joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026dbe
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x2bc
mov eax, 0x10063ddb
call fcn.1002a93f
mov edi, ecx
push str.Expected_non_NULL_setup_log_location
push str._pSetupLogsLocation___NULL_
push str.WatsonReport::GetSetupLogsLocation
test edi, edi
push 0x10d
setne al
movzx eax, al
push str.d:dbs_shodct0217_154505_1cmd6clientonedriveProductUXSharedWatsonReport.cpp
push eax
call fcn.10025c63
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
mov esi, 0x80004005
call fcn.10042070
add esp, 0x24
lea eax, [ebp - 0x218]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x10026ea5
push 0x98
lea eax, [ebp - 0x2b0]
push ebx
push eax
call fcn.10042070
pop ecx
lea ecx, [ebp - 0x2b0]
call fcn.1001197e
lea edx, [ebp - 0x218]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2b0]
call fcn.100141a0
mov ecx, eax
call fcn.10013f60
mov edx, 0x100902d0
mov ecx, eax
call fcn.1001443f
lea eax, [ebp - 0x2c8]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.100130bf
lea eax, [ebp - 0x2c8]
mov ecx, edi
push eax
call fcn.10007a2c
lea ecx, [ebp - 0x2c8]
call fcn.10007a50
lea ecx, [ebp - 0x2b0]
mov esi, ebx
call fcn.1001113a
mov eax, esi
call fcn.1002a8fa
ret

Function at 0x10027292
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteW]

Function at 0x100272a2
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1008f018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push 0x80
push 0
push eax
call fcn.10042070
add esp, 0xc
mov dword [ebp - 0x88], 0x40
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov esi, eax
test esi, esi
je 0x10027312
mov eax, 0x4c00
cmp word [ebp - 0x84], ax
je 0x10027312
lea eax, [ebp - 0x84]
mov ecx, edi
push eax
call fcn.10007d34
xor ecx, ecx
mov eax, 0x80004005
test esi, esi
pop edi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10029be7
leave
ret 4

Function at 0x10027332
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1008f018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x200
push 0
push eax
call fcn.10042070
add esp, 0xc
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test esi, esi
je 0x100273a0
mov eax, 0x4c00
cmp word [ebp - 0x204], ax
je 0x100273a0
lea eax, [ebp - 0x204]
mov ecx, edi
push eax
call fcn.10007d34
xor ecx, ecx
mov eax, 0x80004005
test esi, esi
pop edi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10029be7
leave
ret 4
Function at 0x100274b2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebp
ret 0x2c

Function at 0x100275d2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ebp
ret 8

Function at 0x10027602
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]

Function at 0x100277d2
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetGetConnectedState]

Function at 0x10027a02
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.USER32.dll_GetClipboardData]

Function at 0x10027f77
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, 0x55555555
push edi
mov edi, dword [edx]
xor ebx, ebx
mov dword [esp + 0x14], esi
xor edx, edx
and dword [esi + 0xc], 0
inc ebx
mov dword [esi + 0x1388], eax
mov dword [esi + 0x138c], eax
lea eax, [esi + 0x10]
mov dword [esi + 8], edi
mov esi, eax
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, edi
push eax
push ecx
call fcn.1002aa80
mov edi, eax
mov eax, 0x138
add edi, ebx
mov dword [esi], edi
lea esi, [esi + 8]
adc edx, 0
inc ebx
mov dword [esi - 4], edx
cmp ebx, eax
jl 0x10027fad
mov esi, dword [esp + 0x14]
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002ba19
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1004e66a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1004e28d
push eax
push esi
push dword [ebp + 8]
call fcn.1004e242
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1004e28d
push eax
push esi
push dword [ebp + 8]
call fcn.1004e242
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1004e27d
mov eax, 0x8847edf0
popfd
jl 0x1004e702
invalid
invalid

Function at 0x1004ef14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x1004ef2c
call fcn.1004e242
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.1004e27d
ja 0x1004ef37
or dh, byte [edx + 0x1046897]
add byte [eax], al
mov dl, 0x97
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1004ef71
cld
invalid
cmp dword [ebp - 0x398], 0
je 0x1004f13b
cmp dword [ebp + 0xc], 1
je 0x1004f13b
cmp dword [ebp + 0xc], 8
jne 0x1004f103
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
xor al, 0xc6
test dword [edx - 7], edx
invalid
call dword [esi]
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
invalid
test dword [esi - 7], ebx
Function at 0x1004f1c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
movsd dword es:[edi], dword [esi]
cld
invalid
push dword [esi]
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1004e28d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1004e242
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1004e27d
sub dword [eax + 0x1046835], esi
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.1004e27d
sbb al, 0x39
mov al, 0x4d
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
Function at 0x1005020e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edx], esi
clc
invalid
js 0x100501c2
jle 0x1005027b
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x10050260
lea eax, [ebp - 0x714]
push eax
call fcn.1004e28d
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1004e242
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x10050260
jmp fcn.1004fc1f
cmp dword [ebp - 0x37c], 0
je 0x1005026e
jmp 0x10050323
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x100502c7
add byte [eax - 1], al
mov ch, 0x60
cld
invalid
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x100502cc
jmp fcn.1004fc1f
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x10050313
lea eax, [ebp - 0x714]
push eax
call fcn.1004e28d
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1004e242
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1005031e
jmp 0x10050323
jmp fcn.1004fc1f
cmp dword [ebp - 0x37c], 0
jne 0x100503cd
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1004e459
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x100503b9
lea eax, [ebp - 0x714]
push eax
call fcn.1004e28d
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.1004e322
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
dec dword [ebp - 0x3337b]
invalid
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3f22c50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x327e000]
push edi
or ebp, 0xffffffff
jmp 0x3f22c72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x3f22c79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3f22c68
mov eax, 1
add ebx, ebx
jne 0x3f22c8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x3f22c9c
jne 0x3f22cbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3f22cbb
dec eax
add ebx, ebx
jne 0x3f22ca8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x3f22c80
add ebx, ebx
jne 0x3f22cb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x3f22d0d
xor ecx, ecx
sub eax, 3
jb 0x3f22cd3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x3f22d42
sar eax, 1
mov ebp, eax
jmp 0x3f22cde
add ebx, ebx
jne 0x3f22cde
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3f22cac
inc ecx
add ebx, ebx
jne 0x3f22cec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3f22cac
add ebx, ebx
jne 0x3f22cf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x3f22cee
jne 0x3f22d0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x3f22cee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x3f22d2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x3f22d1e
jmp 0x3f22c6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x3f22d2c
add edi, ecx
jmp 0x3f22c6e
pop esi
lea edi, [esi + 0x3b1b000]
mov eax, dword [edi]
or eax, eax
je 0x3f22d94
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3b3f4d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3b3f974]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x3f22d49
mov ecx, edi
jns 0x3f22d78
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3b3f978]
or eax, eax
je 0x3f22d8e
mov dword [ebx], eax
add ebx, 4
jmp 0x3f22d66
call dword [esi + 0x3b3f980]
mov ebp, dword [esi + 0x3b3f97c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x2af]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x3f22dc8
sub esp, 0xffffff80
jmp 0x11b7c26
Function at 0x4014ef
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push esi
xor esi, esi
cmp dword [0x2447ef4], 0x400
push edi
jne 0x40154a
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
push esi
call fcn.00401e76
push esi
push esi
call fcn.0040181d
push esi
call fcn.00401e11
push esi
push esi
call fcn.00401c5c
push esi
call fcn.00401f54
push esi
push esi
call fcn.00401721
add esp, 0x28
xor edi, edi
cmp edi, 0x16d2a
jge 0x40155f
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidthI]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e82fe
jg 0x401583
inc edi
cmp edi, 0x3011b
jl 0x40154c
mov eax, dword [0x42a864]
mov dword [0x2447ef4], eax
call fcn.0040120c
mov edi, 0x2ec37
cmp dword [0x2447ef4], 0x51f
jne 0x4015af
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x401597
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x4070ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427cfc]
jne 0x4070d4
repz ret
jmp fcn.00409146
Function at 0x4083dd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427cfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004054ea
and dword [ebp - 0x14], 0
cmp dword [0x4354b4], 0
mov dword [ebp - 0x18], eax
jne 0x408490
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408538
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408538
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4354b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4354b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4354bc], eax
call edi
push eax
call esi
mov dword [0x4354c4], eax
test eax, eax
je 0x408490
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4354c0], eax
mov eax, dword [0x4354c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4084e9
cmp dword [0x4354c4], ecx
je 0x4084e9
push eax
call esi
push dword [0x4354c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4084e9
test ebx, ebx
je 0x4084e9
call edi
test eax, eax
je 0x4084e0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4084e0
test byte [ebp - 8], 1
jne 0x4084e9
or dword [ebp + 0x10], 0x200000
jmp 0x40851c
mov eax, dword [0x4354b8]
cmp eax, dword [ebp - 0x18]
je 0x40851c
push eax
call esi
test eax, eax
je 0x40851c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40851c
mov eax, dword [0x4354bc]
cmp eax, dword [ebp - 0x18]
je 0x40851c
push eax
call esi
test eax, eax
je 0x40851c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4354b4]
call esi
test eax, eax
je 0x408538
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40853a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004070ca
leave
ret
Function at 0x495e30
Capabilities:
Accept command line arguments

Disassembly:
push esi
call fcn.0044b610
jmp fcn.00be3430

Function at 0x608aa1
Capabilities:
Encode data using xor

Disassembly:
clc
sahf
vcmpss xmm0, xmm3, xmm0, 0xf6
push eax
call 0x2af5b106
popal
xchg ebp, eax
sub bh, ch
popal
xchg ebp, eax
sub bh, ch
mov esi, 0x45e27a48
aaa
xor dword [ecx - 0x18], eax
fidiv word [ebp - 0x60096978]
sbb dh, ch
mov dword [0x665bfeb], eax
loopne 0x608a98
pop ss
add eax, 0x7d365570
push esi
nop
push cs
loop 0x608b02
lodsd eax, dword [si]
call 0xae98e731
cwde
aad 0x7e
push ebx
xchg ebp, eax
cmc
sub eax, dword [0x22d2b615]
loopne 0x608b4d
insb byte es:[edi], dx
xchg ebp, eax
xchg ebp, eax
push esi
mov al, byte [0xe093964a]
add dh, dh
xchg ebp, eax
test dword [esi], edi
mov ch, 8
dec esi
int3
push 0xd5ca19e8
push ss
jecxz 0x608ad1
mov ah, 0x35
shl byte [0xf9d0a241], 0xc1
sbb cl, byte [ebp - 0x487a9235]
jno 0x608ad4
wait
mov ebx, dword [eax + eax*4 - 0x29527f97]
mov dh, 0xba
or eax, 0x550598
ror dl, 1
test eax, 0xbac3d2a6
nop
lock dec dword [ebx]
sub byte [edi + 0x26feb667], 0x4a
sub ah, dh
jae 0x608b44
imul eax, dword [eax - 0x45492953], 0x5980d67
push ebp
add byte [ebp - 0x30], ah
retf 0xa6a9
push dword [ebx + 0x32]
jae 0x608b79
inc ecx
out 0x17, eax
adc al, 0xc1
ret
mov edi, 0xb1a97645
and dh, bh
lcall 0x9ee, 0xc3018f69
cmpsb byte [esi], byte es:[edi]
xor eax, 0xd6f296d1
push eax
and ecx, esi
out 0xa1, al
out dx, al
and byte [eax], ch
jae 0x608baa
stc
and ah, byte [edx + 0x23]
bound esp, qword [ebx]
mov bh, 0xd4
cwde
mov bl, 0xa8
mov ch, 0xb2
xor dl, byte [edx + ecx - 0x5d]
jne 0x608b20
push esp
or ah, byte [ebx - 0x6c575d8b]
test al, 0x93
jbe 0x608be8
sar byte ds:[ebx + 0x58], 1
add al, 0xe9
aad 0xc0
pop ebp
xor eax, 0xf83d9cbf
inc ebx
das
aad 0x55
enter 0x36f3, 0xffffffffffffffe6
sub al, 0x7a
out 0x19, eax
rol dh, 0xae
rcr dword [edi + 0x6e], 0xd6
inc esi
push edi
jo 0x608b79
push ebx
push ebx
push ebp
push ebp
cmp eax, 0x3b460e4f
in eax, 0xd2
out 0x5e, al
xchg ebx, eax
lodsd eax, dword [esi]
test dword [edi + 0x56d13f77], ecx
jp 0x608b6e
call dword [ecx + 0x76]
and ebp, dword [0xe584127c]
cwde
invalid
inc ebx
dec esp
sub dword [ebx - 0x4eb7b55a], ebp
mov bl, 0xf4
mov eax, 0x8ec1b1c4
fistp word [eax]
dec esp
rcl byte [ebx - 0x74]
jo 0x608bef
mov cl, 0xb3
hlt
or eax, 0x735d2eed
call 0x26c2c16b
invalid
Function at 0x1001aaa3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001aae2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001aae2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001aae2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001aae2
cmp dword [ecx + 0x74], 0xe
jbe 0x1001aae2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001d75f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d7fc
push ebx
push esi
call fcn.1001d728
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d6bc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d7a9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d7fb
push edi
push eax
call fcn.1001e71a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d7c9
call fcn.1001c204
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d7fa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d6bc
add esp, 0x20
test eax, eax
jne 0x1001d7e8
push edi
call fcn.1001c204
jmp 0x1001d7f0
push ebx
call fcn.1001c204
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001da69
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsAlloc
push 0x1f
call fcn.1001d985
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001da9d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
jmp 0x1001daa3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001dae7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd8
push 0x10025cd0
push str.FlsGetValue
push 0x21
call fcn.1001d985
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001db1e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001db26
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025ce0
push 0x10025cd8
push str.FlsSetValue
push 0x22
call fcn.1001d985
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001db60
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100231e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002320d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002320d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret