joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012e9e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10012edc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.100182ab
mov dword [eax], 0x2887cf2e
jmp 0x10013061
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffff
jb 0x10012f14
mov dword [ebp - 0x18], 1
jmp 0x10012f18
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
jge 0x10012f52
xor eax, eax
inc eax
je 0x10012f38
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10012f38
mov dword [ebp - 0x1c], 1
jmp 0x10012f3c
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
add eax, dword [ecx]
jne 0x10012f52
and dword [ebp - 0x20], 0
jmp 0x10012f59
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0xffff
ja 0x10012f6b
mov dword [ebp - 0x24], 1
jmp 0x10012f6f
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x24], eax
je 0x10012f82
mov dword [ebp - 0x28], 1
jmp 0x10012f86
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
add eax, 0xa
cmp eax, 0xfffffff8
ja 0x10012fed
mov dword [ebp - 0x64], 0xfffffffd
mov dword [ebp - 0x68], 0x348f4a8f
mov dword [ebp - 0x2c], 0x29ef
mov dword [ebp - 0xc], 0
jmp 0x10012fb6
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x10012fc9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x70], 7
jmp 0x10012faf
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10012fe4
push 0x138b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
jmp 0x10013061
mov dword [ebp - 0x10], 0x2b8e
mov dword [ebp - 0x14], 0xb8eb
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
je 0x10013013
mov dword [ebp - 0x54], 1
jmp 0x10013017
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
jge 0x1001302a
mov dword [ebp - 0x5c], 1
jmp 0x1001302e
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x10013042
mov dword [ebp - 0x30], 1
jmp 0x10013046
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x30], 0
jne 0x10013055
mov dword [ebp - 0x34], 1
jmp 0x10013059
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001f42d
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f453
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f451
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1001f49e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001f481
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1001f49e
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.100182ab
mov dword [eax], 0xf3a4b440
jmp 0x1001f476
mov esp, ebp
pop ebp
ret
Function at 0x1002cb97
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002cbf2
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002cbd3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002cbf0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100182ab
mov dword [eax], 0xa8c6
jmp 0x1002cbc8
jmp 0x1002cc01
push 0x138b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esp, ebp
pop ebp
ret
Function at 0x10031810
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 1
push 0x7c2
lea eax, [ebp - 0x10]
push eax
call fcn.1003167a
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10031845
xor eax, eax
jmp 0x10031967
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10031863
xor eax, eax
jmp 0x10031967
lea eax, [ebp - 0xc]
push eax
push 0x3776
push 1
push dword [ebp - 8]
call fcn.10031356
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x10031886
xor eax, eax
jmp 0x10031967
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x4c09
push dword [ebp - 0x10]
push 1
push 0x13e3
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.100314fe
add esp, 0x20
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.100316c7
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x100318e7
lea eax, [ebp - 0x14]
push eax
push 0x564b
push 1
lea eax, [ebp - 4]
push eax
call fcn.10031720
add esp, 0x10
push dword [ebp - 4]
call fcn.1003124b
pop ecx
test eax, eax
jne 0x100318f8
xor eax, eax
jmp 0x10031967
push dword [ebp - 4]
push 1
call fcn.100297f0
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1003194f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10031923
xor eax, eax
jmp 0x10031967
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1003193c
xor eax, eax
jmp 0x10031967
lea eax, [ebp - 4]
push eax
push 1
push 0x6c8a
call fcn.100317a9
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10031960
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10031964
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004ae13
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004ae5e
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
shl eax, 2
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [eax + 0x20], ecx
jmp 0x1004ae77
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004ae77
push 0x89e
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret

Function at 0x1004b034
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004b069
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax + 0xc], ecx
jmp 0x1004b0a7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004b0a7
push 0
push 0x24e7
push 0x2256
push 0x1f01
push 0x1be3
push 0x1ecd
push 0x215f
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret
Function at 0x100806a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008b330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10072c34
mov dword [ebp - 0x14], eax
cmp dword [0x11187ddc], esi
jne 0x10080798
push 0x800
push esi
push 0x10007bdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10080725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10080878
push esi
push esi
push 0x10007bdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10080878
push 0x10007bf4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10080878
push eax
call ebx
push 0x10007c00
push edi
mov dword [0x11187ddc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c10
push edi
mov dword [0x11187de0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c24
push edi
mov dword [0x11187de4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11187dec], eax
test eax, eax
je 0x10080795
push 0x10007c40
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11187de8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100807bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100807b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100807d2
push 4
pop eax
jmp 0x1008087a
cmp dword [ebp - 0x14], esi
je 0x100807d2
push dword [0x11187ddc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100807b7
mov eax, dword [0x11187de8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10080830
cmp dword [0x11187dec], edi
je 0x10080830
push eax
call ebx
push dword [0x11187dec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10080830
test eax, eax
je 0x10080830
call ecx
test eax, eax
je 0x10080825
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10080825
test byte [ebp - 8], 1
jne 0x10080830
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10080860
mov eax, dword [0x11187de0]
cmp eax, edi
je 0x1008085d
push eax
call ebx
test eax, eax
je 0x1008085d
call eax
mov esi, eax
test esi, esi
je 0x1008085d
mov eax, dword [0x11187de4]
cmp eax, edi
je 0x1008085d
push eax
call ebx
test eax, eax
je 0x1008085d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x11187ddc]
call ebx
test eax, eax
je 0x10080878
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1008087a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x1006570
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.01003240
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006605
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1009b30]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x1006605
cmp eax, 1
je 0x100661d
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006605
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x10065da
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x1006601
xor eax, eax
inc eax
jmp 0x1006639
cmp esi, ebx
jae 0x1006609
xor eax, eax
jmp 0x1006639
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1009b30]
jmp 0x100661f
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001430
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
push esp
leave
mov eax, dword [0x4b77081a]
lodsb al, byte [esi]
pop ebx
xor dword [ebx], 0x7a741ec
xchg edx, eax
xor esp, dword [edx - 0x425b3308]
xchg esp, ebp
stc
push 0x7bb16a52
salc
xchg esp, eax
out 0x1e, eax
push 0xffffffffffffffac
cmc
stc
fdiv dword [eax + edi*8 - 0x34]
mov esp, dword [eax - 0x3d0b2e4b]
mov bh, byte [esi + 0x73]
mov edi, 0x50506608
or al, 0xe0
push ecx
and dword [ebp + ebp*4 + 0x78], edx
lodsb al, byte [esi]
loop 0x100014d3
sub al, 0xdf
retf 0xa64a
loope 0x100014db
cmpsd dword [esi], dword es:[edi]
xlatb
adc bl, dh
invalid
jge 0x10001512
cdq
ja 0x100014e3
jb 0x100014bd
imul ebp, dword [eax - 0x196b78d5], 0xffffffc9
leave
idiv byte [edx - 0xe32f31d]
loopne 0x100014c5
jmp 0xe22b2caf
iretd
add al, 0xb7
pop edi
pop ebx
push edi
ljmp 0x527b
push es
xor byte [ebx + eax*4 + 0x11], 0x83
xchg ebp, eax
imul edi, eax, 0xc201a6cb
or dword [ebx + 0x281c268d], esp
scasd eax, dword es:[edi]
stc
dec ecx
xchg ecx, eax
sub bl, al
push esi
mov dl, 0xd6
jnp 0x10001592
push ebx
sbb dword [0xb0eea78], 0xaeca1026
scasb al, byte es:[edi]
jle 0x1000159f
and ch, ah
mov dword [0xc6b95738], eax
mov eax, dword [0xc7e4e1d6]
xchg dword [ebx + ebx*2 - 0x767eb252], ecx
mov edi, dword [0xfbaaa5d9]
inc edi
mov esp, ecx
mov dword [0x476a79f7], eax
invalid
xchg ecx, eax
and ebp, dword [ecx + 0x44]
and al, 0xcf
jns 0x100015b7
sahf
mov al, 0x99
ja 0x1000153a
inc ebp
add edx, ecx
retf
in al, dx
pop es
inc ecx
lodsd eax, dword [esi]
push cs
or byte [0x1877aa67], al
stosb byte es:[edi], al
ja 0x100015d2
arpl word [ebx], dx
fnstenv [eax + 0x2e]
dec eax
lodsd eax, dword [esi]
mov esi, 0x115eba54
sahf
pop esi
sub eax, 0xf4ba2c5a
mov eax, dword gs:[0x933f58ee]
xchg ebx, eax
push edx
sar bh, 0x17
out 0x93, al
pop es
xlatb
aam 0x21
push edx
mov bl, 0xae
pop ecx
fcmovb st(0), st(2)
pop ss
sub ah, byte [ebx - 0x71a20eea]
mov dword [0x8e5df116], eax
stc
sub al, 0xf2
lea edi, [ecx + edi*4 - 0x12]
sbb byte [ecx - 0x7c8f9458], cl
dec esi
dec ecx
sar dword [eax - 0xe], 0x98
sub edx, dword [edx - 0x39]
mov edi, 0xc01069fd
popal
sub dword [edx], ebx
sub al, 0x9e
lcall 0xd94a, 0x97deaa97
xor byte [ebx - 0x3196fd5d], cl
jg 0x100015e5
push ecx
fadd st(3), st(0)
or eax, 0x449653c2
jns 0x100015ae
mov edx, 0xd76ce85b
adc dword [edx + 0x4a], ebx
xchg esi, eax
lahf
enter 0xffffffffffffa428, 0xffffffffffffff87
pushal
stosd dword es:[edi], eax
arpl word [eax + 0x3f28025b], cx
sahf
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x474f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474fd2
call fcn.0047a915
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474fd2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474fc9
xor eax, eax
jmp 0x474fda
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474fe0
pop edi
pop esi
pop ebx
ret 4

Function at 0x47ae45
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ae73
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ae91
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047adab
jmp 0x47ae91
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ae91
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047adab
test edi, edi
mov eax, edi
jne 0x47ae7b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403c41
Capabilities:
Encrypt data using tea

Disassembly:
sub esp, 0x30
and dword [esp + 8], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], edi
mov eax, dword [edi]
mov ebp, dword [edi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esi]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x38], eax
call fcn.004032cc
mov ebx, dword [esp + 0x18]
mov eax, dword [esi + 0xc]
add ebx, 0x23f
mov edi, dword [esi + 8]
push 0x20
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], eax
pop esi
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov edx, dword [esp + 0x20]
mov eax, edx
shl eax, 4
add eax, edi
mov dword [esp + 0x28], 0xedeb2e40
cmp dword [0x28d3a64], 0xfa9
mov dword [esp + 0x10], eax
mov eax, dword [0x28d3aa8]
cmove eax, dword [esp + 0x28]
and dword [esp + 0x28], 0
cmp dword [0x28d3a64], 0x3eb
mov dword [0x28d3aa8], eax
mov eax, dword [0x28d3ab0]
cmove eax, dword [esp + 0x28]
mov dword [0x28d3ab0], eax
lea eax, [ebx + edx]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
shr eax, 5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x2c]
xor eax, dword [esp + 0x28]
xor eax, dword [esp + 0x10]
sub ebp, eax
mov dword [esp + 0x14], eax
mov eax, ebp
mov dword [0x28d3aac], 0xf4ea3dee
shl eax, 4
mov dword [esp + 0x34], ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
and dword [esp + 0x1c], 0
mov eax, dword [esp + 0x18]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x24]
mov eax, ebp
shr eax, cl
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x28]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x20], eax
mov edx, 0x9e3779b9
lea ecx, [esp + 0x18]
call fcn.00403c35
dec esi
je 0x403d91
mov ebx, dword [esp + 0x18]
jmp 0x403c8f
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x20]
mov dword [edi + 4], ebp
mov dword [edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x4124df
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448248]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407a16
mov dword [ebp - 0x14], eax
cmp dword [0x28d4b1c], esi
jne 0x4125d2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41255f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4126b2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4126b2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4126b2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x28d4b1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x28d4b20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x28d4b24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x28d4b2c], eax
test eax, eax
je 0x4125cf
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x28d4b28], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4125f7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4125ea
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41260c
push 4
pop eax
jmp 0x4126b4
cmp dword [ebp - 0x14], esi
je 0x41260c
push dword [0x28d4b1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4125f1
mov eax, dword [0x28d4b28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41266a
cmp dword [0x28d4b2c], edi
je 0x41266a
push eax
call ebx
push dword [0x28d4b2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41266a
test eax, eax
je 0x41266a
call ecx
test eax, eax
je 0x41265f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41265f
test byte [ebp - 8], 1
jne 0x41266a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41269a
mov eax, dword [0x28d4b20]
cmp eax, edi
je 0x412697
push eax
call ebx
test eax, eax
je 0x412697
call eax
mov esi, eax
test esi, esi
je 0x412697
mov eax, dword [0x28d4b24]
cmp eax, edi
je 0x412697
push eax
call ebx
test eax, eax
je 0x412697
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x28d4b1c]
call ebx
test eax, eax
je 0x4126b2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4126b4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406c50
mov esp, ebp
pop ebp
ret