dword [esi]
call fcn.01042bd0
push 1
push dword [esi]
call fcn.0104031a
dec ebx
jne 0x1040218
add esi, 4
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [0x104d850], eax
jge 0x10401a9
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10419ea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc4]
cmp eax, 1
je 0x1041ac5
cmp eax, 2
je 0x1041ac5
cmp eax, 5
je 0x1041a7c
cmp eax, 4
je 0x1041a7c
push 0x84
lea eax, [ebp - 0x84]
push eax
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x1054c8c
push 0x10017d8
push esi
call fcn.0103da0a
test eax, eax
je 0x1041a4c
xor eax, eax
jmp 0x1041ad4
push 1
mov eax, dword [0x1054c8c]
mov esi, dword [eax]
push 0
push eax
call dword [esi + 0x18]
test eax, 0x80000000
jne 0x1041a6f
push 0
mov eax, dword [0x1054c8c]
push eax
mov esi, dword [eax]
call dword [esi + 0x1c]
mov eax, dword [0x1054c8c]
push eax
mov esi, dword [eax]
call dword [esi + 8]
jmp 0x1041acf
push 1
push esi
call fcn.0103d8a0
mov esi, eax
test esi, esi
je 0x1041acf
push 0x55
mov eax, dword [0x1056d98]
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..genfile.c
push eax
push dword [0x104ed80]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.SendDocChangeMsg__..__OTNOTIF_SAVE_OBJECT__:
push dword [0x104ed80]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x104ed80]
push esi
call fcn.0102e6d7
jmp 0x1041acf
push 1
push 1
push esi
call fcn.01041adb
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1041fa4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 7
xor esi, esi
cmp dword [ebx + 0xfc], esi
je 0x1042055
mov eax, 2
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
push ecx
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], 5
mov dword [ebp - 0xc], esi
call fcn.010421cb
push 0x84
lea ecx, [ebp - 0xb0]
push ecx
mov dword [ebp - 8], eax
push dword [ebx + 0x110]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0xb0]
push ecx
push str.Do_you_want_to_Save__s_
push dword [0x1056b60]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x23
push str.Cl32Test___ansi
push dword [0x1056b60]
push dword [0x10566c0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, eax
cmp dword [ebp - 8], esi
jne 0x1042055
push dword [ebp - 4]
call fcn.01042274
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1042cf6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [0x104f348], 0
je 0x1042d59
mov ecx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x80]
cmp dword [ecx + 8], 1
push eax
je 0x1042d22
push dword [ecx + 0x110]
jmp 0x1042d28
push dword [ecx + 0x108]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x80]
push eax
push 0
push 0x185
call fcn.01037e52
push eax
push dword [0x10567a0]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [0x10567a0]
call fcn.01033bb1
mov esp, ebp
pop ebp
ret 4
Function at 0x1046110
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10016a0
push 0x104742c
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1056dcc], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [0x1056dd0], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x105266c], eax
mov dword [0x105267c], eax
xor eax, eax
mov al, byte [0x105266d]
mov dword [0x1052678], eax
mov eax, dword [0x105266c]
and eax, 0xff
mov ecx, dword [0x105266c]
shr ecx, 0x10
mov dword [0x1052674], eax
shl eax, 8
mov dword [0x105266c], ecx
add eax, dword [0x1052678]
mov dword [0x1052688], ecx
mov dword [0x1052670], eax
mov eax, ecx
and eax, 0xff
mov cl, ch
and ecx, 0xff
mov dword [0x1052690], eax
and dword [0x105267c], 0xffff
mov eax, dword [0x105267c]
mov dword [0x105268c], ecx
and eax, 0xff
mov dword [0x1052680], eax
xor eax, eax
mov al, byte [0x105267d]
mov dword [0x1052684], eax
call fcn.01047415
call fcn.01047351
test eax, eax
jne 0x10461f1
push 0x10
call fcn.010462be
add esp, 4
call fcn.01047258
call fcn.01046ffe
call fcn.01046f37
call fcn.01046c31
mov dword [ebp - 4], 0
mov esi, dword [0x1056dcc]
mov al, byte [esi]
cmp al, 0x22
jne 0x104622e
mov al, byte [ebp - 0x28]
inc esi
mov al, byte [esi]
test al, al
je 0x1046226
cmp al, 0x22
jne 0x104621b
cmp byte [esi], 0x22
jne 0x1046238
inc esi
jmp 0x1046238
cmp al, 0x20
jbe 0x1046238
inc esi
cmp byte [esi], 0x20
ja 0x1046232
cmp byte [esi], 0
je 0x1046248
cmp byte [esi], 0x20
ja 0x1046248
inc esi
cmp byte [esi], 0
jne 0x104623d
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x1046268
movzx eax, word [ebp - 0x40]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.01046c61
jmp 0x10462a4
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1046c83
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.01046d04
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov byte [0x10526a8], bl
jne 0x1046cda
cmp dword [0x1056dc4], 0
je 0x1046cc8
mov esi, dword [0x1056dc0]
sub esi, 4
cmp esi, dword [0x1056dc4]
jb 0x1046cc8
mov eax, dword [esi]
test eax, eax
je 0x1046cbd
call eax
sub esi, 4
cmp esi, dword [0x1056dc4]
jae 0x1046cb5
push 0x1001018
push 0x1001014
call fcn.01046d1a
add esp, 8
push 0x1001020
push 0x100101c
call fcn.01046d1a
add esp, 8
test ebx, ebx
je 0x1046cf7
call fcn.01046d0f
jmp 0x1046d01
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret
Function at 0x1047351
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.01047a8c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1052d38], eax
cmp eax, 0xffffffff
je 0x10473ae
push 0x50
push 1
call fcn.01047fcb
add esp, 8
mov esi, eax
test esi, esi
je 0x10473ae
push esi
mov eax, dword [0x1052d38]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10473ae
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x44], 0x10526b0
mov dword [esi + 0x14], 1
jmp 0x10473b0
xor eax, eax
pop esi
ret

Function at 0x10473b2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x1052d38]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1047411
push 0x50
push 1
call fcn.01047fcb
add esp, 8
mov esi, eax
test esi, esi
je 0x1047407
push esi
mov eax, dword [0x1052d38]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1047407
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], 1
mov dword [esi + 0x44], 0x10526b0
jmp 0x1047411
push 0x10
call fcn.010462be
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x104751b
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 4
xor eax, eax
mov ecx, 0x1052d40
push edi
cmp dword [ecx], edx
je 0x104753a
add ecx, 8
inc eax
cmp ecx, 0x1052db8
jb 0x104752a
shl eax, 3
cmp dword [eax + 0x1052d40], edx
jne 0x104756e
mov edx, dword [eax + 0x1052d44]
push 0
lea eax, [esp + 8]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, dword [0x1052840]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
add esp, 4
ret
Function at 0x419b00
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x68eb1b01
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x18cd5949
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x401222
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov cl, byte [0x404050]
mov edx, eax
mov ebx, eax
shl edx, cl
mov eax, 0x404054
add edx, dword [0x404050]
call fcn.00401163
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x4032ed
push eax
sub edi, fcn.00402a87
push edi
push fcn.00402a87
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401299
mov eax, fcn.00402a87
mov ebx, esi
mov edx, edi
call fcn.00401163
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00401932
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
call fcn.00402461
lea eax, [esi + 0x1c000]
lea edi, [esi + 1]
imul edi, eax
mov ebx, 0x404054
or bl, 1
xor edx, edx
mov eax, esi
div ebx
lea ebx, [ebp - 2]
add eax, 0x404054
mov edx, edi
call fcn.00402a87
lea esp, [ebp + 0x82]
pop ebp