joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f1fc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
insd dword es:[edi], dx
adc ecx, ebp
xchg edx, eax
sub al, 0xf3
xchg eax, esp
sbb dword [ebx], edx
pop ebx
add dword [esi + 0x53052f33], ecx
aam 0xf7
cmp dword [ecx - 0x5f4898ae], ebx
fldenv [ebx]
movsb byte es:[edi], byte [esi]
ror dword [esi - 0x1b], 1
jnp 0x51f1a1
invalid
and dword cs:[eax], edx
cmpsb byte [esi], byte es:[edi]
mov edi, 0x914ace65
rcr dword [ebx], 1
outsb dx, byte [esi]
mov cl, 0x91
mov ah, 0x7d
mov ebx, 0x767a0c94
jp 0x51f22c
mov eax, dword [0x49efa158]
scasd eax, dword es:[edi]
jle 0x51f16e
test edx, esi
xchg esi, eax
test byte [ecx + 0x12], ah
push esi
mov byte [0x8328a9f8], al
jb 0x51f21c
test eax, 0x50728328
sbb bh, bh
jae 0x51f1b4
ja 0x51f1e3
sub al, 0xa9
and eax, 0x64bab92e
jg 0x51f223
jg 0x51f223
inc ecx
invalid
sbb byte [edx + 0x44], bl
xchg edi, eax
jno 0x51f16a
invalid
push ss
shl dword [edi + ebx*4], 0x9e
xchg dword [ebx], ebx
dec ebx
idiv dword [ecx - 0x4a675b9d]
mov ch, 0x11
xor al, 0xb8
clc
out dx, al
inc eax
mov esp, 0xc4d1c82b
xor al, 0xae
scasb al, byte es:[edi]
jno 0x51f1d9
invalid
aas
adc eax, 0xf1f60180
fbld tbyte [ecx - 0x1f]
mov eax, dword [0xd34938b9]
retf 0x21e1
popal
loope 0x51f1c7
mov ecx, 0xcad34938
loope 0x51f24e
and dword [esi - 0x3faae34a], esp
mov edi, 0xae1c6651
adc dword [ebp + eax*8 + 0x72768151], ebx
cmpsb byte [esi], byte es:[edi]
mov dh, 0x1c
push ebp
sar byte [edi - 0x51e399af], 0x11
pushfd
lds edx, [ecx - 0x7f]
jbe 0x51f2b0
cwde
xor edi, 0x3c9598a0
daa
enter 0x42f5, 0x4b
and al, 0xc0
loope 0x51f218
leave
jno 0x51f1d8
xchg byte [ebp - 0x52], al
aam 0x52
and dword [ecx + 0x30a007a8], edx
inc edx
sub al, 0x87
jp 0x51f2c0
cmc
mov al, byte [0x86c362c4]
fdivr qword [ecx]
int 0x83
mov dh, byte [esp + edx + 0x2a]
adc al, 0xf0
out dx, al
inc ecx
iretd
push 0xffffffffffffff99
retf 0x1439
dec ecx
adc ah, cl
push esp
int1
mov byte [0x2e4cdb37], al
jae 0x51f2c8
outsb dx, byte [esi]
mov ch, 0x50
mov esi, 0xa6ef6c72
xor esi, edx
adc esi, eax
push 5
sal byte [esi + edx*4 + 0x3588211d], 0x1d
mov ah, 0x96
sbb eax, 0x1d358821
and dword [ebx], edx
xchg ecx, eax
sti
and dword [edx + 0x7e], 0x2fd47350
adc edx, dword [ecx + 0x7e6281fb]
push eax
jae 0x51f295
aam 0x2f
das
aad 0x7b
jp 0x51f2d7
add esi, edx
salc
shl byte [edx + 0x3dfd97d1], 1
loope 0x51f2e7
push edx
sti
mov al, 0x6e
pxor mm6, qword [ebx]
dec ecx
inc ebx
xor ecx, dword [ecx + 0x43]
push esi
loopne 0x51f288
stosb byte es:[edi], al
pop ss
sub al, 0x18
push ebp
invalid
pop esi
mov al, 0xa4
loope 0x51f2b8
arpl sp, cx
sbb dword [edx - 0x67], edi
push cs
mov bl, 0xae
adc dh, dl
invalid
Function at 0x541088
Capabilities:
Encode data using xor

Disassembly:
js 0x541034
adc dl, bh
xlatb
shl byte [ecx + ebp*8 - 0x5e], cl
mov edx, 0xd0f588ef
lcall 0xfb69, 0x17965a62
salc
push edx
sbb ah, bh
aas
movsd dword es:[edi], dword [esi]
ljmp 0xc996
and dword [ecx], edi
aam 0xdb
loope 0x54102f
sti
or al, bh
jno 0x5410cc
mov ebx, 0x138078fa
adc dword [esi - 0x6d], ecx
je 0x541027
jle 0x54102a
aas
pushfd
add byte [edx - 0x3ad0dc41], 0xb5
inc ebp
push 0x4b
invalid
scasb al, byte es:[edi]
out dx, eax
sbb ch, byte es:[ebx - 0x6179fa0c]
xchg byte [esi + 0x36a1ab5f], bl
mov edx, 0x9344e7dc
xchg byte [esi + 0x36a1ab5f], bl
mov edx, 0x9344e7dc
push eax
push 0x8b76c979
and dword [esi - 0x6e], edx
mov edi, esp
sti
push es
push 0xfffffffffffffff0
xchg ecx, eax
add dh, byte [edi - 7]
jg 0x541081
jmp 0x5410ca
xchg ebp, eax
xor ah, byte [esp + esi*4]
and al, 0xb4
and dh, bl
les esi, [esi]
inc ecx
cdq
jl 0x54105b
xchg edi, eax
adc esp, dword [ebx + 0x32]
push es
mov ch, 0x40
inc ebx
xor ecx, edx
xor eax, 0x1baa18d7
loopne 0x5410e1
pop ebx
push edi
invalid

Function at 0x6579dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f3f8
cmp edx, dword [eax]
je 0x6579ff
add eax, 8
inc ecx
cmp eax, 0x65f488
jl 0x6579f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f3f8]
jne 0x657b2d
mov eax, dword [0xa5bdd4]
cmp eax, 1
je 0x657b07
test eax, eax
jne 0x657a30
cmp dword [0x65f324], 1
je 0x657b07
cmp edx, 0xfc
je 0x657b2d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657a67
lea eax, [ebp - 0x1a4]
push 0x65c9e8
push eax
call fcn.006583c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658850
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657aaa
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658850
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c9e4
push edi
call fcn.0065a720
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c9c8
push eax
call fcn.006583c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006583d0
lea eax, [ebp - 0xa0]
push 0x65c9c4
push eax
call fcn.006583d0
push dword [esi + 0x65f3fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.006583d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c99c
push eax
call fcn.0065a694
add esp, 0x2c
pop edi
jmp 0x657b2d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f3fc]
push 0
push eax
push dword [esi]
call fcn.00658850
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406c80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x434500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x435420]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24c], ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x435230]
cmp eax, dword [ecx + 4]
jg 0x406e47
cmp dword [0x4344a8], 0
jne 0x406e2a
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call fcn.00407a60
test al, al
jne 0x406d39
push esi
lea eax, [ebp - 0x1c]
push str._05d
push eax
call fcn.00401230
mov esi, eax
add esp, 0xc
cmp esi, 0x434498
je 0x406e21
mov ecx, dword [0x4344ac]
cmp ecx, 0xf
jbe 0x406dde
mov edx, dword [0x434498]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406dd4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406e7d
jmp 0x406dd4
push edi
push 0
push 2
mov dword [ebp - 0x24c], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov edi, eax
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.00410ca0
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x406da7
cmp dword [ebp - 0x240], esi
je 0x406d9b
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x406d80
jmp 0x406da7
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x24c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 0x24c]
lea eax, [ebp - 0x1c]
push str._05d__05d
push eax
call fcn.00401230
add esp, 0x10
mov esi, eax
cmp esi, 0x434498
pop edi
jmp 0x406cf6
push ecx
push edx
call fcn.0040ef5c
add esp, 8
mov dword [0x4344a8], 0
mov dword [0x4344ac], 0xf
mov byte [0x434498], 0
movups xmm0, xmmword [esi]
movups xmmword [0x434498], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4344a8], xmm0
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [esi + 0x14], 0xf
lea ecx, [ebp - 0x1c]
call fcn.00401490
pop esi
push 0x434498
mov ecx, ebx
call fcn.00402ca0
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040ef6a
mov esp, ebp
pop ebp
ret
push 0x435230
call fcn.0040f23d
add esp, 4
cmp dword [0x435230], 0xffffffff
jne 0x406cbd
push 0x428530
call fcn.0040f1d7
push 0x435230
call fcn.0040f1ec
add esp, 8
jmp 0x406cbd
call fcn.004124cf
int3
Function at 0x406e90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427756
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x434500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x24c], esi
call fcn.00410ca0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push 0x7e
push eax
call fcn.004109a0
lea ecx, [ebp - 0x218]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406f15
sub ecx, edi
mov dword [ebp - 0x220], 0
sar ecx, 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x230]
movups xmmword [ebp - 0x230], xmm0
push eax
test edx, edx
je 0x40700e
call fcn.00401fe0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0040c020
push eax
push esi
mov byte [ebp - 4], 1
call fcn.004074a0
mov ecx, dword [ebp - 0x234]
add esp, 0x10
cmp ecx, 0xf
jbe 0x406fbf
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406fb5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407053
push ecx
push edx
call fcn.0040ef5c
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x407036
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40702c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407053
jmp 0x40702c
call fcn.00401fe0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.0040c020
add esp, 8
jmp 0x406fda
push ecx
push edx
call fcn.0040ef5c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ef6a
mov esp, ebp
pop ebp
ret
call fcn.004124cf
int3
Function at 0x40e8f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x40e917
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40e91a
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0040e8cc
pop esi
leave
ret 8

Function at 0x40fb10
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40fb4f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fb4f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fb4f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40fb4f
cmp dword [ecx + 0x74], 0xe
jbe 0x40fb4f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41aba6
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041ab28
Function at 0x41d440
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4359a8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d480
cmp byte [ebx], 0xa
jne 0x41d480
or byte [edi + eax + 0x28], 4
jmp 0x41d485
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41d584
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41d567
inc eax
cmp dl, 0xd
je 0x41d4b1
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41d4d7
cmp eax, ecx
jae 0x41d4e5
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41d499
jmp 0x41d584
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d562
cmp dword [ebp - 0x10], 0
je 0x41d562
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4359a8]
test byte [eax + edi + 0x28], 0x48
je 0x41d53c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41d527
mov byte [esi], dl
jmp 0x41d538
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4359a8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41d584
cmp byte [ebp - 1], 0xa
jne 0x41d54b
cmp esi, ebx
jne 0x41d54b
mov byte [esi], 0xa
jmp 0x41d583
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041de8f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41d584
mov byte [esi], 0xd
jmp 0x41d583
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4359a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d581
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d584
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41d58d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4359a8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d5d3
cmp word [ebx], dx
jne 0x41d5d3
or byte [eax + edi + 0x28], 4
jmp 0x41d5d8
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41d73b
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41d71b
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41d619
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41d64f
cmp eax, edx
jae 0x41d65d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41d5f4
jmp 0x41d73b
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d716
cmp dword [ebp - 0x18], 0
je 0x41d716
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4359a8]
test byte [eax + edi + 0x28], 0x48
je 0x41d6ec
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41d6b0
mov word [esi], cx
jmp 0x41d6e7
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4359a8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4359a8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4359a8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41d73b
pop eax
cmp word [ebp - 4], ax
jne 0x41d6fc
cmp esi, ebx
jne 0x41d6fc
mov word [esi], ax
jmp 0x41d738
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041de8f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41d73b
push 0xd
pop eax
jmp 0x41d6f7
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4359a8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41d735
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41d73b
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41f2a0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42d320
push 0x42d318
push str.FlsAlloc
push 0x1f
call fcn.0041f13c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f2d4
push dword [ebp + 8]
mov ecx, esi
call dword [0x4291e4]
call esi
jmp 0x41f2da
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41f31e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42d330
push 0x42d328
push str.FlsGetValue
push 0x21
call fcn.0041f13c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f355
push dword [ebp + 8]
mov ecx, esi
call dword [0x4291e4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41f35d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42d338
push 0x42d330
push str.FlsSetValue
push 0x22
call fcn.0041f13c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f397
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4291e4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x420737
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4207d4
push ebx
push esi
call fcn.00420700
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041ef83
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x420781
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4207d3
push edi
push eax
call fcn.0041b455
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4207a1
call fcn.0041b41b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4207d2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041ef83
add esp, 0x20
test eax, eax
jne 0x4207c0
push edi
call fcn.0041b41b
jmp 0x4207c8
push ebx
call fcn.0041b41b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4256b5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00425631
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x425824
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x425824
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4257d9
jg 0x425711
test eax, eax
je 0x4257cf
push 1
push 0x1000
call fcn.0041f658
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x425734
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4257c6
push 0x8000
push ebx
call fcn.00418b28
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x42575d
jg 0x425758
cmp ecx, 0x1000
jb 0x42575d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041e7d7
add esp, 0x10
cmp eax, 0xffffffff
je 0x4257a2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x425758
jl 0x425789
test ecx, ecx
jne 0x42574a
push dword [ebp - 0xc]
push ebx
call fcn.00418b28
push esi
call fcn.0041b41b
add esp, 0xc
xor ebx, ebx
jmp 0x425832
cmp byte [edi + 0x24], 0
je 0x4257b9
cmp dword [edi + 0x20], 5
jne 0x4257b9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4257c4
mov ebx, dword [edi + 0x18]
jmp 0x4257c6
xor ebx, ebx
push esi
call fcn.0041b41b
pop ecx
jmp 0x425832
test ecx, ecx
jg 0x42579b
jl 0x4257d9
test eax, eax
jae 0x42579b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041de8f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4257f9
cmp byte [edi + 0x1c], 0
je 0x42579b
jmp 0x42582a
push ebx
call fcn.00420c66
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42579b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x425832
cmp byte [edi + 0x1c], 0
je 0x42582f
mov ebx, dword [edi + 0x18]
jmp 0x425832
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041de8f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x426c10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426c3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426c3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10e2d8c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10e2d96
pushal
call 0x10e2d9c
pop ebp
sub ebp, 0x10
sub ebp, 0xce2d8c
jmp 0x10e2db2
mov eax, 0xce2d8c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d8
mov edx, 0x641005e7
xor byte [eax], dl
inc eax
dec ecx
jne 0x10e2dc9
jmp 0x10e2ddc
insb byte es:[edi], dx
sub ch, byte [esi + ebp*2 - 0x25]
out 0xe7, eax
out 0x66, eax
pop ds
out 0xe7, eax
out 0xe4, eax
sub bl, byte [edi - 0x1f]
out 0xe7, eax
out 0x5d, eax
iretd
Function at 0x1006205
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b2d0]
push edi
xor edi, edi
cmp word [0x100c898], di
mov dword [ebp - 4], eax
jne 0x1006247
cmp dword [0x100c884], edi
jne 0x100623e
call fcn.010043ec
test eax, eax
je 0x1006259
cmp word [0x100c898], di
jne 0x1006247
call fcn.01004bc8
test eax, eax
je 0x1006259
call fcn.0100435e
test eax, eax
je 0x1006259
call fcn.01005f21
test eax, eax
jne 0x1006260
xor eax, eax
jmp 0x100636a
push ebx
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001264
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.010066cf
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov ebx, 0x100bc44
je 0x10062b3
push 0x10014a8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10062b3
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x100c884], edi
jne 0x10062da
cmp dword [0x100c490], edi
jne 0x10062da
call fcn.010047b3
test eax, eax
jne 0x10062da
xor eax, eax
jmp 0x1006368
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1006301
push edi
push 0x10
push edi
push edi
push 0x4bc
push edi
call fcn.01003ebe
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10062d3
cmp dword [0x100c88c], edi
jne 0x1006312
call fcn.01005a36
test eax, eax
je 0x10062d3
test byte [0x100cba8], 0xc0
jne 0x1006330
xor eax, eax
mov ax, word [0x100ba64]
push eax
call fcn.01001f93
mov dword [0x100bb84], eax
jmp 0x1006336
mov dword [0x100bb84], edi
cmp dword [0x100c884], edi
jne 0x100634f
cmp dword [0x100c490], edi
jne 0x100634f
call fcn.01005abc
test eax, eax
je 0x10062d3
cmp word [0x100c898], di
jne 0x1006365
cmp dword [0x100c884], edi
jne 0x1006365
call fcn.01004de5
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret

Function at 0x100645c
Capabilities:
Accept command line arguments

Disassembly:
call fcn.0100646b
jmp fcn.010063e0

Function at 0x100672a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006741
xor eax, eax
jmp 0x1006749
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4