joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454500
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3d000]
push edi
or ebp, 0xffffffff
jmp 0x454522
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x454529
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x454518
mov eax, 1
add ebx, ebx
jne 0x45453b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x454530
jne 0x45454c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x454530
xor ecx, ecx
sub eax, 3
jb 0x454560
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4545d2
mov ebp, eax
add ebx, ebx
jne 0x45456b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x454578
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45459c
inc ecx
add ebx, ebx
jne 0x454588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45457d
jne 0x454599
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45457d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4545bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4545ad
jmp 0x45451e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4545bc
add edi, ecx
jmp 0x45451e
pop esi
mov edi, esi
mov ecx, 0x21
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4545da
cmp byte [edi], 0x30
jne 0x4545da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4545df
lea edi, [esi + 0x52000]
mov eax, dword [edi]
or eax, eax
je 0x454657
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54a0c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54a48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45460c
mov ecx, edi
jns 0x45463b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54a4c]
or eax, eax
je 0x454651
mov dword [ebx], eax
add ebx, 4
jmp 0x454629
call dword [esi + 0x54a5c]
mov ebp, dword [esi + 0x54a50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45468b
sub esp, 0xffffff80
jmp 0x401094

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x43f0cc], 1
mov dword [0x43f0d0], 1
mov dword [0x43f0d4], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x407f30
Capabilities:
Create directory

Disassembly:
push esi
push ebx
push eax
mov eax, 0x2010
call fcn.0040f9d8
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
mov eax, dword [0x43f0a0]
test eax, eax
je 0x407fd0
xor ebx, ebx
test eax, eax
jg 0x407f6b
jmp 0x407f88
add ebx, 1
cmp dword [0x43f0a0], ebx
jle 0x407f88
mov eax, dword [ebx*4 + 0x43e0a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407f60
jmp 0x407fc2
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jne 0x407f9c
cmp word [esi + 2], 0x3a
je 0x407fc2
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
je 0x408018
mov ebx, dword [0x43f0a0]
cmp ebx, 0x3ff
jle 0x408030
mov eax, 1
add esp, 0x2014
pop ebx
pop esi
ret
mov ecx, 0x1000
mov edx, str.HOME
lea eax, [esp + 0x10]
call fcn.00407710
test al, al
je 0x40804b
lea eax, [esp + 0x10]
mov ebx, dword [0x43f0a0]
mov dword [esp], eax
call sub.msvcrt.dll__wcsdup
mov dword [ebx*4 + 0x43e0a0], eax
mov eax, dword [0x43f0a0]
add eax, 1
mov dword [0x43f0a0], eax
jmp 0x407f51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407fb4
xor eax, eax
jmp 0x407fc7
mov dword [esp], esi
call sub.msvcrt.dll__wcsdup
add dword [0x43f0a0], 1
mov dword [ebx*4 + 0x43e0a0], eax
jmp 0x407fc2
mov eax, str.HOME
call fcn.00407e60
lea esi, [esi]
lea esi, [esi]

Function at 0x408120
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x439060]
test eax, eax
je 0x408180
sub esp, 0x1c
mov dword [esp + 4], 0x1388
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x408160
mov eax, dword [0x439060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x1c
ret
mov eax, dword [0x439060]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x408144
ret
Function at 0x40ea28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00414e2c
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00414e2c
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x40f5fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40f61b
mov eax, 0
jmp 0x40f65f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40f63e
mov eax, 0
jmp 0x40f65f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40f65a
mov eax, 0
jmp 0x40f65f
mov eax, 1
leave
ret

Function at 0x40f661
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40f6c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40f6b8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40f6b8
mov eax, dword [ebp - 4]
jmp 0x40f6d4
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40f695
mov eax, 0
leave
ret
Function at 0x10014cc3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10014d02
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10014d02
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10014d02
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10014d02
cmp dword [ecx + 0x74], 0xe
jbe 0x10014d02
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10017981
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10017a1e
push ebx
push esi
call fcn.1001794a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100178de
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100179cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017a1d
push edi
push eax
call fcn.1001893c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100179eb
call fcn.10016424
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017a1c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100178de
add esp, 0x20
test eax, eax
jne 0x10017a0a
push edi
call fcn.10016424
jmp 0x10017a12
push ebx
call fcn.10016424
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10017c8b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f678
push 0x1001f670
push str.FlsAlloc
push 0x1f
call fcn.10017ba7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017cbf
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e158]
call esi
jmp 0x10017cc5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10017d09
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f688
push 0x1001f680
push str.FlsGetValue
push 0x21
call fcn.10017ba7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017d40
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10017d48
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f690
push 0x1001f688
push str.FlsSetValue
push 0x22
call fcn.10017ba7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017d82
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001e158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001d420
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001d44d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001d44d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x75cf166e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x75cf30bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x75cf184f
test eax, eax
jne 0x75cf16bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x75cf1852
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x75cf184f
lea ecx, [ebp - 0x210]
cmp eax, ecx
je 0x75cf184f
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x210]
cmp ax, 0x41
jb 0x75cf16ee
cmp ax, 0x5a
jbe 0x75cf16f7
lea ecx, [eax - 0x61]
cmp cx, 0x19
ja 0x75cf171b
cmp word [ebp - 0x20e], 0x3a
jne 0x75cf171b
cmp word [ebp - 0x20c], 0x5c
jne 0x75cf184f
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
push 0x5c
pop edi
cmp ax, di
jne 0x75cf175d
cmp word [ebp - 0x20e], di
jne 0x75cf175d
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x75cf184f
add eax, 2
push edi
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x75cf184f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x75cf1787
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffef5
add eax, 0x10b
jmp 0x75cf1852
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
cmp esi, eax
jne 0x75cf179b
mov esi, eax
jmp 0x75cf179e
add esi, 0xfffffffe
cmp esi, dword [ebp - 0x214]
je 0x75cf184f
cmp word [esi], di
jne 0x75cf184f
cmp esi, dword [ebp - 0x214]
jbe 0x75cf184f
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x210]
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x75cf184f
movzx ebx, word [edi + 2]
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [edi + 2], bx
cmp eax, 0xffffffff
jne 0x75cf1816
mov esi, edi
cmp edi, dword [ebp - 0x214]
ja 0x75cf17bf
cmp esi, dword [ebp - 0x214]
jbe 0x75cf184f
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
jmp 0x75cf1837
test al, 0x10
jne 0x75cf1804
mov eax, 0x10b
jmp 0x75cf1852
cmp word [esi + 2], bx
je 0x75cf184b
push 0x5c
pop eax
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
je 0x75cf16b0
jmp 0x75cf1821
xor eax, eax
jmp 0x75cf1852
push 0x7b
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.75cd1295
leave
ret 4
Function at 0x100148d3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10014912
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10014912
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10014912
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10014912
cmp dword [ecx + 0x74], 0xe
jbe 0x10014912
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001758f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001762c
push ebx
push esi
call fcn.10017558
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100174ec
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100175d9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001762b
push edi
push eax
call fcn.1001854a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100175f9
call fcn.10016034
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001762a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100174ec
add esp, 0x20
test eax, eax
jne 0x10017618
push edi
call fcn.10016034
jmp 0x10017620
push ebx
call fcn.10016034
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10017899
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f678
push 0x1001f670
push str.FlsAlloc
push 0x1f
call fcn.100177b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100178cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e158]
call esi
jmp 0x100178d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10017917
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f688
push 0x1001f680
push str.FlsGetValue
push 0x21
call fcn.100177b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001794e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001e158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10017956
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f690
push 0x1001f688
push str.FlsSetValue
push 0x22
call fcn.100177b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017990
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001e158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001d010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001d03d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001d03d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402729
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402764
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402760
lea ebx, [ebx]
cmp esi, eax
jae 0x402764
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402750
cmp esi, eax
jb 0x40276a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x407c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x452cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x46eaa4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46eaa4]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
push 8
xor ebx, ebx
push str.vST13FZO
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.00403080
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push ebx
mov al, 0x6c
push ebx
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x70], ebx
mov byte [esp + 0x54], 0x6b
mov byte [esp + 0x55], 0x65
mov byte [esp + 0x56], 0x72
mov byte [esp + 0x57], 0x6e
mov byte [esp + 0x58], 0x65
mov byte [esp + 0x59], al
mov byte [esp + 0x5a], 0x33
mov byte [esp + 0x5b], 0x32
mov byte [esp + 0x5c], 0x2e
mov byte [esp + 0x5d], 0x64
mov byte [esp + 0x5e], al
mov byte [esp + 0x5f], al
mov byte [esp + 0x60], bl
call ebp
mov esi, eax
push 0x16de565f
push esi
call fcn.00403d70
push 0x1a4b89aa
push esi
mov dword [esp + 0x2c], eax
call fcn.00403d70
mov edx, dword [esp + 0x44]
lea eax, [edx*8 - 0x5f27204]
push eax
push esi
call fcn.00403d70
push 0x31cb1743
push esi
mov edi, eax
call fcn.00403d70
add esp, 0x20
push 0xa
push 0x4b60
push ebx
mov dword [esp + 0x20], eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x407d2b
cmp dword [esp + 0x38], 0x10
jb 0x407d24
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0040ce5b
add esp, 4
xor al, al
jmp 0x407e15
push esi
push ebx
call dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x14], eax
jne 0x407d54
cmp dword [esp + 0x38], 0x10
jb 0x407d24
mov edx, dword [esp + 0x24]
push edx
call fcn.0040ce5b
add esp, 4
xor al, al
jmp 0x407e15
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
push ebx
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x48], 0x74
mov byte [esp + 0x49], 0x61
mov byte [esp + 0x4a], 0x73
mov byte [esp + 0x4b], 0x6b
mov byte [esp + 0x4c], 0x6d
mov byte [esp + 0x4d], 0x67
mov byte [esp + 0x4e], 0x72
mov byte [esp + 0x4f], 0x2e
mov byte [esp + 0x50], 0x65
mov byte [esp + 0x51], 0x78
mov byte [esp + 0x52], 0x65
mov byte [esp + 0x53], bl
call ebp
test eax, eax
jne 0x407db3
lea ecx, [esp + 0x20]
call fcn.00402b80
xor al, al
jmp 0x407e15
push ebx
push 0x457dfc
call fcn.0043e197
add esp, 4
push eax
push str.8192
call fcn.0043e197
add esp, 4
or eax, 0x1000
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x34]
mov esi, eax
cmp esi, ebx
je 0x407da6
mov ecx, dword [esp + 0x14]
push edi
push ecx
push esi
call fcn.0043ed40
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x24]
push edi
push esi
push edx
push eax
call fcn.004032d0
add esp, 0x1c
call esi
lea ecx, [esp + 0x20]
call fcn.00402b80
mov al, 1
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0043d9be
add esp, 0x54
ret
Function at 0x409c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x452f48
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x46eaa4]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
mov eax, dword [0x46eaa4]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x148]
push edi
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x144], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x14c]
push ecx
mov ecx, esi
mov dword [esp + 0x14], 2
call fcn.00408af0
mov ebx, dword [esp + 0x144]
push 0
push 0
push edi
push ebx
lea edx, [esp + 0x3c]
push 1
lea ecx, [esi + 0x1b0]
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], edx
call fcn.00418db3
mov ecx, dword [esi + 0x1d0]
lea eax, [esp + 0x10]
push eax
push ebx
push 0x1306
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [edi - 0x10]
mov dword [esp + 0x13c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409d36
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0043d9be
add esp, 0x130
ret 0xc
Function at 0x40c730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4533d8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46eaa4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x20], 0
call fcn.00408af0
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
push 0xffff0002
push 0xffff0000
push 0
push 0
push 0
push eax
push eax
push esi
push 0x23
mov ecx, ebx
call fcn.00418cab
mov ebp, eax
push ebp
push ecx
mov dword [esp + 0x38], esp
add esi, 0xfffffff0
mov dword [esp + 0x38], esp
push esi
call fcn.00401740
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
add esp, 4
add eax, 0x10
push edx
mov dword [ecx], eax
push ebx
mov ecx, edi
call fcn.0040bd50
mov eax, dword [ebx + 0x20]
push ebp
push 2
push 0x1102
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c7ed
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10