joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d4f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007345b
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x1008d470]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp eax, 0xff
ja 0x1005d725
mov byte [ebp - 0xa9], al
mov ecx, 0x1008e038
lea eax, [ebp - 0xa9]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.1005be50
mov ecx, dword [ebp - 0xb0]
mov edx, dword [0x1008e038]
cmp byte [ecx + 0xd], 0
jne 0x1005d562
mov eax, dword [ebp + 8]
cmp al, byte [ecx + 0x10]
jae 0x1005d564
mov ecx, edx
cmp ecx, edx
jne 0x1005d718
push 0x80
lea eax, [ebp - 0x90]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x90]
push 0x7f
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
mov dword [ebp - 0x98], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x94], 0
movups xmmword [ebp - 0xa8], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005d5c7
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
lea ecx, [ebp - 0xa8]
call fcn.10059c30
mov eax, dword [ebp + 8]
mov ecx, 0x1008e038
mov byte [ebp - 0xa9], al
lea eax, [ebp - 0xa9]
push eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], 0
push eax
call fcn.1005be50
mov ecx, dword [ebp - 0xb0]
cmp byte [ecx + 0xd], 0
jne 0x1005d623
mov eax, dword [ebp + 8]
cmp al, byte [ecx + 0x10]
jae 0x1005d6a8
cmp dword [0x1008e03c], 0x5d1745d
je 0x1005d741
mov esi, dword [0x1008e038]
mov dword [ebp - 0xc0], 0x1008e038
push 0x2c
mov byte [ebp - 4], 1
mov dword [ebp - 0xbc], 0
call fcn.10071e94
mov cl, byte [ebp - 0xa9]
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 4], 0
mov byte [eax + 0x10], cl
mov ecx, 0x1008e038
movups xmmword [eax + 0x14], xmm0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0xf
push eax
push dword [ebp - 0xb4]
mov byte [eax + 0x14], 0
push dword [ebp - 0xb8]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.10060a90
mov ecx, eax
add ecx, 0x14
lea eax, [ebp - 0xa8]
cmp ecx, eax
je 0x1005d6cf
cmp dword [ebp - 0x94], 0x10
push dword [ebp - 0x98]
cmovae eax, dword [ebp - 0xa8]
push eax
call fcn.1005b290
mov edx, dword [ebp - 0x94]
lea esi, [ebp - 0xa8]
mov ecx, dword [ebp - 0xa8]
cmp edx, 0x10
cmovae esi, ecx
jb 0x1005d714
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005d70a
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1005d70a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10071aa4
add esp, 8
mov eax, esi
jmp 0x1005d727
cmp dword [ecx + 0x28], 0x10
lea eax, [ecx + 0x14]
jb 0x1005d727
mov eax, dword [eax]
jmp 0x1005d727
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10071a96
mov esp, ebp
pop ebp
ret
call fcn.10060d50
int3
Function at 0x1005dc40
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push 0x1007cbf8
push dword [esp + 0x14]
lea eax, [esp + 0xc]
mov dword [esp + 0x10], ecx
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov ebx, dword [esp + 0x10]
add esp, 0xc
test ebx, ebx
jne 0x1005dc79
lea eax, [ebx - 3]
pop ebx
add esp, 8
ret 4
push esi
push 2
push 0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x1005dc93
mov esi, 0xfffffffd
jmp 0x1005dd0b
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
add esp, 4
test esi, esi
js 0x1005dc8c
jne 0x1005dca9
xor esi, esi
jmp 0x1005dd0b
push edi
lea eax, [esi + 1]
push 0x100890c0
push eax
call fcn.10071f50
mov edi, eax
add esp, 8
test edi, edi
jne 0x1005dcc6
lea esi, [eax - 2]
jmp 0x1005dd0a
push 0
push 0
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push ebx
push esi
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x1c
cmp eax, esi
je 0x1005dcf4
push edi
call fcn.10071f4b
mov esi, 0xfffffffd
jmp 0x1005dd07
mov ecx, dword [esp + 0x10]
push eax
push edi
call fcn.1005dac0
push edi
mov esi, eax
call fcn.10071f4b
add esp, 4
pop edi
push dword [esp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, esi
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x10062190
Capabilities:
Terminate process

Disassembly:
cmp byte [0x1008e3f8], 0
push esi
mov esi, ecx
je 0x100621b8
push str.crash_direct3d__exiting.
call fcn.10059e50
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x1008e3f4]
test ecx, ecx
je 0x100621d2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x1008e3f4], 0
mov byte [0x1008e3f8], 1
mov ecx, dword [esi + 0xc]
pop esi
test ecx, ecx
je 0x100621ea
push dword [esp + 4]
call fcn.10066a10
call fcn.100691e0
ret 4
Function at 0x10069d60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x1008d470]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10069e22
cmp byte [esi + 0x3d], 0
je 0x10069e22
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10069e0f
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10069dd3
sub eax, 1
je 0x10069dd7
sub eax, 2
jne 0x10069e0f
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10071a96
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x10069df7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10069e0f
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10071a96
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10071a96
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.10071a96
add esp, 0x28
ret
Function at 0x1006a360
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x1008d470]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1006a390
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10071a96
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1006a3c1
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1006a3c1
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10071a96
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1006a4cd
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1006a3ea
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1006a41f
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10071a96
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1006a487
sub eax, 1
je 0x1006a487
sub eax, 2
jne 0x1006a4cd
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.10066e40
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10071a96
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x1006a4a7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1006a4cd
lea ecx, [esp + 0xc]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x14], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10071a96
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10071a96
add esp, 0x30
ret 4
Function at 0x1006e1d0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x14]
test eax, eax
jg 0x1006e1f1
jl 0x1006e1e7
test esi, esi
jne 0x1006e1f1
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ecx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1006e209
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, dword [ebx + 0x1c]
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edx, dword [eax]
mov edi, esi
test edx, edx
je 0x1006e252
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
test eax, eax
je 0x1006e259
mov edi, dword [esp + 0x1c]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ebp
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add ebp, esi
sub edi, esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x1006e259
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x4c], 0
je 0x1006e2c6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1006e283
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1006e2b4
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call eax
add esp, 0x10
add ebp, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1006e2c6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1006e290
test edi, edi
je 0x1006e2c6
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call eax
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x20]
sub esi, edi
pop edi
pop ebp
mov eax, esi
sbb edx, 0
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x1006e2e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1006e305
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
add esp, 0x14
ret 0xc
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], edi
test ecx, ecx
je 0x1006e332
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1006e338
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, ecx
cdq
mov dword [esp + 0x2c], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1006e3a0
jg 0x1006e34f
test esi, esi
je 0x1006e3a0
test ecx, ecx
jl 0x1006e39a
jg 0x1006e359
test eax, eax
je 0x1006e39a
cmp edi, ecx
jg 0x1006e36d
jl 0x1006e363
cmp esi, eax
jae 0x1006e36d
mov eax, esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], edi
mov ebp, dword [esp + 0x28]
push eax
push ebp
push dword [esp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x2c]
add ebp, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1006e3a4
mov ebp, dword [esp + 0x28]
jmp 0x1006e3ae
mov ebp, dword [esp + 0x28]
test edi, edi
jl 0x1006e3c8
jg 0x1006e3ae
test esi, esi
je 0x1006e3c8
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1006e3c8
push eax
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x1006f920
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x1007415d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1008d470]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
call fcn.10061280
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1005a700
add esp, 0xc
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
or esi, 0xffffffff
call fcn.1005a970
push eax
call fcn.10061170
add esp, 4
test al, al
je 0x1006fa77
push 0x1007cbf8
lea ecx, [ebp - 0x28]
call fcn.1005a970
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1006fa77
push ebx
push 0x200
lea eax, [ebp]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, eax
add esp, 0x10
test edx, edx
je 0x1006fa08
nop dword [eax]
xor ecx, ecx
movzx eax, byte [ebp + ecx]
inc ecx
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x100875d0]
mov edi, esi
cmp ecx, edx
jb 0x1006f9d2
push ebx
push 0x200
lea eax, [ebp]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x1006f9d0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10059d70
not esi
push esi
push 0x100879d0
call fcn.1005a060
add esp, 8
cmp esi, 0x931b4825
ja 0x1006fa5d
je 0x1006fa4b
cmp esi, 0x2f388d11
je 0x1006fa4b
cmp esi, 0x8c4b7b3a
jne 0x1006fa95
push dword [ebp + 0x20c]
call fcn.10070100
add esp, 4
mov al, 1
jmp 0x1006fa97
cmp esi, 0xae196a1e
jne 0x1006fa95
push dword [ebp + 0x20c]
call fcn.1006fad0
add esp, 4
mov al, 1
jmp 0x1006fa97
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10059d70
push 0
push 0x100879d0
call fcn.1005a060
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.10071a96
lea esp, [ebp + 0x204]
pop ebp
ret
Function at 0x10071340
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100741a7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1008d470]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10071515
sub eax, 1
jne 0x10071536
push 0x10071260
push 0x10087c40
push 0x10087c54
call fcn.1005a250
add esp, 0xc
mov dword [0x10093458], eax
cmp byte [0x1009345c], 0
jne 0x10071536
push 0x10071270
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.1005e020
call fcn.1005f710
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
xor edi, edi
mov ebx, dword [eax + 0x3c]
add ebx, eax
xor eax, eax
movzx ecx, word [ebx + 0x14]
lea esi, [ebx + 0x18]
add esi, ecx
cmp ax, word [ebx + 6]
jae 0x100714a8
mov ecx, 0x10087b34
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10071407
test dl, dl
je 0x10071403
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10071407
add eax, 2
add ecx, 2
test dl, dl
jne 0x100713e7
xor eax, eax
jmp 0x1007140c
sbb eax, eax
or eax, 1
test eax, eax
je 0x10071470
mov ecx, 0x10087b3c
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10071437
test dl, dl
je 0x10071433
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10071437
add eax, 2
add ecx, 2
test dl, dl
jne 0x10071417
xor eax, eax
jmp 0x1007143c
sbb eax, eax
or eax, 1
test eax, eax
je 0x10071470
mov ecx, str..textnc
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10071467
test dl, dl
je 0x10071463
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10071467
add eax, 2
add ecx, 2
test dl, dl
jne 0x10071447
xor eax, eax
jmp 0x1007146c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10071498
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov eax, dword [esi + 8]
add eax, 0xfff
and eax, 0xfffff000
push 0x40
push eax
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [ebx + 6]
inc edi
add esi, 0x28
cmp edi, eax
jl 0x100713e0
push dword [0x1008df7c]
push str.imagebase__0x_p
call fcn.1005a060
push 0xf8
call fcn.10071e94
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x100714dc
mov ecx, eax
call fcn.10061b60
jmp 0x100714de
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x10093454], eax
test eax, eax
je 0x100714fe
mov ecx, eax
call fcn.10062050
test al, al
mov eax, str.m2ext_initialised.
jne 0x10071503
mov eax, str.m2ext_instance_failed_to_create.
push eax
call fcn.10059e50
add esp, 4
mov byte [0x1009345c], 1
jmp 0x10071536
push str.terminate_the_process.
call fcn.10059e50
add esp, 4
call fcn.10059e10
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x443730
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004438e0
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x44382e
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4437d1
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x443814
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4437e8
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x443803
test al, 0x40
je 0x4437fa
mov ecx, dword [edi + 0x20]
jmp 0x443801
test al, 0x80
je 0x443814
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x443814
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4437a0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x10be5f8f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5dc3300b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42fe08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [esp + 0x10], esi
mov dword [ebx + 4], edi
mov dword [ebx], vtable.CFont.0
mov eax, vtable.CBitmap.0
mov dword [esp + 0x1c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], eax
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], eax
lea ebp, [esi + 0x78]
mov dword [ebp + 4], edi
mov dword [ebp], vtable.CFont.0
mov dword [esi + 0x90], edi
mov dword [esi + 0x8c], vtable.CFont.0
mov byte [esp + 0x1c], 4
call fcn.004219f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x9c], eax
mov eax, dword [esp + 0x24]
lea ecx, [esi + 0x38]
push ecx
mov byte [esp + 0x20], 5
mov dword [esi + 0x34], eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x68], edi
call dword [sym.imp.USER32.dll_SetRectEmpty]
push str.Tahoma
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x190
push edi
push edi
push edi
push 0xe
mov dword [esi + 0x58], 1
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
lea ecx, [esi + 0x8c]
call fcn.00429343
push str.Tahoma
push 0x20
push edi
push edi
push edi
push edi
push edi
push 1
push edi
push 0x190
push edi
push edi
push edi
push 0xe
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
mov ecx, ebp
call fcn.00429343
push str.Tahoma
push edi
push edi
push edi
push edi
push edi
push edi
mov ebp, 1
push ebp
push edi
push 0x2bc
push edi
push edi
push edi
push 0xe
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
mov ecx, ebx
call fcn.00429343
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 8], edi
pop edi
mov dword [esi + 0x30], ebp
mov dword [esi + 0x74], ebp
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0xa0], edx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8