joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c66ae
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x7c5078
xor eax, eax
movsx esi, cx
pop esi
jmp 0x6a897b
test esi, esi
je 0x68a1b6
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x68a1b0
ret
mov esp, ebp
pop ebp
jmp 0x6a5627
dec edi
add eax, edx
sub ebx, ebx
cmp di, sp
mov dword [ebp - 0xc], eax
stc
test edi, edi
jl 0x6a0df3
jmp 0x9441a1
push ebp
shr dx, cl
inc dl
mov ebp, esp
btr edx, ebx
sar edx, 0xad
bts edx, edx
mov edx, dword [ebp + 8]
cmc
test ebx, eax
sub esp, 0x114
push esi
test edx, edx
je 0x68a1b6
mov esi, dword [ebp + 0xc]
jmp 0x6a27e1
jne 0x68a1b6
mov ecx, dword [eax + 0x78]
test ah, 0x93
stc
mov dword [ebp - 4], ecx
clc
test ecx, ecx
jmp 0x7b9c1a
ja 0x8191bd
mov eax, esi
test dx, bx
sub eax, dword [ecx + edx + 0x10]
jmp 0x6a0dec
je 0x68a1b6
mov eax, dword [eax + 0x7c]
cmp bp, ax
cmp bx, 0x101c
push ebx
cmp si, cx
jmp 0x94272e
mov eax, dword [edx + 0x3c]
test sp, 0xef17
cmp al, bh
add eax, edx
test sp, bp
cmp dword [eax], 0x4550
jmp 0x6c670d
mov edi, dword [ecx + edx + 0x18]
cmp cx, di
clc
test esp, esi
test edi, edi
je 0x6a0df3
mov eax, dword [ecx + edx + 0x20]
jmp 0x6b8232
mov dword [ebp - 0x10], eax
stc
mov dword [ebp - 8], 0xffffffff
cmp bp, cx
cmp esi, 0xffff
jmp 0x78e241
push edi
stc
clc
jmp 0x8285dd

Function at 0x7139cb
Capabilities:
Encode data using xor

Disassembly:
mov ebp, edi
lea ebx, [edx*8 + 0xa0c821f]
mov dword [esp], edx
mov ebx, eax
and dword [esp], edx
mov eax, 0x44119c1d
inc dword [esp + eax - 0x44119c1d]
mov edx, ebx
sal edx, 2
mov eax, ebp
shl word [esp + 1], 0xef
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x713a2c
mov eax, 0x511f8811
xor eax, 0x4b33fb30
not ax
mov eax, dword [ebp + ebx*4]
push eax
push 0x8002f216
dec ebx
not dword [esp]
lea esp, [esp + 4]
jne 0x713a07
mov eax, 0x931cc708
xchg ah, al
mov eax, dword [ebp]
call eax
mov edi, 0x602fc4ac
push edi
mov ebp, dword [ebp + edi - 0x602fc4b0]
mov ebx, 0xbe1edc1a
pop edi
mov dword [ebp + edi - 0x602fc4ac], eax
movsx esi, di
mov edi, ebp
bswap esi
jmp 0x701f0c

Function at 0x793dbe
Capabilities:
Encode data using xor

Disassembly:
call fcn.006ebe8f
scasb al, byte es:[edi]
invalid
mov dword [esp], ebx
push 0x4b9a0ab1
movzx ebx, byte [eax]
xor ebx, edx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x7d3140]
not byte [esp]
shr edx, 8
xor edx, ebx
inc eax
shl dword [esp], 0xd0
ror byte [esp + 3], 2
xor edx, 0xb50f7816
sar dword [esp], 0x41
dec ecx
push 0xeea15b1f
lea esp, [esp + 8]
jne 0x793dc1
pop ebx
jmp 0x791864

Function at 0x7ac605
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [ebp + ecx - 0x6a17b426]
mov edi, 0x8b0a548e
mov dword [esp], edi
mov di, word [ecx]
add dword [esp], 0xf32aa48c
jl 0x7ce73c
mov dword ss:[edx], ecx
push 0xe93a5a10
lea esp, [esp + 4]
jmp fcn.006aa887
add ebp, 2
mov word [ebp], di
lea esp, [esp + 4]
jmp fcn.006945e8
Function at 0x7c94c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jb 0x68a0bc
push esi
bts ax, bp
movzx esi, cl
xor dh, 0xb4
rcr ax, 0x86
mov eax, 0x6c16c16d
cmc
shrd dx, ax, 8
and edx, 0x1b094fba
mul esi
sar eax, cl
bswap ax
cbw
mov eax, esi
shld si, dx, 0x9e
sub eax, edx
mov si, 0xae0d
shr eax, 1
xadd esi, esi
inc si
and si, 0xc312
lea eax, [eax + edx]
sar dx, cl
shr eax, 5
mov dx, 0xb326
movzx eax, al
mov edx, eax
sbb si, 0xcaa6
pop esi
test ebp, ecx
add cl, 0xd3
cmp dl, bh
clc
sub eax, 1
jne 0x68a0a0
mov dword [edi + 8], edx
test eax, ebp
cmp sp, 0x712b
cmp cx, ax
mov dword [edi + 4], 0
stc
cmp cl, 9
jb 0x68f409
movzx edx, cl
movsx eax, di
dec ah
rcr ah, cl
mov eax, 0x38e38e39
stc
test eax, 0x2f1603a7
mul edx
sbb ah, 0x80
rol eax, 0x3c
cmovge ax, cx
shr edx, 1
movzx eax, dl
mov edx, eax
cmc
cmp di, 0x2539
clc
lea ecx, [ecx]
jmp 0x82558b
movzx eax, byte [edi]
call fcn.00947d81
jmp 0x839f76
jmp 0x7a533b
mov word [edi], ax
call fcn.007baa58
mov word [edi], dx
call fcn.0093bee9
syscall
call fcn.0083e108
call fcn.006e8d06
mov eax, 0x57912fad
add ax, ax
mov edx, dword [eax + ebp - 0x57915f5a]
neg eax
add ebp, 4
bswap eax
neg ax
jb 0x6c49d5
cmp cl, 0x2d
jmp 0x68a03d
push 0xb53f5e39
add edi, 4
sar word [esp + 1], 0x81
ror byte [esp + 1], 0xe6
and edx, esi
push 0x3bb2fb1e
not edx
jmp 0x6f1698

Function at 0x7d077e
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x5c
scasb al, byte es:[edi]
test dh, bh
retf 0x6791
sbb byte [eax + 0x66], 0x54
cmpsb byte [esi], byte es:[edi]
or ebp, dword [edi]
invalid
js 0x7d06f7
jmp 0x7d06e3
call fcn.0069788a
rol dword [esp + 8], 0xf2
rol cl, 1
xor bl, cl
lea ecx, [esp + ecx + 0xc]
push 0x7ab55608
mov dword [ecx], esi
call fcn.007a965e
inc ecx
imul ebx, dword [ebx - 0x2e], 0xacb58c3d
inc edx
xchg ebx, eax
mov al, byte [0x5bf36241]
jp 0x7d07c6
cdq
jo 0x7d0750
sub eax, 0xe52330ad
mov dl, 0x3d
or byte [ebx + 0x1bc0a4fe], al
mov dl, 0xca
mov dh, 0x11
ret 0x55f7
cmp eax, 0x4cc9cbde
mov word [eax - 0x11], gs
pop edx
xchg ebp, eax
and dword [edx], esi
mov bh, 0x51
push 0xca3f2c58
add eax, dword [esi - 0x29]
std
add al, 3
dec ebx
in eax, dx
and al, 0xf0
popal
ljmp 0xd0f6

Function at 0x815c1d
Capabilities:
Encode data using xor

Disassembly:
sbb edi, 0xc
push 0x2b0a23b3
mov dword [edi + 0xc], eax
push 0x900ba19d
mov dword [edi + 8], ebx
mov dword [edi + 4], ecx
mov dword [esp + 8], 0x8baee50d
mov ebx, 0xdb0dd93
call fcn.006d9230
fstp qword [eax - 0x32]
xchg ebx, eax
xchg ebx, eax
sti
pop edi
das
xchg ebp, eax
pop esp
scasb al, byte es:[edi]
pop es
mov ebx, 0xf5532bab
xor al, 0xd2
jnp 0x815c4c
lahf
das
pop edi
aad 0x9a
xchg edx, eax
cmp dword [esi], 0xa59e0f98
ret
Function at 0x8338a3
Capabilities:
Check for software breakpoints

Disassembly:
inc ecx
mov eax, 0xdd8260ac
dec esp
mov eax, dword [ebp]
mov edx, 0x9ba48d03
dec eax
mov dword [esp], edx
mov edx, dword [ebp + 8]
dec eax
add ebp, 0xc
call fcn.006b8d76
jecxz 0x8338f2
insb byte es:[edi], dx
popfd
sahf
pcmpgtb mm3, mm5
inc ecx
mov al, byte [0xce56ab63]
daa
outsb dx, byte [esi]
insd dword es:[edi], dx
popfd
dec edi
push esi
stosd dword es:[edi], eax
inc edx
push es
mov al, byte [0xfa053602]
jnp 0x833911
push dword [0xadb78eb2]
xchg edx, eax
mov dh, 0xa9
movsd dword es:[edi], dword [esi]
mov edi, 0x47a92892
inc edi
sahf
cmp dword [esi - 0x329dccc6], edx
mov eax, dword [eax + 0x1c3ba9af]
push ds
test al, 0xff
mov ebp, 0x9498d976
lahf
xor dword [0x42cf69a4], ecx
mov dword [ebp - 0x4a4013de], esp
outsd dx, dword [esi]
out dx, ax
movsd dword es:[edi], dword [esi]
and ch, ah
mov edi, 0xef666fb5
sub al, byte [ebx]
fldenv [edi]
movsb byte es:[edi], byte [esi]
sub eax, 0x4ae4a6ee
inc edx
or dword [ebp + 0x1e], esp
and byte [edi + 0x36], dl
cmp al, cl
sbb dword [ecx], edi
cmp al, 0xcc
dec ebx
mov ah, 0x95
insd dword es:[edi], dx
mov ah, cl
loope 0x83392b
enter 0x3919, 0x3c
int3
aas
out dx, eax
push 0xb9cae0dd
sbb al, 0xe2
rcr dword [ebx], cl
invalid
Function at 0x93ea9c
Capabilities:
Encode data using xor

Disassembly:
jae 0x824781
loop 0x672f54
push esp
pop edi
push edx
jb 0x672f7d
inc edi
mov ebx, 0x1eceb107
sbb al, 0x3f
outsb dx, byte [esi]
stc
cmp bl, byte [ebx - 0x6f992185]
lahf
mov edi, 0xc9d57aef
add ebp, dword [eax + 0x6f]
scasb al, byte es:[edi]
xchg ecx, eax
add dword [esi - 0x2a068511], edi
inc ebp
adc ch, al
dec edi
sub byte [ebp - 0x2a9d7294], bl
invalid
sbb eax, 0x7aefbfac
popfd
nop
scasd eax, dword es:[edi]
aas
inc ebp
adc byte [ebp - 0x47d95a70], al
mov ah, 0xd8
out 0xbe, eax
out dx, eax
cli
insd dword es:[edi], dx
out 0xde, al
mov edi, 0x26e1954e
inc edi
ret
push ecx
pop edx
cwde
rcr esp, cl
shr ebp, 0x5b
wait
out dx, eax
imul edi, ecx, 0xfffffff6
outsb dx, byte [esi]
adc al, 0x73
sbb ch, byte [ecx - 0x59843496]
cmp ch, byte ss:[esi - 0x6e3424dc]
fcmovne st(0), st(3)
xchg ecx, eax
mov ah, 0xb6
sbb edi, dword ds:[esi + 0x26e8faef]
cmp al, 0xf5
mov ah, 0x13
out dx, eax
scasb al, byte es:[edi]
push esp
xor esi, dword [edx - 0x7b]
jp 0x672f97
sti
pop ebp
loop 0x67302d
mov dword [eax + edi*8 + 0x40], ebx
jns 0x672fe9
arpl word [edi], cx
rcr esi, cl
jecxz 0x672fcf
or eax, 0x40592244
mov esp, ebp
inc eax
add al, 0xb5
imul ebx, eax, 0xc
xor al, 0xc6
inc esp
aas
add al, 0x92
xchg edx, eax
dec esp
aas
mov ah, 0x38
sub eax, dword [ecx + ecx*8 - 0x41]
and edi, ebp
int3
outsd dx, dword [esi]
mov eax, dword [esi + 0x16092785]
pop eax
pop edi
test dword [ebx], ebp
lahf
sbb eax, 0x274007a7
pop esp
inc eax
cld
fbld tbyte [ecx]
sbb dword [edi + eax], ecx
bound eax, qword [eax - 0x23]
dec ecx
aaa
push edi
aas
invalid
lodsb al, byte [esi]
wait
pushal
push ebp
daa
out dx, eax
push 0xffffffffffffff91
jg 0x6730ae
shl edx, 1
loopne 0x672fd1
stc
pop es
wait
sal byte [eax + 0x3e], 0x89
pop ds
js 0x6730af
cmpsb byte [esi], byte es:[edi]
dec edi
cli
cdq
push esi
fcmovu st(0), st(4)
jmp 0x4ae0b61a
inc edx
mov edx, 0x55aeb7e0
dec esi
pop ebx
arpl word [edx - 0x76], si
fidivr dword [esi - 0x24]
retf
rol cl, 0x43
mov cl, byte [edi + 2]
jae 0x672ef9
mov edx, dword [ebp + 4]
push 0xc210d898
add ebp, 8
push 0xdb998688
mov dword ss:[esi], edx
lea esp, [esp + 8]
jmp fcn.006aa887
call fcn.00680c3b
movzx ax, byte [edi]
mov ecx, 0xa78f3e8d
jmp 0x6b8d91
Function at 0x946826
Capabilities:
Encode data using xor

Disassembly:
ret
cmp ah, ch
dec eax
mov ebx, dword [esp + 8]
dec eax
mov dword [esp + 8], 0x2f9c75dd
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.006b50b1
std
sbb ebp, eax
sub eax, 0x16e29abf
xchg esi, eax
push cs
mov al, byte [0x61515e3]
and eax, 0x1e2185e8
aad 0x24
outsb dx, byte [esi]
test eax, eax
inc ecx
pop ebp
mov esi, 0x997bb475
jle 0x94685f
jle 0x94679d
leave
int3
nop
mov byte [0xc0339a9c], al
cwde
mov word [esi], gs
sub esi, dword [ebx + 0x7d]
sbb dh, al
adc ah, byte [ebp + 0x6e]
inc edi
push esi
pop ebx
mov ah, byte [ecx + 0x68]
adc cl, bh
mov esp, 0x240cff0e
jg 0x68e224
xor al, 0x13
call fcn.007d1d17
push edx
jbe 0x9467bb
pop esp
sbb ebp, edi
mov ch, 0xe2
jae 0x94687c
lahf
sub cl, byte [edx]
vmptrst qword [edi + 0x22ce995b]
sbb dh, ch
sbb esp, esp
jns 0x946802
insb byte es:[edi], dx
stosb byte es:[edi], al
invalid
mov dh, 0xed
invalid
add cl, byte [esi - 7]
sbb al, 0x3a
sub byte [eax - 0xd], bl
cmp dword [edi - 0x34], edi
and eax, 0x31b858b5
mov esi, 0x2aa73f33
scasb al, byte es:[edi]
int1
jb 0x9468d0
cmpsb byte [esi], byte es:[edi]
push ss
out 0xec, eax
aaa
invalid
cmpsd dword [esi], dword es:[edi]
push cx
stosb byte es:[edi], al
sti
stosd dword es:[edi], eax
mov dword [esp + ebx - 0x19], 0x6a261b3e
invalid
aaa
mov word [edx], ds
jno 0x946877
xlatb
jno 0x9468a9
lodsb al, byte cs:[esi]
dec ebp
sbb bl, byte [esi - 0x38e36bbb]
inc ebp
xchg esp, eax
sbb al, 0xc7
xchg edx, eax
push 0xb7a4d4a9
jo 0x9468cf
jno 0x946900
ret 0x2ef5
sbb al, al
insd dword es:[edi], dx
cli
stc
pop ebx
jne 0x9468aa
salc
inc esp
mov edi, 0xbe251be
stosd dword es:[edi], eax
outsb dx, byte [esi]
mov cs, edx
in al, dx
sti
ja 0x946975
inc edx
feni8087_nop
cmp ecx, dword [esi + 0x25f88b6]
ja 0x94695d
dec edx
add al, 0x86
invalid
cmc
xor ebx, dword [esi]
sbb eax, 0x9e1d1f70
jno 0x9468c1
les esi, [esi + 0x559a17b5]
sti
and eax, 0x7a2d4f6b
xchg esi, eax
mov ah, 0xa7
mul byte [ecx - 0xe]
sub esp, dword [ebx + 0x4a966a5a]
lodsb al, byte [esi]
wait
daa
popfd
pop edx
arpl word [eax], sp
dec ebp
jge 0x9469d6
push ss
ja 0x9469c9
pop edi
aam 0x31
and ecx, esi
adc dword [ebx - 0x6c], esi
sbb dh, byte [esi + 0x619bd878]
outsb dx, byte [esi]
jae 0x94692f
jge 0x9469f1
fdivr st(2), st(0)
sar byte [eax + esi*4 + 0x2288b3d3], cl
pop esp
mov ecx, 0x66dc6b3d
invalid
arpl word [esi + edi*8 - 6], dx
push ebx
sbb dword [ebp - 0x2d218f31], ebx
mov al, byte [0x256e891f]
pop ds
mov dword [esi + 0x25], ebp
stosd dword es:[edi], eax
out dx, al
push ecx
xor ch, byte [ecx + 0x10]
je 0x9469e9
call 0x32e65916
inc ebp
dec edi
cmp bl, byte [edi + 0x11]
enter 0xffffffffffffb1ba, 0xfffffffffffffff2
adc cl, byte ss:[eax - 0x28]
sbb si, word ss:[edx + edi*4]
not byte [edx]
scasb al, byte es:[edi]
int 3
sub bl, bl
sbb eax, 0x76cdae10
dec esp
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
salc
out 0xc9, al
test dword [esi], ecx
out dx, al
push ecx
xor dh, byte [0xc0e21fa6]
xchg edx, eax
in eax, dx
retf 0x610f
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x2cbc7920
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x218379a0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10295e42
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10295e81
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10295e81
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10295e81
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10295e81
cmp dword [ecx + 0x74], 0xe
jbe 0x10295e81
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10298f61
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10298ffe
push ebx
push esi
call fcn.10298f2a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10298ebe
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10298fab
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10298ffd
push edi
push eax
call fcn.10296957
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10298fcb
call fcn.1029691d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10298ffc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10298ebe
add esp, 0x20
test eax, eax
jne 0x10298fea
push edi
call fcn.1029691d
jmp 0x10298ff2
push ebx
call fcn.1029691d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1029926b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102a1558
push 0x102a1550
push str.FlsAlloc
push 0x1f
call fcn.10299187
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1029929f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1029f13c]
call esi
jmp 0x102992a5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x102992e9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102a1568
push 0x102a1560
push str.FlsGetValue
push 0x21
call fcn.10299187
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10299320
push dword [ebp + 8]
mov ecx, esi
call dword [0x1029f13c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10299328
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102a1570
push 0x102a1568
push str.FlsSetValue
push 0x22
call fcn.10299187
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10299362
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1029f13c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1029e3d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1029e3fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1029e3fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010b0
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x88d4dc], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 8], eax
jne 0x4010db
push str.hokuxeyidofap_lafegohawuzusatuxakoterasiva_purumogihali
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov ecx, dword [0x46ecb8]
mov ebx, dword [0x46ecbc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], ecx
call fcn.004010a0
mov edx, dword [0x46ecc0]
mov eax, dword [0x46ecc4]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov edi, 0x20
jmp 0x401120
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x88d4dc]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401186
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 0x34]
push edx
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], cx
mov eax, dword [ebp - 0x1c]
push eax
push ecx
push str.dojizilujidufarekezurutiric
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov eax, dword [ebp - 4]
mov ecx, dword [0x88d4dc]
add eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x4011a0
mov dword [0x88d4d8], 0xedeb2e40
jmp 0x4011c2
cmp ecx, 0x3eb
jne 0x4011c2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x88ce8c], 0
mov ecx, dword [ebp - 0x18]
add ecx, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
mov edx, esi
shr edx, cl
mov dword [0x88d4d4], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov edx, dword [ebp - 8]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, ebx
xor eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ecx
sub esi, ecx
call fcn.00401090
sub edi, 1
jne 0x401120
cmp dword [0x88d4dc], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x401279
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405fbc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46ea40]
jne 0x405fc6
repz ret
jmp fcn.004073d8

Function at 0x4061fe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402cda
and dword [ebp - 4], 0
cmp dword [0x46f910], 0
mov ebx, eax
jne 0x4062af
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406360
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406360
push eax
call fcn.00402c68
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46f910], eax
call esi
push eax
call fcn.00402c68
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46f914], eax
call esi
push eax
call fcn.00402c68
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46f918], eax
call esi
push eax
call fcn.00402c68
pop ecx
mov dword [0x46f920], eax
test eax, eax
je 0x4062af
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402c68
pop ecx
mov dword [0x46f91c], eax
mov eax, dword [0x46f91c]
cmp eax, ebx
je 0x406307
cmp dword [0x46f920], ebx
je 0x406307
push eax
call fcn.00402ce3
push dword [0x46f920]
mov esi, eax
call fcn.00402ce3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406307
test edi, edi
je 0x406307
call esi
test eax, eax
je 0x4062fe
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4062fe
test byte [ebp - 0xc], 1
jne 0x406307
or dword [ebp + 0x10], 0x200000
jmp 0x406340
mov eax, dword [0x46f914]
cmp eax, ebx
je 0x406340
push eax
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406340
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406340
mov eax, dword [0x46f918]
cmp eax, ebx
je 0x406340
push eax
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406340
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f910]
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406360
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406362
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret