joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434278
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4342ad
cmp edi, dword [esi + 0xc]
jge 0x4342ad
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4342ad
cmp edi, dword [eax + 8]
jge 0x4342ad
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4342af
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4343b3
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4343e7
jmp fcn.0042956c
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x434458
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x434551
cmp eax, dword [edi + 0xc]
jge 0x434551
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4344a9
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x43453a
cmp dword [ebp + 0xc], ebx
je 0x43453a
jmp 0x4344d3
push 0x10
call fcn.00434144
cmp eax, ebx
je 0x4344bf
mov ecx, eax
call fcn.004343aa
mov esi, eax
jmp 0x4344c1
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4344ea
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4344fa
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x43450c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0042956c
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0041c980
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x43454c
cmp ecx, dword [esi + 8]
jge 0x43454c
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x434552
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x434610
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43463e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43465c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043457a
jmp 0x43465c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43465c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043457a
test edi, edi
mov eax, edi
jne 0x434646
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4491a4]
test ecx, ecx
je 0x43470f
jmp 0x43460f
ret 8
Function at 0x6d3db325
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x6d3db334
pop dword [ebp - 0x30]
mov eax, 0xab418da8
sub eax, 0x3e03da74
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa19158f9
sub dword [ebp - 0x40], 0x533f13ae
mov dword [ebp - 0x3c], 0x25097c5b
sub dword [ebp - 0x3c], 0xf2d63016
mov dword [ebp - 0x38], 0xb4cca368
sub dword [ebp - 0x38], 0x68805f3a
mov dword [ebp - 0x34], 0x1fb64bd5
add dword [ebp - 0x34], 0xe049b42b
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb16d7af0
sub dword [ebp - 0x40], 0x3cfb119a
mov dword [ebp - 0x3c], 0xcbb422e3
add dword [ebp - 0x3c], 0x75b83e92
mov dword [ebp - 0x38], 0xf5788a8c
sub dword [ebp - 0x38], 0x92091e20
mov dword [ebp - 0x34], 0x94dca45f
sub dword [ebp - 0x34], 0x94dca45f
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x3dd26a1c
add eax, 0x2f6b7638
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3db49
push 0
call eax
mov ecx, 0x19ad1fe9
sub ecx, 0x19acdaf7
xor edi, edi
add edi, eax
mov ebx, 0x5caead95
sub ebx, 0xef701195
add ebx, dword [ebp - 0x30]
mov esi, 0xf21c7298
sub esi, 0xa3bbbfff
mov edx, dword [ebx]
sub dword [ebp - 0x14], 0x162b6f67
add edx, esi
xor dword [ebp - 0x28], 0xdf5313fe
mov dword [edi], edx
mov dword [ebp - 0x1c], 0x271b4a27
add edi, 4
add ebx, 4
loop 0x6d3db453
add eax, 0xc91e2553
sub eax, 0xc91d1eb8
mov ebx, eax
add eax, 0x4ebbc0e2
add eax, 0xb1443f23
mov ecx, 0x6d3c0000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x6d3dd4ec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d3e5200]
jne 0x6d3dd4f6
repz ret
jmp fcn.6d3dd963
Function at 0x1006902
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x10098e8]
mov eax, dword [0x1008034]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], edi
jae 0x1006ae8
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x1009900]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x424], ebx
je 0x1006ae8
and dword [ebp - 0x414], 0
and dword [ebp - 0x420], 0
cmp dword [ebp + 0x10], 0
jne 0x1006973
xor eax, eax
jmp 0x1006afc
test al, 0x20
je 0x1006986
push 2
push 0
push 0
push ecx
call fcn.01006538
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1006a46
and dword [ebp - 0x40c], 0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x410], edi
jbe 0x1006ac2
mov ecx, dword [ebp - 0x410]
xor edi, edi
sub ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x10069f5
mov edx, dword [ebp - 0x410]
inc dword [ebp - 0x410]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x10069e3
inc dword [ebp - 0x420]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x424]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x10069bf
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006a74
mov eax, dword [ebp - 0x418]
add dword [ebp - 0x414], eax
cmp eax, edi
jl 0x1006a80
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp + 0x10]
jb 0x10069ab
jmp 0x1006a80
push 0
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006a74
mov eax, dword [ebp - 0x418]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], eax
jmp 0x1006a80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x1006ae0
cmp dword [ebp - 0x40c], eax
je 0x1006abc
push 5
pop eax
cmp dword [ebp - 0x40c], eax
jne 0x1006aae
mov dword [0x10085ac], 9
mov dword [0x10085b0], eax
jmp 0x1006af9
push dword [ebp - 0x40c]
call fcn.010065de
pop ecx
jmp 0x1006af9
mov edi, dword [ebp - 0x41c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1006ad4
cmp byte [edi], 0x1a
je 0x100696c
mov dword [0x10085ac], 0x1c
jmp 0x1006af2
sub eax, dword [ebp - 0x420]
jmp 0x1006afc
mov dword [0x10085ac], 9
and dword [0x10085b0], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001d56
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x410a13
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410884

Function at 0x410e0d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00405440
mov eax, dword [0x459500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0040fa79
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x410e4f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x410fab
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041ae90
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x45aee0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00411e04
mov ecx, dword [esi*4 + 0x45aee0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x410fa4
cmp eax, dword [edi + ecx + 0x24]
jne 0x410fa4
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410fa4
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00411e04
add esp, 0x14
test edx, edx
jl 0x410fa4
jg 0x410f1a
test eax, eax
jb 0x410fa4
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x410fa4
jl 0x410f34
cmp dword [ebp - 0x1008], eax
ja 0x410fa4
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x410f52
test ebx, ebx
je 0x410f8b
cmp ecx, edi
jae 0x410f8b
mov al, byte [ecx]
cmp al, 0xd
jne 0x410f6c
lea eax, [edi - 1]
cmp ecx, eax
jae 0x410f78
cmp byte [ecx + 1], 0xa
jne 0x410f78
inc ecx
jmp 0x410f78
movzx eax, al
movsx eax, byte [eax + 0x4597b8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x410f52
cmp edx, ebx
jne 0x410f52
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x410fa9
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404956
leave
ret
Function at 0x4112a2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x45aee0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4112e2
cmp byte [ebx], 0xa
jne 0x4112e2
or byte [eax + edi + 0x28], 4
jmp 0x4112e7
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4113e5
mov al, byte [edx]
cmp al, 0x1a
je 0x4113c7
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x411316
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41133b
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x411345
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4112f8
jmp 0x4113e5
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4113c2
cmp dword [ebp - 0xc], 0
je 0x4113c2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x45aee0]
test byte [eax + edi + 0x28], 0x48
je 0x41139c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x411387
mov byte [esi], dl
jmp 0x411398
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x45aee0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4113e5
cmp byte [ebp - 1], 0xa
jne 0x4113ab
cmp esi, ebx
jne 0x4113ab
mov byte [esi], 0xa
jmp 0x4113e4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00411e22
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4113e5
mov byte [esi], 0xd
jmp 0x4113e4
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x45aee0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4113e1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4113e5
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4113ee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x45aee0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411431
cmp word [esi], dx
jne 0x411431
or byte [edi + eax + 0x28], 4
jmp 0x411436
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x411589
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x411569
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x411478
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4114ae
cmp eax, edx
jae 0x4114ba
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x411450
jmp 0x411589
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411565
cmp dword [ebp - 0x14], 0
je 0x411565
mov eax, dword [ebx*4 + 0x45aee0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41153d
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x411506
mov word [esi], cx
jmp 0x411539
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x45aee0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x45aee0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x45aee0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x411589
pop ebx
cmp word [ebp - 4], bx
jne 0x41154e
cmp esi, dword [ebp + 0xc]
jne 0x41154e
mov word [esi], bx
jmp 0x411586
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00411e22
add esp, 0x10
cmp word [ebp - 4], bx
je 0x411589
push 0xd
jmp 0x411582
mov ecx, dword [ebx*4 + 0x45aee0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411580
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411589
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4151e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415283
push ebx
push esi
call fcn.004151af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00413e34
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x415230
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415282
push edi
push eax
call fcn.00412001
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x415250
call fcn.0040efd8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415281
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00413e34
add esp, 0x20
test eax, eax
jne 0x41526f
push edi
call fcn.0040efd8
jmp 0x415277
push ebx
call fcn.0040efd8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41ae50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ae7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ae7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41c20e
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40
push 0x1000
mov ebx, 0x4ac
xor ebp, ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov edi, 0x459038
mov esi, eax
push edi
call fcn.0041c168
push ebx
push edi
push esi
call fcn.00405470
add esp, 0x14
call fcn.0041c14e
push ebp
push ebp
push 0x427038
lea eax, [esi + 0x188]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000103b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001072
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1000106e
jmp 0x10001060
cmp esi, eax
jae 0x10001072
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001060
cmp esi, eax
jb 0x10001079
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007800
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024dd8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100365e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea ecx, [ebp - 0xd]
call fcn.1000de60
mov esi, dword [ebp + 8]
push 0x11c
push 0
push esi
mov dword [ebp - 4], 0
call fcn.10013ff0
add esp, 0xc
push esi
mov dword [esi], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0xd]
test eax, eax
je 0x1000791b
push 0x6265
call fcn.1000df00
push eax
push 0x6275
lea ecx, [ebp - 0xd]
call fcn.1000df60
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x10007898
mov ecx, dword [ebp + 0xc]
push ecx
call eax
jmp 0x100078a2
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x10], 2
jne 0x10007918
cmp dword [esi + 4], 4
jbe 0x10007918
push 0x6266
lea ecx, [ebp - 0xd]
call fcn.1000df00
push eax
push 0x6275
lea ecx, [ebp - 0xd]
call fcn.1000df60
push eax
call edi
push eax
call ebx
test eax, eax
je 0x100078e7
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 8]
push ecx
mov ecx, dword [esi + 4]
push 0
push 0
push edx
push ecx
call eax
jmp 0x100078f0
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
lea ecx, [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
call fcn.10001110
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
call fcn.10001110
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000b4c2
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1000b491
cmp eax, 2
jne 0x1000b4ac
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x1000b4bc
test eax, eax
je 0x1000b4b7
test al, 1
jne 0x1000b4ac
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x1000b4bc
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1000b4f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100365e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.1000b3a0
mov ebx, eax
cmp ebx, esi
je 0x1000b56a
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x1000b555
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012e4f
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov dword [ebp - 0x214], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1000b5ec
mov edi, edi
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x210]
call fcn.1000b4f0
mov ebx, eax
cmp ebx, esi
jne 0x1000b544
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
push edx
mov dword [ebp - 0x214], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1000b5a0
mov eax, dword [ebp - 0x210]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x1000b605
push eax
call ebx
mov dword [ebp - 0x210], esi
mov eax, dword [ebp - 0x218]
push eax
mov ecx, edi
mov dword [ebp - 0x20c], esi
call fcn.1000b320
mov edi, eax
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x1000b628
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012e4f
mov esp, ebp
pop ebp
ret 4