joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x100ac1fc], 0
mov dword [0x100ac200], 0
mov dword [0x100ac20c], 0
mov dword [0x100ac1f4], 0x1e79
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jne 0x10008c2d
mov eax, dword [0x100ac1f8]
mov dword [ebp - 0x20], eax
jmp 0x10008d89
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10008c3e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x100ac1f4], 0x20b1
add ecx, 1
mov edi, edx
add edi, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x100ac1fc], edx
mov dword [0x100ac1f8], 0x4ed
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x30]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x100ac200], edx
mov dword [0x100ac1f4], 0x371
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x100ac204], cl
mov dword [0x100ac1f4], 0xadf
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x100ac1f4], 0x1ad7
mov cl, byte [0x100ac204]
mov edx, dword [0x100ac200]
mov byte [ebx + edx], cl
mov edx, dword [0x100ac1f8]
add edx, 0x1a15
mov dword [0x100ac1f8], edx
mov edx, dword [0x100ac1fc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x100ac200]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x100ac20c], ecx
mov edx, dword [0x100ac1f4]
add edx, 0xffffe4e9
mov dword [0x100ac1f8], edx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x34]
xor cl, byte [edx + esi]
mov byte [0x100ac210], cl
mov dword [0x100ac1f8], 0xffffee0e
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov ecx, dword [0x100ac1f8]
mov edx, ecx
add edx, 0xffffe858
mov dword [0x100ac1f4], edx
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ecx
je 0x10008d83
mov eax, dword [0x100ac200]
mov ecx, dword [0x100ac1fc]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jmp 0x10008c3e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0xffffe2d8
mov dword [0x100ac1f4], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008da0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x100ac1f4], 0x234f
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10007f80
lea ecx, [0x10007760]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x64], edx
mov dword [esp + 0x30], 0x13d600
mov edx, dword [0x100ac1e0]
mov dword [esp + 0x80], edx
mov edx, dword [0x100ac1e4]
mov dword [esp + 0x70], edx
mov edx, dword [0x100ac1e8]
mov dword [esp + 0x84], edx
mov edx, dword [0x100ac1ec]
mov dword [esp + 0x28], edx
mov edx, dword [0x100ac1f0]
mov dword [esp + 0x40], edx
mov dword [0x100ac1f8], 0x1909
mov dword [0x100ac1f4], 0x1d4c
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10008e5e
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x10008e81
jmp 0x10008e6d
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x10008e3c
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10008e5e
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [0x100ac1f4], 0x9a3
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], eax
mov dword [0x100ac1f8], 0xf18
call fcn.10007ad0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x10008e56
lea eax, [esp + 0x28]
mov dword [0x100ac1f8], 0x3bd
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.100073a0
mov dword [0x100ac1f8], 0x2255
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x100ac1f8], 0x7a4
mov dword [esp + 0xc], eax
jmp 0x10008e56
Function at 0x41eadd
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x44d792
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.0041eb8c
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.00412458
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41eae9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x44d792
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.0041eb8c
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.00412458
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x422cbd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x44dd92
call fcn.0044b4c0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.00402d43
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00402d43
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.0042246d
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x423870
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x44de21
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
call fcn.004025e0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004025e0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004025e0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004025e0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x426028
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x44e1da
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x10]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.00402e5b
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00426244
mov eax, dword [esi + 0x28]
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x28], eax
mov al, byte [esi + 0x2c]
mov byte [ebx + 0x2c], al
mov al, byte [esi + 0x2d]
mov byte [ebx + 0x2d], al
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
lea eax, [esi + 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.004261d5
mov eax, dword [esi + 0x40]
add esi, 0x48
mov dword [ebx + 0x40], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x48]
mov dword [ebx + 0x44], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4260c1
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x44e20d
call fcn.0044b4c0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0042619f
mov al, byte [edi + 8]
and dword [ebp - 4], 0
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040263c
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0040263c
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.0040263c
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0040263c
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42db88
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x44e985
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov byte [esi + 0x17], bl
call fcn.00402d43
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.00402d43
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.00402d43
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
mov byte [esi + 0x4f], bl
call fcn.0042145c
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.0042145c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42ddcb
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x44ea06
call fcn.0044b4c0
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esi], 0x454498
mov dword [esi + 4], 0x454418
mov dword [esi + 8], 0x454488
mov dword [esi + 0xc], 0x453484
mov dword [esi + 0x10], 0x45435c
mov dword [esi + 0x14], eax
mov byte [esi + 0x18], al
mov dword [ebp - 0x10], esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
call fcn.00402d43
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402d43
lea edi, [esi + 0x60]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00406532
lea ecx, [edi + 0x28]
call fcn.00402d43
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 5
call fcn.0041692f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x454474
mov dword [esi + 4], 0x454460
mov dword [esi + 8], 0x454450
mov dword [esi + 0xc], 0x454440
mov dword [esi + 0x10], 0x45442c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42e727
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x44eb51
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
test eax, eax
mov dword [ebx], eax
je 0x42e74b
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebx + 4], eax
je 0x42e75f
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 8]
mov byte [ebp - 4], 1
test eax, eax
mov dword [ebx + 8], eax
je 0x42e773
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0xc]
mov byte [ebp - 4], 2
test eax, eax
mov dword [ebx + 0xc], eax
je 0x42e787
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00402e5b
lea eax, [esi + 0x24]
lea ecx, [ebx + 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.00402e5b
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 5
call fcn.00402e5b
mov eax, dword [esi + 0x3c]
add esi, 0x44
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x40], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x78]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x5c], eax
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
lea eax, [esi + 0x78]
push eax
call fcn.0042e886
lea eax, [esi + 0xa8]
lea ecx, [ebx + 0xa8]
push eax
mov byte [ebp - 4], 7
call fcn.0042e886
mov eax, dword [esi + 0xd8]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4384e8
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00401524
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp bx, ax
jne 0x438521
movzx ecx, ax
mov eax, ecx
mov edx, edi
shr eax, 0xa
and ecx, 0x3ff
mov dword [esi], eax
call fcn.00438525
pop edi
pop esi
pop ebx
ret
Function at 0x43967f
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x44fa58
call fcn.0044b4c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov byte [esi + 3], bl
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.00402d43
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.00402d43
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.00402d43
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call fcn.00439715
lea ecx, [esi + 0x98]
call fcn.0044b1d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44676b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x446799
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4467b7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004466d5
jmp 0x4467b7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4467b7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004466d5
test edi, edi
mov eax, edi
jne 0x4467a1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x5706ec]
test ecx, ecx
je 0x44686a
jmp 0x44676a
ret 8

Function at 0x10021286
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10021295
pop dword [ebp - 0x44]
mov eax, 0x10021295
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x92871623
sub dword [ebp - 0x54], 0x4434d0d8
mov dword [ebp - 0x50], 0xaef3c9ef
sub dword [ebp - 0x50], 0x7cc07daa
mov dword [ebp - 0x4c], 0x1bfd8838
sub dword [ebp - 0x4c], 0xcfb1440a
mov dword [ebp - 0x48], 0x3a232912
sub dword [ebp - 0x48], 0x3a232912
lea eax, [ebp - 0x54]
push eax
mov eax, 0x8199f7f8
sub eax, 0x7194d6e8
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3def06bd
add dword [ebp - 0x54], 0x36836299
mov dword [ebp - 0x50], 0x80f97892
add dword [ebp - 0x50], 0xc072e8e3
mov dword [ebp - 0x4c], 0xbb4e4f77
sub dword [ebp - 0x4c], 0x57dee30b
mov dword [ebp - 0x48], 0xd99b7b7e
add dword [ebp - 0x48], 0x26648482
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x5950b
push 0
call eax
mov ecx, 0x3041a42e
add ecx, 0xcfbe9b9d
xor edi, edi
add edi, eax
mov ebx, 0x7a498f00
sub ebx, 0x6a437f00
add ebx, dword [ebp - 0x44]
mov edx, 0xfcdf4d96
sub edx, 0xeea9a5ea
mov dword [ebp - 8], 0x4d326b4c
mov esi, dword [ebx]
sub esi, edx
mov dword [ebp - 0x20], 0xabf220fa
mov dword [edi], esi
xor dword [ebp - 8], edi
add edi, 0xf37cf7da
add edi, 0xc83082a
add ebx, 4
loop 0x100213af
add eax, 0x2d17a4c1
sub eax, 0x2d16b2c2
xor ebx, ebx
add ebx, eax
add eax, 0x678f1e9f
add eax, 0x9870e166
mov ecx, 0xd325ea31
add ecx, 0x3cda15cf
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x426bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x426bf0
lcall 0x5de5, 0x8b10c483
jmp loc.0090ab38