joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x4010e4
jmp 0x401040
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x401040
add eax, 4
jle 0x401185
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x40117f
movd dword [edi], mm4
je 0x401185
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x41b218
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], eax
mov eax, dword fs:[0]
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xf3
mov es, word [eax]
xor edi, dword [edx + 1]
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
test ecx, ecx
je 0x41b21c
add dword [ecx], eax
push ecx
call dword [eax + 8]
mov ecx, dword [ebp]
add byte [ecx + 0xd], cl
dec esi
add dword [ebx - 0x743ca21b], ecx
or dword [ebx + 0x1ae90000], eax
and al, byte [eax]
add byte [eax], bh
add esp, ebp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
add byte [eax], al
call int.0041d49c
add al, 1
add al, 0x89
inc edi
add al, 0x8b
inc esi
or byte [eax], al
add byte [eax], cl
mov eax, dword [esi + 0xc]
mov esp, ebx
add dword [edx + 0x46321047], ecx
adc byte [eax + eax], ah
add byte [edi + 0x10], al
mov cl, byte [esi + 0x10]
ja 0x41b28a
adc byte [eax + 0x4f3202e1], al
adc byte [eax], al
add byte [eax], dl
mov al, byte [esi + 0x10]
xor bl, byte [ecx]
and cl, 2
xor cl, byte [edi + 0x10]
add byte [eax], al
adc byte [edx + 0x19321046], cl
add dword [edx + esi], eax
Function at 0x4320a8
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], eax
mov eax, dword fs:[0]
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xf3
mov es, word [eax]
xor edi, dword [edx + 1]
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
test ecx, ecx
je 0x4320ac
add dword [ecx], eax
push ecx
call dword [eax + 8]
mov ecx, dword [ebp]
add byte [ecx + 0xd], cl
dec esi
add dword [ebx - 0x743ca21b], ecx
or dword [ebx + 0x1ae90000], eax
and al, byte [eax]
add byte [eax], bh
add esp, ebp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
add byte [eax], al
call int.0043432c
add al, 1
add al, 0x89
inc edi
add al, 0x8b
inc esi
or byte [eax], al
add byte [eax], cl
mov eax, dword [esi + 0xc]
mov esp, ebx
add dword [edx + 0x46321047], ecx
adc byte [eax + eax], ah
add byte [edi + 0x10], al
mov cl, byte [esi + 0x10]
ja 0x43211a
and cl, 2
xor cl, byte [edi + 0x10]
add byte [eax], al
adc byte [edx + 0x19321046], cl

Function at 0x438fc2
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx - 0x25], bl
ljmp 0x267a
pop edx
psubsw mm5, qword [ebp + 0x1fa6a4ce]
into
invalid
jp 0x438fe4
invalid
jae 0x438f52
dec edi
jg 0x438f7d
push 0xffffffffffffffcd
jmp 0x438fcf
or al, 0xcc
sub dh, byte [edi]
pop ecx
jnp 0x438ff6
sbb esi, esi
xchg ebx, eax
sbb esp, 0x6339e1af
not byte [eax]
std
popal
sub ebp, edi
std
hlt
aad 0xfe
stosb byte es:[edi], al
popfd
jecxz 0x438fa5
insb byte es:[edi], dx
sub eax, 0x3343fae6
push es
out 0xfa, al
inc ebx
xor eax, dword [esi]
rcl byte [ebx - 0x6d1d9ef7], cl
mov cl, 0x10
test dword [esi + 0x2167f326], esi
and cl, byte [eax + edx*2]
adc dword [edi + 0x3c], esi
insd dword es:[edi], dx
xor dword [ebp - 0xcea9801], 0xffffffb3
jle 0x438ffe
adc ebp, dword [esi]
adc dh, byte [ecx - 0x54]
add al, 0x3c
pop esi
mov al, 0x8b
mov edi, 0x1ff0d31d
adc eax, 0x7f8f317c
lcall 0x9bc9, 0x4c9e6589
cmc
pop esp
pop edx
in eax, 0x7a
popfd
wait
jns 0x439072
invalid
cmp bl, byte [eax + 0x15]
sbb ebx, dword [ebx + 0x3c6a2e3]
mov ebx, 0xfab5d78b
sbb bh, byte [edx + 0x60]
pop ebp
retf
Function at 0x448ae8
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], eax
mov eax, dword fs:[0]
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xf3
mov es, word [eax]
xor edi, dword [edx + 1]
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
test ecx, ecx
je 0x448aec
add dword [ecx], eax
push ecx
call dword [eax + 8]
mov ecx, dword [ebp]
add byte [ecx + 0xd], cl
dec esi
add dword [ebx - 0x743ca21b], ecx
or dword [ebx + 0x1ae90000], eax
and al, byte [eax]
add byte [eax], bh
add esp, ebp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
add byte [eax], al
call int.0044ad6c
add al, 1
add al, 0x89
inc edi
add al, 0x8b
inc esi
or byte [eax], al
add byte [eax], cl
mov eax, dword [esi + 0xc]
mov esp, ebx
add dword [edx + 0x46321047], ecx
adc byte [eax + eax], ah
add byte [edi + 0x10], al
mov cl, byte [esi + 0x10]
ja 0x448b5a
adc byte [eax + 0x4f3202e1], al
adc byte [eax], al
add byte [eax], dl
mov al, byte [esi + 0x10]
xor bl, byte [ecx]
and cl, 2
xor cl, byte [edi + 0x10]
add byte [eax], al
adc byte [edx + 0x19321046], cl
add dword [edx + esi], eax
ror dword [eax + 0x8b1047], 0
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x1e]
add dword [edi + 0x18], eax
mov eax, edi
pop edi
pop esi
pop ebp
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
push 0xffffffffffffffa0
add dword [ecx], ecx
or bh, byte [eax + eax + 0x64]
mov eax, dword [pe_dos_header]
push eax
mov eax, dword [0x15af32c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
add byte fs:[eax], al
add byte [eax], al
add byte [ebx + 0x7401f809], cl
push es
mov eax, dword [ecx]
push ecx
call dword [eax]
add byte [ebp - 0xc], cl
mov dword fs:[0x1fb], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x469ed7
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xd886bc7e
test edx, ecx
mov esp, 0xca85d886
outsd dx, dword [esi]
add byte [0x495f2200], 0x25
xor byte [eax], dl
mov ebp, 0x43cd2e47
loope 0x469ed9
cdq
pop esi
das
imul ecx, esp, 0x48
or byte [ebp - 0x38bb9c6a], dl
rep insw word es:[edi], dx
invalid
Function at 0x476348
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], eax
mov eax, dword fs:[0]
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xf3
mov es, word [eax]
xor edi, dword [edx + 1]
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
test ecx, ecx
je 0x47634c
add dword [ecx], eax
push ecx
call dword [eax + 8]
mov ecx, dword [ebp]
add byte [ecx + 0xd], cl
dec esi
add dword [ebx - 0x743ca21b], ecx
or dword [ebx + 0x1ae90000], eax
and al, byte [eax]
add byte [eax], bh
add esp, ebp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
add byte [eax], al
call int.004785cc
add al, 1
add al, 0x89
inc edi
add al, 0x8b
inc esi
or byte [eax], al
add byte [eax], cl
mov eax, dword [esi + 0xc]
mov esp, ebx
add dword [edx + 0x46321047], ecx
adc byte [eax + eax], ah
add byte [edi + 0x10], al
mov cl, byte [esi + 0x10]
ja 0x4763ba
adc byte [eax + 0x4f3202e1], al
adc byte [eax], al
add byte [eax], dl
mov al, byte [esi + 0x10]
xor bl, byte [ecx]
and cl, 2
xor cl, byte [edi + 0x10]
add byte [eax], al
adc byte [edx + 0x19321046], cl
add dword [edx + esi], eax
ror dword [eax + 0x8b1047], 0
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x1e]
add dword [edi + 0x18], eax
mov eax, edi
pop edi
pop esi
pop ebp
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
push 0xffffffffffffffa0
add dword [ecx], ecx
or bh, byte [eax + eax + 0x64]
mov eax, dword [pe_dos_header]
push eax
mov eax, dword [0x15af32c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
add byte fs:[eax], al
add byte [eax], al
add byte [ebx + 0x7401f809], cl
push es
mov eax, dword [ecx]
push ecx
call dword [eax]
add byte [ebp - 0xc], cl
mov dword fs:[0x1fb], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x48db98
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], eax
mov eax, dword fs:[0]
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xf3
mov es, word [eax]
xor edi, dword [edx + 1]
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
test ecx, ecx
je 0x48db9c
add dword [ecx], eax
push ecx
call dword [eax + 8]
mov ecx, dword [ebp]
add byte [ecx + 0xd], cl
dec esi
add dword [ebx - 0x743ca21b], ecx
or dword [ebx + 0x1ae90000], eax
and al, byte [eax]
add byte [eax], bh
add esp, ebp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
add byte [eax], al
call int.0048fe1c
add al, 1
add al, 0x89
inc edi
add al, 0x8b
inc esi
or byte [eax], al
add byte [eax], cl
mov eax, dword [esi + 0xc]
mov esp, ebx
add dword [edx + 0x46321047], ecx
adc byte [eax + eax], ah
add byte [edi + 0x10], al
mov cl, byte [esi + 0x10]
ja 0x48dc0a
adc byte [eax + 0x4f3202e1], al
adc byte [eax], al
add byte [eax], dl
mov al, byte [esi + 0x10]
xor bl, byte [ecx]
and cl, 2
xor cl, byte [edi + 0x10]
add byte [eax], al
adc byte [edx + 0x19321046], cl
add dword [edx + esi], eax
ror dword [eax + 0x8b1047], 0
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x1e]
add dword [edi + 0x18], eax
mov eax, edi
pop edi
pop esi
pop ebp
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
push 0xffffffffffffffa0
add dword [ecx], ecx
or bh, byte [eax + eax + 0x64]
mov eax, dword [pe_dos_header]
push eax
mov eax, dword [0x15af32c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
add byte fs:[eax], al
add byte [eax], al
add byte [ebx + 0x7401f809], cl
push es
mov eax, dword [ecx]
push ecx
call dword [eax]
add byte [ebp - 0xc], cl
mov dword fs:[0x1fb], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x612ea8
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], eax
mov eax, dword fs:[0]
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xf3
mov es, word [eax]
xor edi, dword [edx + 1]
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
test ecx, ecx
je 0x612eac
add dword [ecx], eax
push ecx
call dword [eax + 8]
mov ecx, dword [ebp]
add byte [ecx + 0xd], cl
dec esi
add dword [ebx - 0x743ca21b], ecx
or dword [ebx + 0x1ae90000], eax
and al, byte [eax]
add byte [eax], bh
add esp, ebp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
add byte [eax], al
call int.0061512c
add al, 1
add al, 0x89
inc edi
add al, 0x8b
inc esi
or byte [eax], al
add byte [eax], cl
mov eax, dword [esi + 0xc]
mov esp, ebx
add dword [edx + 0x46321047], ecx
adc byte [eax + eax], ah
add byte [edi + 0x10], al
mov cl, byte [esi + 0x10]
ja 0x612f1a
adc byte [eax + 0x4f3202e1], al
adc byte [eax], al
add byte [eax], dl
mov al, byte [esi + 0x10]
xor bl, byte [ecx]
and cl, 2
xor cl, byte [edi + 0x10]
add byte [eax], al
adc byte [edx + 0x19321046], cl
add dword [edx + esi], eax
ror dword [eax + 0x8b1047], 0
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x1e]
add dword [edi + 0x18], eax
mov eax, edi
pop edi
pop esi
pop ebp
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
push 0xffffffffffffffa0
add dword [ecx], ecx
or bh, byte [eax + eax + 0x64]
mov eax, dword [pe_dos_header]
push eax
mov eax, dword [0x15af32c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
add byte fs:[eax], al
add byte [eax], al
add byte [ebx + 0x7401f809], cl
push es
mov eax, dword [ecx]
push ecx
call dword [eax]
add byte [ebp - 0xc], cl
mov dword fs:[0x1fb], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x627cc9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x630390
cmp edx, dword [eax]
je 0x627ceb
add eax, 8
inc ecx
cmp eax, 0x630420
jl 0x627cdc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x630390]
jne 0x627e19
mov eax, dword [0x639d20]
cmp eax, 1
je 0x627df3
test eax, eax
jne 0x627d1c
cmp dword [0x6302bc], 1
je 0x627df3
cmp edx, 0xfc
je 0x627e19
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d53
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627d96
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ca34
push edi
call fcn.0062aa10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006286b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006286c0
lea eax, [ebp - 0xa0]
push 0x62ca14
push eax
call fcn.006286c0
push dword [esi + 0x630394]
lea eax, [ebp - 0xa0]
push eax
call fcn.006286c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a984
add esp, 0x2c
pop edi
jmp 0x627e19
lea eax, [ebp + 8]
lea esi, [esi + 0x630394]
push 0
push eax
push dword [esi]
call fcn.00628b40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40891a
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
sub edx, 0xdc700778
call fcn.0040894d
xor dword [eax], ecx
mov edx, 0xd981caf3
sub edx, esi
add eax, 1
or esi, edx
cmp eax, edi
jne fcn.0040891a
mov edx, 0x1f687635
ret
Function at 0x100328a9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100328e8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100328e8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100328e8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100328e8
cmp dword [ecx + 0x74], 0xe
jbe 0x100328e8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100354db
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10035578
push ebx
push esi
call fcn.100354a4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10035438
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10035525
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035577
push edi
push eax
call fcn.10036404
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10035545
call fcn.10033f80
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035576
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10035438
add esp, 0x20
test eax, eax
jne 0x10035564
push edi
call fcn.10033f80
jmp 0x1003556c
push ebx
call fcn.10033f80
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100357e5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea00
push 0x1003e9f8
push str.FlsAlloc
push 0x1f
call fcn.10035701
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10035819
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c174]
call esi
jmp 0x1003581f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10035863
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea10
push 0x1003ea08
push str.FlsGetValue
push 0x21
call fcn.10035701
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003589a
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100358a2
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea18
push 0x1003ea10
push str.FlsSetValue
push 0x22
call fcn.10035701
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100358dc
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003c174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1003ae40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003ae6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003ae6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40aba0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a6a8]
jne 0x40abaa
repz ret
jmp fcn.00411bcc

Function at 0x417cbc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f65c
and dword [ebp - 0x14], 0
cmp dword [0x461bfc], 0
mov dword [ebp - 0x18], eax
jne 0x417d6f
push 0x403824
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417e17
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403818
push ebx
call edi
test eax, eax
je 0x417e17
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403808
push ebx
mov dword [0x461bfc], eax
call edi
push eax
call esi
push 0x4037f4
push ebx
mov dword [0x461c00], eax
call edi
push eax
call esi
push 0x4037d8
push ebx
mov dword [0x461c04], eax
call edi
push eax
call esi
mov dword [0x461c0c], eax
test eax, eax
je 0x417d6f
push 0x4037c0
push ebx
call edi
push eax
call esi
mov dword [0x461c08], eax
mov eax, dword [0x461c08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417dc8
cmp dword [0x461c0c], ecx
je 0x417dc8
push eax
call esi
push dword [0x461c0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417dc8
test ebx, ebx
je 0x417dc8
call edi
test eax, eax
je 0x417dbf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x417dbf
test byte [ebp - 8], 1
jne 0x417dc8
or dword [ebp + 0x10], 0x200000
jmp 0x417dfb
mov eax, dword [0x461c00]
cmp eax, dword [ebp - 0x18]
je 0x417dfb
push eax
call esi
test eax, eax
je 0x417dfb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417dfb
mov eax, dword [0x461c04]
cmp eax, dword [ebp - 0x18]
je 0x417dfb
push eax
call esi
test eax, eax
je 0x417dfb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x461bfc]
call esi
test eax, eax
je 0x417e17
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417e19
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aba0
leave
ret
Function at 0x422620
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00421960
cmp dword [0x802980], 0x37
jne 0x4226d3
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404480
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4044b0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov ecx, dword [0x802984]
mov eax, dword [0x7fedf0]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1004
ret