joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ce924
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x20
mov ecx, dword [0x101bf848]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101c65c4]
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x100cea0d
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x100cea02
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
mov eax, dword [eax + 0x24]
call eax
test eax, eax
je 0x100cea02
mov ecx, ebx
call fcn.1000c880
lea ecx, [ebx + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 8]
mov eax, dword [eax + 8]
call eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0xf
mov byte [ebp - 0x20], 0
mov edx, dword [eax + 8]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100ce8f8
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x20]
call fcn.1000f300
cmp dword [ebp - 0xc], 0x10
lea ecx, [ebp - 0x20]
mov edi, dword [ebp - 0x20]
cmovae ecx, edi
cmp dword [ebp - 0x10], 0x11
jne 0x100ce94e
mov edx, str.CBreakableSurface
mov esi, 0xd
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100ce94e
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100ce928
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100ce94e
mov ecx, ebx
call fcn.1000c880
mov dword [eax], 2
jmp 0x100ce9ae
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
cmp ecx, 0x10
cmovae eax, edi
cmp edx, 9
jne 0x100ce979
cmp dword [eax], 0x73614243
jne 0x100ce979
cmp dword [eax + 4], 0x6f6f4465
jne 0x100ce979
cmp byte [eax + 8], 0x72
je 0x100ce9a1
cmp ecx, 0x10
lea eax, [ebp - 0x20]
cmovae eax, edi
cmp edx, 0xc
jne 0x100ce9ae
cmp dword [eax], 0x6e794443
jne 0x100ce9ae
cmp dword [eax + 4], 0x63696d61
jne 0x100ce9ae
cmp dword [eax + 8], 0x706f7250
jne 0x100ce9ae
mov ecx, ebx
call fcn.1000c880
mov dword [eax], 0
push ebx
call dword [0x101c65c0]
add esp, 4
mov byte [ebp + 0xb], al
mov ecx, ebx
call fcn.1000c880
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
cmp eax, 0x10
jb 0x100ce9f6
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x100ce9ec
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100cea4e
push ecx
push edi
call fcn.1007739f
add esp, 8
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x101c65c4
call fcn.100774e5
add esp, 4
cmp dword [0x101c65c4], 0xffffffff
jne 0x100ce8a9
push str.server.dll
call dword [sym.imp.kerNEl32.DLl_GetModuleHandleA]
add eax, 0x1cd4f0
push 0x101c65c4
mov dword [0x101c65c0], eax
call fcn.1007749b
add esp, 4
jmp 0x100ce8a9
call fcn.10084c47
int3
Function at 0x100ddd74
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
movss dword [ebp - 4], xmm3
mov ebx, edx
xorps xmm7, xmm7
mov edx, dword [ebp + 8]
xorps xmm6, xmm6
xorps xmm3, xmm3
mov dword [esi], 0
mov dword [esi + 4], 0
test bl, 1
je 0x100ddc79
mov ecx, 0x14
call fcn.100ddd90
mov ecx, 0x13
movaps xmm6, xmm0
call fcn.100ddd90
mov ecx, 0x12
subss xmm6, xmm0
call fcn.100ddd90
mov ecx, 0x11
movaps xmm5, xmm0
call fcn.100ddd90
movss xmm3, dword [esi]
subss xmm5, xmm0
addss xmm6, dword [esi + 4]
addss xmm3, xmm5
movss dword [esi + 4], xmm6
movss dword [esi], xmm3
test bl, 2
je 0x100ddcca
mov ecx, 7
call fcn.100ddd90
mov ecx, 6
movaps xmm6, xmm0
call fcn.100ddd90
mov ecx, 5
subss xmm6, xmm0
call fcn.100ddd90
mov ecx, 4
movaps xmm5, xmm0
call fcn.100ddd90
movss xmm3, dword [esi]
subss xmm5, xmm0
addss xmm6, dword [esi + 4]
addss xmm3, xmm5
movss dword [esi + 4], xmm6
movss dword [esi], xmm3
test bl, 4
je 0x100ddd1b
mov ecx, 0xb
call fcn.100ddd90
mov ecx, 0xa
movaps xmm6, xmm0
call fcn.100ddd90
mov ecx, 9
subss xmm6, xmm0
call fcn.100ddd90
mov ecx, 8
movaps xmm5, xmm0
call fcn.100ddd90
movss xmm3, dword [esi]
subss xmm5, xmm0
addss xmm6, dword [esi + 4]
addss xmm3, xmm5
movss dword [esi + 4], xmm6
movss dword [esi], xmm3
movss xmm4, dword [ebp - 4]
movaps xmm1, xmm6
mov ecx, dword [0x101c0bb0]
movaps xmm2, xmm3
ucomiss xmm4, xmm7
lahf
test ah, 0x44
jnp 0x100ddd53
movss xmm0, dword [ecx + 0x338]
comiss xmm0, xmm7
jbe 0x100ddd53
mulss xmm2, xmm4
mulss xmm1, xmm4
movss dword [esi], xmm2
movss dword [esi + 4], xmm1
movss xmm3, dword [ebp + 0xc]
ucomiss xmm3, xmm7
lahf
test ah, 0x44
mov eax, esi
jnp 0x100ddd81
movss xmm0, dword [ecx + 0x33c]
comiss xmm0, xmm7
jbe 0x100ddd81
mulss xmm2, xmm3
mulss xmm1, xmm3
movss dword [esi], xmm2
movss dword [esi + 4], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e7bf4
Capabilities:
Encode data using xor

Disassembly:
movsx eax, word [edx + 4]
push esi
mov esi, ecx
movd xmm1, eax
movsx eax, word [edx + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0xc], xmm1
movss dword [esi + 0x10], xmm0
movzx eax, word [edx + 8]
test ax, ax
jle 0x100e7c3d
movzx ecx, word [edx + 0xa]
test cx, cx
jle 0x100e7c3d
cwde
movd xmm1, eax
movsx eax, cx
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0x1c], xmm1
mov eax, dword [esi + 0x1c]
movss dword [esi + 0x20], xmm0
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov al, byte [edx + 0xc]
mov byte [esi + 0x85], al
pop esi
ret

Function at 0x100e7c64
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x100e7c8d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x100e7c73
cmp byte [esi], bl
jne 0x100e7c73
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x101770a0]
test bl, bl
jne 0x100e7c64
pop edi
pop esi
not ecx
pop ebx
jmp fcn.100e7ca0
Function at 0x100eb9d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x101c0bb0]
xor bl, bl
push edi
call fcn.100e8cd0
call fcn.100dfd50
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100eb914
mov ecx, dword [esi + 0x1a74]
test ecx, ecx
je 0x100eb914
cmp dword [ecx + 0x318], eax
je 0x100eb914
cmp ecx, eax
je 0x100eb914
mov ecx, dword [ecx + 0x314]
test ecx, ecx
jne 0x100eb904
mov bl, 1
test byte [esi + 8], 0x10
mov ecx, 1
movzx eax, bl
mov ebx, 0xfffffc19
cmovne eax, ecx
or edx, 0xffffffff
mov dword [ebp - 8], eax
lea ecx, [esi + 0x3e7]
xor ah, ah
xor edi, edi
sub ebx, esi
nop word [eax + eax]
cmp byte [ecx - 0xf], 0
je 0x100eb960
cmp dword [esi + 0x1a70], 0
jne 0x100eb95c
cmp dword [esi + 0x1bac], 0
jg 0x100eb95c
xor al, al
jmp 0x100eb95e
mov al, 1
mov byte [ecx], al
mov al, byte [ecx - 0x2fb]
or ah, al
mov byte [ebp - 1], ah
test al, al
je 0x100eb98b
cmp edx, 0xffffffff
je 0x100eb988
movsd xmm0, qword [esi + edx*8 + 0x3b0]
comisd xmm0, xmmword [esi + edi + 0x3b0]
jbe 0x100eb98b
lea edx, [ebx + ecx]
inc ecx
add edi, 8
lea eax, [ebx + ecx]
cmp eax, 5
mov ah, byte [ebp - 1]
jl 0x100eb940
cmp edx, 0xffffffff
je 0x100eb9ad
cmp byte [edx + esi + 0x3e7], 0
jne 0x100eb9ad
xor al, al
jmp 0x100eb9af
mov al, 1
cmp byte [esi + 0x1e64], 0
je 0x100eb9c5
test byte [esi + 0x1e68], 0x10
je 0x100eb9c5
mov cl, 1
jmp 0x100eb9c7
xor cl, cl
test al, al
jne 0x100eb9cf
test cl, cl
je 0x100eb9d5
cmp byte [ebp - 8], 0
je 0x100eb9f3
mov dword [esi + 0x1a78], 0
mov dword [esi + 0x1a74], 0
mov dword [esi + 0x1a70], 0
mov ecx, dword [esi + 0x3128]
cmp ecx, 0xffffffff
je 0x100eba05
test ecx, ecx
setne al
jmp 0x100eba27
test al, al
je 0x100eba18
cmp dword [esi + 0x1a70], 0
jne 0x100eba25
cmp byte [ebp - 1], 0
jne 0x100eba25
cmp dword [esi + 0x1bac], 0
jg 0x100eba25
xor al, al
jmp 0x100eba27
mov al, 1
mov byte [esi + 0x354], al
mov eax, dword [esi + 0x312c]
cmp eax, 0xffffffff
je 0x100eba3f
test eax, eax
setne al
jmp 0x100eba54
cmp dword [esi + 0x1aa4], 0
jne 0x100eba52
cmp dword [ebp - 0xc], 0
jne 0x100eba52
xor al, al
jmp 0x100eba54
mov al, 1
mov byte [esi + 0x355], al
cmp byte [esi + 0x359], 0
je 0x100eba72
mov eax, dword [esi + 8]
and al, 9
cmp al, 1
jne 0x100eba72
mov byte [esi + 0x355], al
mov ecx, dword [esi + 0x3130]
cmp ecx, 0xffffffff
je 0x100eba91
xor eax, eax
test ecx, ecx
setne al
mov byte [esi + 0x356], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov byte [esi + 0x356], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f0894
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss xmm3, dword [ecx]
xorps xmm0, xmm0
comiss xmm0, xmm3
movss xmm2, dword [0x101afc38]
jbe 0x100f0859
xorps xmm1, xmm1
jmp 0x100f0860
movaps xmm1, xmm2
minss xmm1, xmm3
movss xmm3, dword [0x101afdac]
movss xmm4, dword [0x101afbec]
movss xmm5, dword [ecx + 4]
comiss xmm0, xmm5
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si edx, xmm1
jbe 0x100f088b
xorps xmm1, xmm1
jmp 0x100f0892
movaps xmm1, xmm2
minss xmm1, xmm5
movss xmm5, dword [ecx + 8]
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si eax, xmm1
shl eax, 8
or edx, eax
comiss xmm0, xmm5
jbe 0x100f08b2
xorps xmm1, xmm1
jmp 0x100f08b9
movaps xmm1, xmm2
minss xmm1, xmm5
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si eax, xmm1
movss xmm1, dword [ecx + 0xc]
shl eax, 0x10
or edx, eax
comiss xmm0, xmm1
ja 0x100f08db
minss xmm2, xmm1
movaps xmm0, xmm2
mulss xmm0, xmm3
addss xmm0, xmm4
cvttss2si eax, xmm0
shl eax, 0x18
or eax, edx
ret
Function at 0x1012e2e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, dword [0x101c0bb0]
push edi
mov edi, ecx
mov eax, dword [esi + 0x1a6c]
mov byte [eax + 0x84], 1
mov eax, dword [esi + 0x1a6c]
cmp byte [eax + 0x87], 0
je 0x1012e2eb
pop edi
xor al, al
pop esi
ret
mov ecx, dword [eax + 0xc4]
xor edx, edx
mov eax, dword [eax + 0xcc]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.100f1430
add esp, 4
cmp dword [esi + 0x1aa4], eax
jne 0x1012e315
mov dword [esi + 0x1aa8], eax
cmp dword [esi + 0x1adc], eax
jne 0x1012e324
mov byte [esi + 0x1ae0], 1
push 0
push edi
xor edx, edx
mov ecx, eax
call fcn.10118210
add esp, 8
pop edi
pop esi
ret

Function at 0x1012e3c4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [0x101c0bb0]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 8]
push eax
movups xmm0, xmmword [esi + 0x15dc]
lea ecx, [esi + 0x1b64]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x10], xmm0
call fcn.1001e8b0
movups xmm0, xmmword [esi + 0x15ec]
movups xmmword [esi + 0x15dc], xmm0
cmp byte [edi], 0x25
jne 0x1012e410
cmp byte [edi + 1], 0x73
jne 0x1012e410
cmp byte [edi + 2], 0
jne 0x1012e410
mov ecx, dword [ebp + 0xc]
xor edx, edx
push 1
call fcn.1012c160
add esp, 4
mov ecx, 1
call fcn.100ef130
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp + 0xc]
mov ecx, edi
call fcn.1012d170
mov ecx, 1
call fcn.100ef130
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1012e414
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [0x101c0bb0]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 8]
push eax
movups xmm0, xmmword [esi + 0x15dc]
lea ecx, [esi + 0x1b64]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x10], xmm0
call fcn.1001e8b0
movups xmm0, xmmword [esi + 0x15ec]
movups xmmword [esi + 0x15dc], xmm0
cmp byte [edi], 0x25
jne 0x1012e410
cmp byte [edi + 1], 0x73
jne 0x1012e410
cmp byte [edi + 2], 0
jne 0x1012e410
mov ecx, dword [ebp + 0xc]
xor edx, edx
push 1
call fcn.1012c160
add esp, 4
mov ecx, 1
call fcn.100ef130
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp + 0xc]
mov ecx, edi
call fcn.1012d170
mov ecx, 1
call fcn.100ef130
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1012ef34
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101c0bb0]
push esi
mov esi, ecx
mov dword [ebp - 0xc], eax
mov ecx, dword [edx + 4]
movss xmm0, dword [eax + 0x1930]
movss xmm1, dword [eax + 0x1550]
movaps xmm3, xmm0
addss xmm3, dword [edx]
movss xmm2, dword [eax + 0x1554]
addss xmm1, xmm1
addss xmm2, xmm2
mov dword [ebp - 0x28], ecx
push edi
mov edi, dword [eax + 0x1a6c]
lea ecx, [ebp - 0x2c]
mov eax, dword [edx]
addss xmm3, xmm1
mov dword [ebp - 0x2c], eax
movss xmm1, dword [edx + 4]
mov edx, esi
addss xmm1, xmm0
push 0
movss dword [ebp - 0x24], xmm3
addss xmm1, xmm2
movss dword [ebp - 0x20], xmm1
call fcn.100e1470
add esp, 4
lea eax, [ebp - 2]
mov edx, esi
lea ecx, [ebp - 0x2c]
push 0
push eax
lea eax, [ebp - 3]
push eax
call fcn.1012e520
mov dh, byte [ebp - 2]
add esp, 0xc
mov dl, byte [ebp - 3]
mov byte [ebp - 1], al
test dh, dh
je 0x1012eee6
test dl, dl
je 0x1012eee6
mov ecx, 0x17
jmp 0x1012eef0
xor ecx, ecx
test dl, dl
setne cl
add ecx, 0x15
movss xmm7, dword [0x101afc38]
movaps xmm1, xmm7
call fcn.100ef3f0
movaps xmm1, xmm7
mov dword [ebp - 8], eax
xor ecx, ecx
call fcn.100ef3f0
movss xmm0, dword [ebp - 0x24]
movss xmm1, dword [0x101afbec]
movss xmm3, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
addss xmm0, dword [ebp - 0x2c]
mulss xmm0, xmm1
movss dword [ebp - 0x1c], xmm0
movss xmm0, dword [ebp - 0x20]
addss xmm0, xmm3
mulss xmm0, xmm1
movss dword [ebp - 0x18], xmm0
test dl, dl
jne 0x1012ef4a
test dh, dh
je 0x1012efa7
test dword [ebp - 8], 0xff000000
mov eax, dword [ebp - 0xc]
mov esi, dword [edi + 0x284]
movss xmm2, dword [eax + 0x1930]
mulss xmm2, xmm1
addss xmm2, xmm7
je 0x1012efa7
xorps xmm0, xmm0
comiss xmm0, xmm2
jae 0x1012efa7
push 0xb
push 0
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.10104da0
push dword [ebp - 8]
mov ecx, esi
push dword [esi + 0x54]
push dword [esi + 0x5c]
call fcn.10105050
movss xmm7, dword [0x101afc38]
movss xmm3, dword [ebp - 0x28]
mov dword [esi + 0x54], 0
mov esi, dword [ebp - 0xc]
xor eax, eax
cmp byte [edi + 0x85], al
mov edx, dword [ebp - 0x14]
mov ecx, dword [edi + 0x284]
sete al
movss xmm0, dword [esi + 0x1554]
movss xmm1, dword [esi + 0x1550]
addss xmm0, xmm3
addss xmm1, dword [ebp - 0x2c]
lea eax, [eax*2 + 1]
movaps xmm3, xmm7
movss dword [ebp - 0xc], xmm0
push dword [ebp - 0xc]
movss dword [ebp - 0x10], xmm1
push dword [ebp - 0x10]
push eax
call fcn.100f45d0
mov edx, dword [0x101c0bb0]
add esp, 0xc
mov ecx, dword [edx + 0x1aa4]
test ecx, ecx
je 0x1012f043
mov eax, dword [edx + 0x1a6c]
cmp ecx, dword [eax + 0x114]
jne 0x1012f043
cmp byte [edx + 0xec], 0
je 0x1012f043
movss xmm1, dword [edx + 0x30]
movss xmm0, dword [edx + 0x444]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
test al, al
je 0x1012f043
mov ecx, edi
call fcn.100ec740
mov al, byte [ebp - 1]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10143534
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], edx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [eax + 4], ecx
jle 0x101435ad
xor ebx, ebx
nop
mov esi, dword [eax]
mov eax, dword [esi + ebx + 0x28]
add esi, ebx
test eax, eax
je 0x1014356e
cmp dword [eax + 4], 0
je 0x1014356e
push dword [ebp + 0x10]
mov ecx, edx
push dword [ebp + 0xc]
push eax
call fcn.10143520
mov ecx, eax
test ecx, ecx
je 0x1014356e
mov eax, dword [esi + 0x2c]
add eax, ecx
add dword [ebp - 4], eax
mov eax, dword [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10143573
sub eax, edx
mov edx, dword [ebp + 0xc]
mov ecx, edx
cmp dword [edx + 0x14], 0x10
jb 0x10143589
mov ecx, dword [edx]
mov edx, dword [edx + 0x10]
push eax
push dword [esi]
call fcn.10010a30
add esp, 8
test al, al
jne 0x101435b8
mov eax, dword [ebp + 8]
inc edi
mov edx, dword [ebp - 8]
add ebx, 0x3c
cmp edi, dword [eax + 4]
jl 0x10143540
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101435c1
mov dword [eax], esi
mov eax, dword [esi + 0x2c]
add eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40197d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401990
push esp
mov dword [ebp - 0x24], 0x4016f4
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a2f
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a10
pop ebp
ret 0x10

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, reloc.kernel32.dll_FileTimeToSystemTime
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40188f
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
xor esi, esi
mov edi, esi
mov edi, 0xfffffffb
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x10e], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xa]
push eax
push 1
push 1
lea eax, [ebp - 0x10e]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
lea eax, [ebp - 0xa]
push eax
call sub.KERNEL32.dll_GetModuleHandleA
movsx eax, byte [ebp - 0xa]
sub eax, 0x41
pop edi
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4028c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4028fd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x40291d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404990
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402a84
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404728
test esi, esi
jne 0x402aba
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404818
jmp 0x402ad8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402998
mov edi, eax
test esi, esi
je 0x402ad8
cmp dword [ebx], 0
je 0x402ad8
dec esi
jmp 0x402ac1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4037b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403848
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403828
xor eax, eax
push ebp
push 0x403821
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403864
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403828
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46400c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404528
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x466048], 0
je 0x404589
cmp word [0x46621c], 0xd7b2
jne 0x404551
cmp dword [0x466224], 0
jbe 0x404551
mov eax, 0x466218
call dword [0x466234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x464054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045b0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46401c], 0
jne 0x4045a5
push 0
push 0x464074
push 0x464054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4046dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402728
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x466049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4046a4
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc