joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002630
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x1000266f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x10], ecx
jge 0x1000278b
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x100026fc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x100026f7
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100026d0
xor eax, eax
jmp 0x10002790
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.100045b0
add esp, 0xc
jmp 0x1000265d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10002610
add esp, 8
test eax, eax
jne 0x1000271d
xor eax, eax
jmp 0x10002790
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10002754
xor eax, eax
jmp 0x10002790
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10004030
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x1000265d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100128ef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10012765

Function at 0x10017e40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10017e6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10017e6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4017c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401810
xor eax, eax
jmp 0x4018f1
jmp loc.0045d80b
mov esp, ebp
pop ebp
ret

Function at 0x401ad0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
jmp loc.0045b96c

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x2f420d37
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x33f21749
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100075f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100075ff
pop dword [ebp - 8]
mov eax, 0x2633b60
sub eax, 0xf262c561
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x395fe
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x444d
mov esi, eax
mov edx, 0xcfd651e4
add edx, 0x402d6e1c
add edx, dword [ebp - 8]
mov edi, 0xd2257826
add dword [ebp - 4], ebx
mov ebx, dword [edx]
xor dword [ebp - 4], 0x34df8135
add ebx, edi
mov dword [ebp - 4], 0x977f209e
mov dword [esi], ebx
sub dword [ebp - 4], edi
add esi, 0x6640ee97
add esi, 0x99bf116d
add edx, 0x15cfd58d
sub edx, 0x15cfd589
loop 0x1000764d
add eax, 0x10407
mov ebx, eax
add eax, 5
mov ecx, 0x5e5bf37b
add ecx, 0xb1a40c85
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100085e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x100351ec], 0x10008580
mov eax, dword [0x10034e40]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x24], 0
je 0x10008610
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
push eax
call sym.glut32.dll_glutInit
add esp, 4
push 0x34
call fcn.1000f203
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10008630
push str.out_of_memory.
call sym.glut32.dll_glutInit
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
call sym.glut32.dll_glutInit
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10008666
push str.lacks_overlay_support.
call sym.glut32.dll_glutInit
add esp, 4
xor eax, eax
mov al, byte [0x10030640]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [0x10034cd0]
push eax
call sym.glut32.dll_glutInit
add esp, 0x10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x100086a1
push 0x1003096c
call sym.glut32.dll_glutInit
add esp, 4
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call sym.glut32.dll_glutInit
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [0x10034cd0]
push eax
call sym.glut32.dll_glutInit
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x70]
and ecx, 0x28030
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 8]
cmp dword [edx + 0x5c], 0
je 0x10008723
push 3
push 0
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x68], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x24], edx
push 1
call sym.glut32.dll_glutInit
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x1000877f
push 0x404
call dword [sym.imp.OPENGL32.dll_glDrawBuffer]
push 0x404
call dword [sym.imp.OPENGL32.dll_glReadBuffer]
mov esp, ebp
pop ebp
ret
Function at 0x10008a30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10034e40]
cmp dword [eax + 0x24], 0
jne 0x10008a4d
push str.glutHideOverlay:_window_has_no_overlay_established
call sym.glut32.dll_glutInit
add esp, 4
jmp 0x10008a72
push 0
mov ecx, dword [0x10034e40]
mov edx, dword [ecx + 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x10034e40]
mov edx, dword [ecx + 0x24]
mov dword [edx + 0x20], 0
pop ebp
ret

Function at 0x1000a670
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [0x10034cc0], 0
je 0x1000a690
mov ecx, dword [0x10034cc0]
mov dword [ebp - 8], ecx
jmp 0x1000a697
mov dword [ebp - 8], str._unamed_
mov edx, dword [ebp - 8]
push edx
push str.GLUT:_Fatal_Error_in__s:
push 0x10031bb8
call fcn.10010150
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x10031bb8
call fcn.10010115
add esp, 0xc
mov dword [ebp - 4], 0
push 0x10031bb8
push 0xa
call fcn.10010105
add esp, 8
cmp dword [0x10034cf8], 0
je 0x1000a6ec
push 1
call dword [0x10034cf8]
add esp, 4
push 1
call fcn.1000fa87
mov esp, ebp
pop ebp
ret
Function at 0x1007a10c
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 0xc], ecx
jle 0x1007a132
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
movsx eax, byte [ecx + edx]
xor eax, 0xffffff80
shl eax, 0x18
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [esp + 0x10]
jl 0x1007a11d
pop esi
ret

Function at 0x1007ed43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1007ed52
pop dword [ebp - 0x48]
mov eax, 0x1007ed52
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x32b6f48e
sub dword [ebp - 0x58], 0xe464af43
mov dword [ebp - 0x54], 0xf2ca3d89
sub dword [ebp - 0x54], 0xc096f144
mov dword [ebp - 0x50], 0x667ef08f
add dword [ebp - 0x50], 0xe5cd539f
mov dword [ebp - 0x4c], 0x231df6d9
sub dword [ebp - 0x4c], 0x231df6d9
lea eax, [ebp - 0x58]
push eax
mov eax, 0x99eb3658
add eax, 0x761d39dc
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x968a2d03
sub dword [ebp - 0x58], 0x2217c3ad
mov dword [ebp - 0x54], 0x7faee38c
add dword [ebp - 0x54], 0xc1bd7de9
mov dword [ebp - 0x50], 0x664076f6
sub dword [ebp - 0x50], 0x2d10a8a
mov dword [ebp - 0x4c], 0x1dfd43d3
add dword [ebp - 0x4c], 0xe202bc2d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xa7e59818
add eax, 0x6822d80c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3de03
push 0
call eax
mov ecx, 0x55f4bfea
sub ecx, 0x55f47607
mov ebx, eax
mov esi, 0x7747e9a9
add esi, 0x98c3a657
add esi, dword [ebp - 0x48]
mov edx, 0x3c9564bd
sub dword [ebp - 0x18], 0xd61243ad
mov edi, dword [esi]
sub dword [ebp - 0x44], 0x9dd632e2
sub edi, edx
mov dword [ebp - 0x14], 0xb7f7349f
mov dword [ebx], edi
xor dword [ebp - 0x38], ebx
add ebx, 4
add esi, 4
loop 0x1007ee69
add eax, 0xb5015234
sub eax, 0xb50037d5
xor ebx, ebx
add ebx, eax
add eax, 0x956231f5
add eax, 0x6a9dce10
mov ecx, 0x91f942b2
add ecx, 0x7e06bd4e
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002aaee
pop dword [ebp - 0x28]
mov eax, 0xd768f524
add eax, 0x3899b5ca
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe191d275
add dword [ebp - 0x38], 0x6cc072d6
mov dword [ebp - 0x34], 0x7ff0268f
sub dword [ebp - 0x34], 0x4dbcda4a
mov dword [ebp - 0x30], 0x2f109bc7
add dword [ebp - 0x30], 0x1d3ba867
mov dword [ebp - 0x2c], 0xbcb02dcb
add dword [ebp - 0x2c], 0x434fd235
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x8a7d833
sub dword [ebp - 0x38], 0x94356edd
mov dword [ebp - 0x34], 0xca5d9814
add dword [ebp - 0x34], 0x770ec961
mov dword [ebp - 0x30], 0x8e17fe7c
add dword [ebp - 0x30], 0xd5576df0
mov dword [ebp - 0x2c], 0xbd012a96
add dword [ebp - 0x2c], 0x42fed56a
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38d18
push 0
call eax
mov ecx, 0x5167
xor edx, edx
add edx, eax
mov edi, 0x821289dc
add edi, 0x8df10c24
add edi, dword [ebp - 0x28]
mov esi, 0xb5d2b89d
xor dword [ebp - 0x14], eax
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0x5a2481a5
sub ebx, esi
sub dword [ebp - 0x20], eax
mov dword [edx], ebx
mov dword [ebp - 0x18], 0x111543b3
add edx, 4
add edi, 0x49a2222d
add edi, 0xb65dddd7
loop 0x1002abfc
add eax, 0xf37bab18
add eax, 0xc858d57
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10034da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10034daf
pop dword [ebp - 0x40]
mov eax, 0x10034daf
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xed87544a
add dword [ebp - 0x50], 0x60caf101
mov dword [ebp - 0x4c], 0xe07e18f8
sub dword [ebp - 0x4c], 0xae4accb3
mov dword [ebp - 0x48], 0xa1d28532
sub dword [ebp - 0x48], 0x55864104
mov dword [ebp - 0x44], 0xc625b2c1
sub dword [ebp - 0x44], 0xc625b2c1
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x7f702f74
add dword [ebp - 0x50], 0xf50239e2
mov dword [ebp - 0x4c], 0x6f16273e
add dword [ebp - 0x4c], 0xd2563a37
mov dword [ebp - 0x48], 0x38ca1aa7
add dword [ebp - 0x48], 0x2aa551c5
mov dword [ebp - 0x44], 0x318dc44c
sub dword [ebp - 0x44], 0x318dc44c
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x47248
push 0
call eax
mov ecx, 0x562cb853
add ecx, 0xa9d3944b
xor edx, edx
add edx, eax
mov edi, 0x405deb5c
sub edi, 0x30589d5c
add edi, dword [ebp - 0x40]
mov esi, 0x1f987592
sub esi, 0x9ec5cfd4
xor dword [ebp - 0x2c], 0xfe3f93e2
mov ebx, dword [edi]
add dword [ebp - 0x24], 0x1c0bb258
add ebx, esi
add dword [ebp - 0x20], ecx
mov dword [edx], ebx
xor dword [ebp - 0x1c], edi
add edx, 0x550a1011
sub edx, 0x550a100d
add edi, 0x9180ba5
add edi, 0xf6e7f45f
loop 0x10034ec4
add eax, 0xf3891b24
add eax, 0xc780a27
xor ebx, ebx
add ebx, eax
add eax, 0x3090b958
add eax, 0xcf6f46ad
mov ecx, 0x342bb87
add ecx, 0xcbd4479
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100366e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e348
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004e2d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004e28c]
cmp eax, 0xffffffff
jne 0x10036716
xor ebx, ebx
jmp 0x1003671f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003675f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003679e
test esi, esi
jne 0x100367a2
push 0x10035270
push 0x1004fad8
call fcn.10034da0
mov eax, dword [0x1004e28c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003675f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003678c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003678c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100367e4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x100367cd
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x100367a2
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036730
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10036809
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x10036809
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10034da0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100367f0
jmp 0x10036730
Function at 0x40359e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4035ad
pop dword [ebp - 0x28]
mov eax, 0x8575c70d
add eax, 0x7aca6ea0
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xa7b9b275
add dword [ebp - 0x38], 0xa69892d6
mov dword [ebp - 0x34], 0xbf58f5e7
add dword [ebp - 0x34], 0x72da565e
mov dword [ebp - 0x30], 0xef4d9b98
sub dword [ebp - 0x30], 0xa301576a
mov dword [ebp - 0x2c], 0xbaca3605
sub dword [ebp - 0x2c], 0xbaca3605
lea eax, [ebp - 0x38]
push eax
mov eax, 0xe88559af
add eax, 0x17bb166d
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x5e984bfc
sub dword [ebp - 0x38], 0xea25e2a6
mov dword [ebp - 0x34], 0x8f634b77
sub dword [ebp - 0x34], 0x4df6ea02
mov dword [ebp - 0x30], 0x98768c05
add dword [ebp - 0x30], 0xcaf8e067
mov dword [ebp - 0x2c], 0x92b9798d
sub dword [ebp - 0x2c], 0x92b9798d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xfbfe8b5d
sub eax, 0xfbbe1b3d
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37be2
push 0
call eax
mov ecx, 0x579ed938
sub ecx, 0x579e9123
mov edx, eax
mov ebx, 0xc7b7c04e
add ebx, 0x388907b2
add ebx, dword [ebp - 0x28]
mov edi, 0xbfaf015
add edi, 0x7aa5a2e5
add dword [ebp - 0x20], 0xf02d6988
mov esi, dword [ebx]
add dword [ebp - 0xc], esi
xor esi, edi
add dword [ebp - 0x18], edi
mov dword [edx], esi
add dword [ebp - 8], 0x5f9d34ba
add edx, 0xca29ad7f
sub edx, 0xca29ad7b
add ebx, 0x5d4c5219
add ebx, 0xa2b3adeb
loop 0x4036cf
add eax, 0x11327
xor ebx, ebx
add ebx, eax
add eax, 0x2df55ee
add eax, 0xfd20aa17
mov ecx, 0xf28201dc
sub ecx, 0xf24201dc
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4045f7
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x406af3
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404616
mov al, 1
jmp 0x4046e2
test esi, esi
je 0x4046e0
xor ebx, ebx
cmp word [esi], bx
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4046e0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040359e
pop ecx
pop ecx
mov esi, dword [0x40a010]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4046d1
lea eax, [ebp - 0x28]
push eax
call fcn.0040359e
pop ecx
test al, al
jne 0x4046d1
cmp dword [ebp - 0x18], esi
jbe 0x4046d1
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4046d1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x4046d1
push 0x4075c8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
movzx ebx, bl
pop ecx
pop ecx
cmovne ebx, edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.0040359e
mov al, bl
jmp 0x4046e2
xor al, al
call fcn.004054b6
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40de38
mov ecx, 0x37165c11
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x5eb8159c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10002eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10002ebf
pop dword [ebp - 0x2c]
mov eax, 0x4f00135a
add eax, 0xc1001b65
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6c885743
add dword [ebp - 0x3c], 0xe1c9ee08
mov dword [ebp - 0x38], 0x4856badb
add dword [ebp - 0x38], 0xe9dc916a
mov dword [ebp - 0x34], 0xf8049144
add dword [ebp - 0x34], 0x5447b2ea
mov dword [ebp - 0x30], 0xafd054b1
sub dword [ebp - 0x30], 0xafd054b1
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xdb6f0da9
add eax, 0x34928293
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xaf55de95
add dword [ebp - 0x3c], 0xc51c8ac1
mov dword [ebp - 0x38], 0xffa8519c
sub dword [ebp - 0x38], 0xbe3bf027
mov dword [ebp - 0x34], 0xefc0dccb
sub dword [ebp - 0x34], 0x8c51705f
mov dword [ebp - 0x30], 0x3a3b08dc
sub dword [ebp - 0x30], 0x3a3b08dc
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x35ca6
push 0
call eax
mov ecx, 0xfea2e1d0
add ecx, 0x15d5fd5
mov esi, eax
mov edi, 0xbbbe1ad3
sub edi, 0xabbbf2d3
add edi, dword [ebp - 0x2c]
mov edx, 0x7fd64e2b
sub edx, 0x5fb6a3e
add dword [ebp - 0x10], 0x76acc0
mov ebx, dword [edi]
xor dword [ebp - 4], 0xb36dea57
xor ebx, edx
add dword [ebp - 0x24], 0xae06b692
mov dword [esi], ebx
add dword [ebp - 0x28], 0xbfecfbd8
add esi, 0x51c25d31
sub esi, 0x51c25d2d
add edi, 0x41f13e1a
add edi, 0xbe0ec1ea
loop 0x10002fdc
add eax, 0x3b778238
sub eax, 0x3b7688d1
mov ebx, eax
add eax, 0x9c1ce44a
add eax, 0x63e31bbb
mov ecx, 0x538a98b9
add ecx, 0xbc756747
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret