joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dc20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movaps xmm0, xmmword [eax]
lea edx, [esi - 1]
pxor xmm0, xmmword [edi]
movaps xmmword [eax], xmm0
cmp edx, 1
jbe 0x45dc6d
add edx, 0xfffffffe
lea ecx, [edi + 0x10]
shr edx, 1
inc edx
nop dword [eax]
movaps xmm0, xmmword [eax]
lea ecx, [ecx + 0x20]
aesdec xmm0, xmmword [ecx - 0x20]
movaps xmmword [eax], xmm0
aesdec xmm0, xmmword [ecx - 0x10]
movaps xmmword [eax], xmm0
sub edx, 1
jne 0x45dc50
movaps xmm0, xmmword [eax]
add esi, esi
aesdec xmm0, xmmword [edi + esi*8 - 0x10]
movaps xmmword [eax], xmm0
aesdeclast xmm0, xmmword [edi + esi*8]
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45dc90
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movaps xmm1, xmmword [eax]
movaps xmm0, xmmword [ecx]
mov eax, dword [ebp + 0x14]
pxor xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
push esi
mov esi, dword [ebp + 0x10]
pxor xmm0, xmm1
movaps xmmword [edx], xmm0
push edi
mov edi, dword [ebp + 0x1c]
movaps xmm0, xmmword [esi]
pxor xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
pxor xmm0, xmm1
movaps xmmword [eax], xmm0
cmp edi, 1
jbe 0x45dd2d
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
add edi, 0x10
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
nop
sub dword [esp + 0xc], 1
lea edi, [edi + 0x10]
movaps xmm1, xmmword [edi - 0x10]
movaps xmm0, xmmword [ecx]
aesdec xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesdec xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesdec xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesdec xmm0, xmm1
movaps xmmword [eax], xmm0
jne 0x45dcf0
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add edi, edi
movaps xmm0, xmmword [ecx]
movaps xmm1, xmmword [eax + edi*8]
mov eax, dword [ebp + 0x14]
aesdeclast xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesdeclast xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesdeclast xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesdeclast xmm0, xmm1
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4672a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x4672cb
cmp dword [ebx + 0x80], 0
jne 0x4672cb
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.004772b6
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0046755e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x467305
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004772b6
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x46733c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0046735d
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46b1a7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x46b1ec
call fcn.004772b6
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46b1ec
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x46b208
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0047266a
mov ebx, eax
test edi, edi
je 0x46b206
test esi, esi
je 0x46b206
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46bc1f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x46bcdd
cmp dword [esi + 0x20], 0
je 0x46bcdd
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46bcdd
cmp dword [ebp + 8], 0
je 0x46bcdd
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004772b6
push 0x5f0a88
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x46bcae
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x46bcdd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0048025f
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x46bcce
test edi, edi
je 0x46bcce
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x46bcd9
mov ecx, esi
call fcn.0046b9be
mov eax, ebx
jmp 0x46bcdf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4706eb
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5ea14a
call fcn.005aa0a3
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x470711
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x470770
call fcn.00472411
push eax
lea ecx, [ebp - 0x10]
call fcn.00403cd0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.005aa066
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005c0695
push eax
call fcn.00403f00
add esp, 0x14
test esi, esi
je 0x470763
push esi
call fcn.005c04f8
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404240
mov eax, ebx
call fcn.005aa06c
ret 8

Function at 0x4729db
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00470244
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x472a17
call fcn.00472bfd
mov dword [esi + 0xc], 1
jmp 0x472a1c
call fcn.00472bfd
cmp dword [esi], 0
je 0x472a65
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x472a3f
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0046882b
jmp 0x472a50
push 0xff
mov ecx, esi
call fcn.004044a0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00427ee0
jmp 0x472a89
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x472a89
push dword [esi]
push dword [ebp - 4]
call fcn.0047d720
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x472b52
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00472bfd
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x472b9a
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0046882b
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00427ee0
jmp 0x472ba5
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0047d720
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x475511
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x47555b
call fcn.004772b6
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x475558
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4755a9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x475587
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.005aa066
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x475587
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4755a7
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.005aa066
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x475f9f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x475ff2
push esi
push dword [ebp + 8]
call fcn.00476192
mov edi, eax
test edi, edi
jne 0x475fc2
mov eax, dword [ebp + 0x10]
jmp 0x476004
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x475fbd
mov eax, dword [ebp - 8]
jmp 0x476004
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x482d0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x482d25
mov edi, dword [esi + 0xc]
jmp 0x482d65
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x482d3e
call fcn.00478e28
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x482d53
call fcn.00478e28
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x482d65
call fcn.00478e28
call fcn.004772b6
cmp dword [eax + 0x3c], 0
je 0x482d7a
push edi
mov ecx, ebx
call fcn.0048239f
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00482f57
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x482da3
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x482daf
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b07de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x4b07f7
call fcn.004772b6
mov esi, dword [eax + 0xc]
push 0x5f9c94
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4b084d
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4b084c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b082d
xor esi, esi
jmp 0x4b0843
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004b0855
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x549633
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x5e8b03
call fcn.005aa0d7
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0041d7b0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5efff0
call fcn.00436cc0
cmp eax, 0xffffffff
jne 0x5496fe
push 0
push 0x5f9c50
lea ecx, [ebp - 0x4d0]
call fcn.00436cc0
cmp eax, 0xffffffff
jne 0x5496fe
push 0
push 0x5f13b4
lea ecx, [ebp - 0x4d0]
call fcn.00436cc0
cmp eax, 0xffffffff
jne 0x5496fe
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0041d7b0
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x5496db
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005aa066
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00404240
jmp 0x549736
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00404900
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00404240
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x549724
mov edi, dword [ebp - 0x4cc]
jmp 0x549736
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005aa066
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00404240
mov eax, edi
call fcn.005aa081
ret

Function at 0x5ceb0b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ce98a

Function at 0x5d24b2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d2172
Function at 0x402700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x402711
jmp dword [eax*4 + 0x408448]
cmp dword [0x4090b4], 0
je 0x402820
push 0x4090b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4090d0]
test edi, edi
je 0x402815
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40275b
mov edi, dword [edi + 8]
test edi, edi
je 0x402815
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402750
test esi, esi
je 0x402750
mov ecx, dword [edi + 4]
call dword [0x4088c4]
push esi
call ecx
add esp, 4
jmp 0x402750
call fcn.00402040
jmp case.default.0x402711
cmp dword [0x4090b4], 0
je case.default.0x402711
push 0x4090b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4090d0]
test edi, edi
je 0x402808
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4027c7
mov edi, dword [edi + 8]
test edi, edi
je 0x402808
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x4027c0
test esi, esi
je 0x4027c0
mov ecx, dword [edi + 4]
call dword [0x4088c4]
push esi
call ecx
add esp, 4
jmp 0x4027c0
cmp dword [0x4090b4], 0
jne 0x4027fc
push 0x4090b8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4090b4], 1
jmp case.default.0x402711
push 0x4090b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x402711
push 0x4090b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4090b4]
cmp eax, 1
jne case.default.0x402711
mov eax, dword [0x4090d0]
test eax, eax
je 0x402852
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x402840
mov dword [0x4090d0], 0
mov dword [0x4090b4], 0
push 0x4090b8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402980
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x408004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x4029e6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x4029e6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x4029e6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x4029e6
mov edx, dword [esp + 0xc]
sub edx, dword [0x408004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x4029d6
add esi, 0x28
dec ecx
je 0x4029e6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x4029d0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x4029d0
mov eax, esi
pop esi
pop edi
ret
Function at 0x408866
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410204
push 0x4101fc
push str.FlsGetValue
push 0x21
call fcn.00408723
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40889d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4088a5
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41020c
push 0x410204
push str.FlsSetValue
push 0x22
call fcn.00408723
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4088df
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40e150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x40aa0f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040a7ed
cmp eax, 0x66baabc5
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x40aa47
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40aa41
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40aa32
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040a7ed
mov ebx, 0x8d0da192
inc ebp
test al, 0x50
call fcn.0040a7fd
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040a7b2
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40aadb
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040a7ed
ret 0x6448
Function at 0x40aefd
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x40aea1
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40ae9c
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40ae86
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
xor al, 3
into
xor al, 3
into
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40ae8e
cmp edx, ebx
jne 0x40afdc
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40ae5d
add eax, dword [eax + 4]
jmp 0x40ae4a
mov dword [ebp + 0xc], ebx
jmp 0x40aeac
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40aec4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40aee2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
invalid
ja 0x40af40
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
adc byte [ecx + 0xe2], al
and byte [ecx + 0x1065], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40af27
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40af30
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40af3a
add ecx, eax
or byte [ecx], 4
invalid
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40af1c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40aea6
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40af8d
dec eax
je 0x40af84
sub eax, 3
je 0x40af7b
mov dword [ebp - 4], 0x40
jmp 0x40afaa
mov dword [ebp - 4], 4
jmp 0x40af90
mov dword [ebp - 4], 0x20
jmp 0x40af90
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
invalid