joyce8/EMBER2024-capa huggingface dataset:
Function at 0x628d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x628d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x628d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x628d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x628d94
push eax
push esi
call fcn.0062b20b
add esp, 8
pop esi
ret 0x10

Function at 0x628da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x628e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x628e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x641320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0062adff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x628dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x628e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x628ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x628eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x641320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0062adff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x628eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x628e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x629000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x629131
push esi
call fcn.0062c145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0061b080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x629131
push 0
push ebp
call fcn.0061b3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0061b260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x62908b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0061b2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x629121
push 0x641918
push edi
call fcn.0062a3f0
push eax
push ebx
push esi
call fcn.00628f60
push 0x6418f8
push edi
call fcn.0062a3f0
push eax
push ebx
push esi
call fcn.00628f60
push 0x6418d8
push edi
call fcn.0062a3f0
push eax
push ebx
push esi
call fcn.00628f60
push 0x6418c0
push edi
call fcn.0062a3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00628f60
push 0x6418a0
push edi
call fcn.0062a3f0
push eax
push ebx
push esi
call fcn.00628f60
push 0x641888
push edi
call fcn.0062a3f0
push eax
push ebx
push esi
call fcn.00628f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x62a1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0062a140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0062a140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0062a140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0062a140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x62abfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x62ac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x63c87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x62ac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x62ac52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a9000
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x54]
push edi
mov ebp, 1
test ecx, 0x8000000
je 0x1e7a9059
mov ebx, dword [esp + 0x18]
push ebx
mov eax, esi
call fcn.1e7a8f60
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x1e7a910f
test ebx, ebx
invalid
test eax, eax
add byte [eax], al

Function at 0x1e7a9480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx + 0x458df845]
xchg esp, eax
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
xor eax, esi
inc ebp
wait
xor eax, 0x349c45c6

Function at 0x1e7a94a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, esi
inc ebp
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
invalid
inc ebp
invalid
Function at 0x1e7a9500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1e7a9565
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a90da
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a908f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a90ca
and al, 0x7f
movsb byte es:[edi], byte [esi]
adc dword [eax - 0x8363], ecx
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1e7a90ca
bound esp, qword [edx + 0x25]
lea eax, [ebp - 0x84]
push eax
call fcn.1e7a90da
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a908f
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1e7a98c3
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.1e7a903b
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1e7a963a
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
cmp bh, 0x74
rcl dword [eax], 0x8d
add al, 0xc1
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1e7a903b
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1e7a9607
call fcn.1e7a90ca
popal
out dx, al
enter 0xffffffffffff8b64, 0x7e
cmp al, 3
dec byte [ecx - 0x8743]
dec dword [ebx + 0x8087]
add byte [eax], 0

Function at 0x1e7a9760
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1e7a977e
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1e7a9779
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1e7a9763
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
adc ebx, ebp
invalid
adc ebx, ebp
or byte [ebx], bh
ror dword [edi], cl
test dword [esi + 1], ecx
add byte [eax], al
cmp edx, ebx
jne 0x1e7a98b9
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a973a
add eax, dword [eax + 4]
jmp 0x1e7a9727
mov dword [ebp + 0xc], ebx
jmp 0x1e7a9789
Function at 0x1e7a97b0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a97a1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a97bf
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a981d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
add byte [eax], ah
add byte [eax], ah
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a9804
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a980d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a9817
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a97f9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a9783
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a986a
dec eax
je 0x1e7a9861
sub eax, 3
je 0x1e7a9858
mov dword [ebp - 4], 0x40
jmp 0x1e7a9887
mov dword [ebp - 4], 4
jmp 0x1e7a986d
mov dword [ebp - 4], 0x20
jmp 0x1e7a986d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a98b9
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a9839
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a90ca
sub dword [ebp + 0x1475ff9e], eax
push 1
push esi
call edi
mov eax, esi
jmp 0x1e7a98c5
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1e7a97f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a97a1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a97bf
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a981d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
add byte [eax], ah
add byte [eax], ah
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a9804
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a980d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a9817
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a97f9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a9783
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a986a
dec eax
je 0x1e7a9861
sub eax, 3
je 0x1e7a9858
mov dword [ebp - 4], 0x40
jmp 0x1e7a9887
mov dword [ebp - 4], 4
jmp 0x1e7a986d
mov dword [ebp - 4], 0x20
jmp 0x1e7a986d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a98b9
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a9839
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a90ca
sub dword [ebp + 0x1475ff9e], eax
push 1
push esi
call edi
mov eax, esi
jmp 0x1e7a98c5
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1e7a9fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a90a8
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
invalid
Function at 0x1e7aa520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1e7a90ca
in al, dx
sbb dword [esi - 0x32], esp
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
invalid
movsd dword es:[edi], dword [esi]

Function at 0x1e7aa560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ecx
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
invalid
pop ss

Function at 0x1e7ab3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x1e7ab3dc
cmp dword [esi + 4], edi
je 0x1e7ab3dc
mov ecx, dword [esi]
push ecx
call dword [sym.imp.python27.dll_PyThreadState_Delete]
mov edx, dword [0x1e7ba8b8]
add esp, 4
push edi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError]
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], edi
cmp eax, edi
je 0x1e7ab402
dec dword [eax]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError]
cmp dword [eax], edi
jne 0x1e7ab402
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x18]
push eax
call edx
add esp, 4
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError]
mov dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError], edi
cmp eax, edi
je 0x1e7ab428
dec dword [eax]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError]
cmp dword [eax], edi
jne 0x1e7ab428
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x18]
push eax
call edx
add esp, 4
mov dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError], edi
pop edi
pop esi
ret
Function at 0x4022f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x34], edx
mov dword [ebp - 8], 0
jmp 0x40236d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx + 0x18]
jae 0x4023da
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x30]
push edx
call fcn.004021f0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004086e0
add esp, 8
test eax, eax
jne 0x4023d8
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x34]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x4023dc
jmp 0x402364
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403d95
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403dd4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403dd4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403dd4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403dd4
cmp dword [ecx + 0x74], 0xe
jbe 0x403dd4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40c62c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4185d8
push 0x4185d0
push str.FlsAlloc
push 0x1f
call fcn.0040c548
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c660
push dword [ebp + 8]
mov ecx, esi
call dword [0x416124]
call esi
jmp 0x40c666
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40c6aa
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4185e8
push 0x4185e0
push str.FlsGetValue
push 0x21
call fcn.0040c548
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c6e1
push dword [ebp + 8]
mov ecx, esi
call dword [0x416124]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40c6e9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4185f0
push 0x4185e8
push str.FlsSetValue
push 0x22
call fcn.0040c548
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c723
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416124]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40dd19
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40ddb6
push ebx
push esi
call fcn.0040dce2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040dc76
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40dd63
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ddb5
push edi
push eax
call fcn.0040a5fe
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40dd83
call fcn.0040a5c4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ddb4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040dc76
add esp, 0x20
test eax, eax
jne 0x40dda2
push edi
call fcn.0040a5c4
jmp 0x40ddaa
push ebx
call fcn.0040a5c4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x414d10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414d3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414d3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x4cab4e46
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x220404fb
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219