joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10070b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10070bcc
cmp byte [esi + 0x3d], 0
je 0x10070bcc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10070bba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10070b81
sub eax, 1
je 0x10070b85
sub eax, 2
jne 0x10070bba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073b99
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10070ba3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10070bba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073b99
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073b99
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10073b99
mov esp, ebp
pop ebp
ret

Function at 0x100714a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 3
xor eax, eax
mov dl, byte [edi + eax - 0x2dde7edd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100714ce
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100714b1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100714e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xb5
xor eax, eax
mov dl, byte [edi + eax - 0x39e8c79c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007150e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100714f1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10071520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x7e
xor eax, eax
mov dl, byte [edi + eax + 0x47b30cfa]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007154e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10071531
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10071560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x90
xor eax, eax
mov dl, byte [edi + eax + 0x2c0f6166]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007158e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10071571
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10073930
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008299d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.100737c0
cmp byte [ebp - 0x84], 0
jne 0x10073a81
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x100739c5
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100a8a50
call fcn.100737c0
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.100737c0
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10073a34
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10073870
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10073ac3
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10073ab9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10073ab9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100744bf
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073b99
mov esp, ebp
pop ebp
ret
Function at 0x406953
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
mov edi, eax
call fcn.00406aca
xor esi, esi
cmp edi, esi
mov dword [ebp - 8], esi
je 0x4069c8
push ebx
lea eax, [edi - 0x834]
xor ebx, ebx
cmp eax, 0x383
mov dword [ebp - 4], 0x1300
ja 0x40699f
push 2
push esi
push str.netmsg.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
je 0x40699f
mov dword [ebp - 4], 0x1b00
push esi
push esi
push esi
push esi
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4069bc
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 1
cmp ebx, esi
je 0x4069c7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
push 0x40a504
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
cmp edi, esi
je 0x4069f8
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push esi
push dword [ebp + 8]
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
leave
ret 4

Function at 0x406ec8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f018]
jne 0x406ed2
repz ret
jmp fcn.004073b5

Function at 0x408959
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.0040897c
add ebx, ebx
xor dword [ecx], edx
inc ebx
inc ecx
push 0x5edf07f7
pop ebx
cmp ecx, eax
jne main
dec edi
ret
Function at 0x10001250
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1001b2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x104
lea eax, [ebp - 0x108]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 0x10c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001290
lea ecx, [ebp - 0x10c]
push ecx
push str.SOFTWAREEGGORG
sub eax, edx
push 0x80000001
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100013cd
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edx, [ebp - 0x10c]
push edx
push str.SOFTWAREEGGORG
push 0x80000001
call esi
lea eax, [ebp - 0x10c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
test eax, eax
jne 0x100013ba
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x1001d4e8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
test eax, eax
jg 0x1000131b
mov edx, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push 0
push edx
jmp 0x10001332
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0x1001d4e8
push ecx
call esi
inc ebx
test eax, eax
je 0x100013ad
cmp ebx, 0xa
jl 0x100012f5
mov edx, dword [ebp - 0x10c]
push edx
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x1001d4e8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
test eax, eax
jg 0x1000138a
mov edx, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push 0
push edx
jmp 0x100013a1
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0x1001d4e8
push ecx
call esi
inc ebx
test eax, eax
je 0x100013ad
cmp ebx, 0xa
jl 0x10001364
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004388
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10004388
mov esp, ebp
pop ebp
ret
Function at 0x10003830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1001b2a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x100039c1
cmp byte [ebx + 0x49], 0
je 0x100039c1
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x100039b5
lea esi, [ebp - 0x2c]
call fcn.100033d0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x100038a3
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x100038dc
dec eax
je 0x100038e0
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x100039bc
call fcn.10002020
xor al, al
jmp 0x100039c3
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x100038f0
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x1000391d
cmp edi, 0x10
jae 0x100038ff
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.100055b4
add esp, 0x10
cmp esi, eax
jne 0x100039ad
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x100039b9
test esi, esi
jne 0x10003897
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x100039de
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x100039de
cmp edi, esi
jae 0x10003996
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.10003dc0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x10003897
mov ecx, eax
cmp edi, 0x10
jae 0x10003972
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x1000398d
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x10003891
test esi, esi
jne 0x10003968
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x100039a5
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x10003891
lea ecx, [ebp - 0x2c]
call fcn.10002020
xor al, al
jmp 0x100039c3
lea ecx, [ebp - 0x2c]
call fcn.10002020
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004388
mov esp, ebp
pop ebp
ret
push 0x10018028
call fcn.1001116d
int3
Function at 0x10003c90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013e4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1001b2a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10011036
push 4
mov dword [ebp - 4], 0
call fcn.10004ac0
mov edi, eax
add esp, 4
test edi, edi
je 0x10003d0c
call fcn.10010a07
mov dword [edi], eax
call fcn.100107c6
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.100106fb
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10003d02
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.10010723
jmp 0x10003d0e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10004388
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001b2a0]
jne 0x10004392
repz ret
jmp fcn.10005e19
Function at 0x1000c3a4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001b2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000693c
and dword [ebp - 0x14], 0
cmp dword [0x1001d190], 0
mov dword [ebp - 0x18], eax
jne 0x1000c457
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000c4ff
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000c4ff
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001d190], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001d194], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001d198], eax
call edi
push eax
call esi
mov dword [0x1001d1a0], eax
test eax, eax
je 0x1000c457
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001d19c], eax
mov eax, dword [0x1001d19c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000c4b0
cmp dword [0x1001d1a0], ecx
je 0x1000c4b0
push eax
call esi
push dword [0x1001d1a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000c4b0
test ebx, ebx
je 0x1000c4b0
call edi
test eax, eax
je 0x1000c4a7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000c4a7
test byte [ebp - 8], 1
jne 0x1000c4b0
or dword [ebp + 0x10], 0x200000
jmp 0x1000c4e3
mov eax, dword [0x1001d194]
cmp eax, dword [ebp - 0x18]
je 0x1000c4e3
push eax
call esi
test eax, eax
je 0x1000c4e3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000c4e3
mov eax, dword [0x1001d198]
cmp eax, dword [ebp - 0x18]
je 0x1000c4e3
push eax
call esi
test eax, eax
je 0x1000c4e3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001d190]
call esi
test eax, eax
je 0x1000c4ff
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000c501
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004388
leave
ret

Function at 0xc36e94
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36e94
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x49ac2d8c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3ba86631
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1e7a7500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
test al, 0x50
call fcn.1e7a7267
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a721c
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1e7a7545
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45

Function at 0x1e7a7f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1e7a7257
popal
dec edi
nop
sbb ebp, dword [eax + 4]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x1e7a7f20
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1e7a7f4b
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
cmp dword [ebp - 0x398], 0
invalid
test ah, dl
add dword [eax], eax

Function at 0x1e7a85e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x1e7a85f8
call fcn.1e7a721c
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
invalid
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x1e7a93ea
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.1e7a71c8
add esp, 0xc
and dword [ebp - 0x700], 0
add cl, bh
invalid
inc dword [eax]
jmp 0x1e7a8664
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1e7a86ad
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1e7a8657
call fcn.1e7a7257
push ds
salc
jecxz 0x1e7a86ae
movsd dword es:[edi], dword [esi]
jmp 0x1e7a86b0
invalid
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
inc dword [eax]

Function at 0x1e7a86d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
invalid
test esi, ebx
clc
Function at 0x1e7a9c90
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], 0
push ebx
mov ebx, dword [sym.imp.python27.dll_Py_FatalError]
push esi
push edi
mov edi, dword [sym.imp.python27.dll_PyThreadState_Swap]
jne 0x1e7a9ccd
push 0
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1e7a9cbf
push str.pywintypes:_can_not_setup_interpreter_state__as_current_state_is_invalid
call ebx
add esp, 4
mov eax, dword [esi + 4]
push esi
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9ce7
push 0x1e7b10fc
call ebx
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call edi
push eax
mov dword [esi], eax
call edi
add esp, 8
pop edi
mov dword [esi + 4], 0
pop esi
pop ebx
ret

Function at 0x1e7a9d10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1e7a9d7f
push esi
push edi
mov edi, dword [sym.imp.python27.dll_Py_FatalError]
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
jne 0x1e7a9d3a
push str.Can_not_setup_thread_state__as_have_no_interpreter_state
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9d54
push str.Out_of_memory_allocating_thread_state.
call edi
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState]
push edx
call dword [sym.imp.python27.dll_PyThreadState_New]
add esp, 4
mov dword [esi], eax
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret
xor eax, eax
ret

Function at 0x1e7a9dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1e7a9e0b
cmp dword [esi + 4], 0
je 0x1e7a9e0b
mov ecx, dword [esi]
push ecx
call dword [sym.imp.python27.dll_PyThreadState_Delete]
mov edx, dword [0x1e7ba8b8]
add esp, 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
ret

Function at 0x1e7aa520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1e7aa538
test eax, 0xffff0000
je 0x1e7aa538
mov dword [esp + 4], eax
jmp sym.pywintypes27.dll_void___cdecl_PyWinObject_FreeString_char__
ret