joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434bf2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00423ab4
xor ebx, ebx
cmp dword [0x44caf8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x434cc8
push 0x43fa7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x434da8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43fa70
push edi
call esi
cmp eax, ebx
je 0x434da8
push eax
call fcn.00423a46
mov dword [esp], 0x43fa60
push edi
mov dword [0x44caf8], eax
call esi
push eax
call fcn.00423a46
mov dword [esp], 0x43fa4c
push edi
mov dword [0x44cafc], eax
call esi
push eax
call fcn.00423a46
mov dword [0x44cb00], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00426a9c
test eax, eax
pop ecx
pop ecx
je 0x434c96
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d62b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x434cc8
push 0x43fa30
push edi
call esi
push eax
call fcn.00423a46
cmp eax, ebx
pop ecx
mov dword [0x44cb08], eax
je 0x434cc8
push 0x43fa18
push edi
call esi
push eax
call fcn.00423a46
pop ecx
mov dword [0x44cb04], eax
mov eax, dword [0x44cb04]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x434d4d
cmp dword [0x44cb08], ecx
je 0x434d4d
push eax
call fcn.00423abd
push dword [0x44cb08]
mov esi, eax
call fcn.00423abd
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x434d4d
cmp edi, ebx
je 0x434d4d
call esi
cmp eax, ebx
je 0x434d1a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x434d1a
test byte [ebp - 0x18], 1
jne 0x434d4d
lea eax, [ebp - 0x10]
push eax
call fcn.00426ad3
test eax, eax
pop ecx
je 0x434d35
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d62b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x434d44
or dword [ebp + 0x10], 0x200000
jmp 0x434d88
or dword [ebp + 0x10], 0x40000
jmp 0x434d88
mov eax, dword [0x44cafc]
cmp eax, dword [ebp - 8]
je 0x434d88
push eax
call fcn.00423abd
cmp eax, ebx
pop ecx
je 0x434d88
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x434d88
mov eax, dword [0x44cb00]
cmp eax, dword [ebp - 8]
je 0x434d88
push eax
call fcn.00423abd
cmp eax, ebx
pop ecx
je 0x434d88
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44caf8]
call fcn.00423abd
cmp eax, ebx
pop ecx
je 0x434da8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x434daa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x12905529
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x713f1cf1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x6f7c15d6
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6ff42008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6ff42008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0
jmp 0x6f7c165a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6ff42004]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6ff4200c]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.6f7c2828
add dword [ebp - 0xc], 0x28
add dword [ebp - 0x10], 1
mov eax, dword [0x6ff42008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6f7c1614
nop
leave
ret
Function at 0x401830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413998
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x419454]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
lea esi, [edi + 0x4f0]
push 0
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x30], 0
call sub.FXEzDll.dll_public:_int___thiscall_CFXEzInst::GetPrinterList_class_CStringList____class_CStringList____int_
test eax, eax
je 0x4018f5
mov ecx, esi
call sub.FXEzDll.dll_public:_class_CStringList____thiscall_CFXEzInst::GetModelNameList_void_
mov ebx, eax
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 4]
test esi, esi
je 0x4018cf
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0xc]
push eax
call fcn.0040da9b
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov ecx, ebx
call fcn.0040c6de
test eax, eax
je 0x4018cb
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [edi + 0x1808]
call sub.FXEzDll.dll_public:_int___thiscall_CFXEzModel::GetModelNoByInfModel_char_const___int__
test eax, eax
je 0x40191a
test esi, esi
jne 0x40188f
mov cx, word [edi + 0x1830]
mov edx, dword [edi + 0x182c]
push 0
push 0x10
push 0xec
push ecx
push edx
call sub.FXEzDll.dll_char____cdecl_FXEz_GetResString_struct_HINSTANCE____const__unsigned_short_int__unsigned_int_
add esp, 0xc
push eax
call fcn.00411910
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040d9f2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040d9f2
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4063cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x419ce0
cmp edx, dword [eax]
je 0x4063ef
add eax, 8
inc ecx
cmp eax, 0x419d70
jl 0x4063e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x419ce0]
jne 0x40651d
mov eax, dword [0x41ddb0]
cmp eax, 1
je 0x4064f7
test eax, eax
jne 0x406420
cmp dword [0x419814], 1
je 0x4064f7
cmp edx, 0xfc
je 0x40651d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x406457
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004065b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004066a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40649a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004066a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x415774
push edi
call fcn.00407a40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004065b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004065c0
lea eax, [ebp - 0xa0]
push 0x415754
push eax
call fcn.004065c0
push dword [esi + 0x419ce4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004065c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004079a9
add esp, 0x2c
pop edi
jmp 0x40651d
lea eax, [ebp + 8]
lea esi, [esi + 0x419ce4]
push 0
push eax
push dword [esi]
call fcn.004066a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40bb60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00403ef0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x40bc2b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x40bc2b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x40bbde
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x40bbe9
or bh, 8
and edi, 0x8000000
je 0x40bc04
mov eax, dword [0x41f53c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x40bc2b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40c02b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40c04f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x40c06a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x4127e8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x412816
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x412834
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041274e
jmp 0x412834
mov eax, dword [esi + 0x14]
test eax, eax
je 0x412834
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041274e
test edi, edi
mov eax, edi
jne 0x41281e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x446016
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x446044
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x446062
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00445f7c
jmp 0x446062
mov eax, dword [esi + 0x14]
test eax, eax
je 0x446062
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00445f7c
test edi, edi
mov eax, edi
jne 0x44604c
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x44a65b
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov ecx, dword [ebp]
mov eax, dword [ecx]
lea eax, [eax + ebx + 5]
cmp byte [eax - 5], 0xe9
jne 0x44a67e
add eax, dword [eax - 4]
cmp dword [esi + 0x14], eax
mov al, 1
je 0x44a74d
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
test eax, eax
sete byte [ebp - 0x14]
jne 0x44a69a
push 0x20
push 0x40
call dword [edi - 0x1c]
test eax, eax
je 0x44a766
push ebx
push edi
push eax
push esi
xchg edi, ebx
mov ecx, dword [ebp]
mov esi, dword [ecx]
add esi, edi
mov edi, eax
mov dword [ebp - 4], esi
add dword [ebp - 4], 5
lea edx, [ebp - 8]
push edi
push esi
push edx
push esi
push edi
push ebx
call fcn.0044a62f
pop edx
pop ecx
mov esi, eax
mov edi, dword [ebp - 8]
sub eax, dword [ebp - 4]
jae 0x44a705
mov al, byte [edx]
cmp al, 0xcc
je 0x44a756
cmp al, 0xeb
je 0x44a756
and al, 0xfe
cmp al, 0xc2
je 0x44a756
push 7
pop ecx
mov edx, dword [ebp - 4]
mov eax, edx
shl eax, 0x14
je 0x44a6b0
sub edx, 0xe
add edx, ecx
mov ax, word [edx]
cmp al, 0xeb
jne 0x44a701
sub edx, esi
inc edx
inc edx
neg edx
cmp dl, ah
je 0x44a756
loop 0x44a6e1
jmp 0x44a6b0
lea eax, [ebp - 8]
push esi
push eax
push ecx
call fcn.0044a5f0
mov edi, dword [ebp - 8]
mov al, 0xe9
stosb byte es:[edi], al
lea ecx, [edi + 4]
mov eax, esi
sub eax, ecx
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov al, 0xe9
stosb byte es:[edi], al
pop esi
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 4]
pop dword [edx]
sub eax, ecx
stosd dword es:[edi], eax
pop edi
pop ebx
sub ecx, 5
push edx
push ebp
lea eax, [ebp - 0x10]
mov ebp, ecx
push 5
push eax
call fcn.00449463
test eax, eax
pop ebp
pop edx
je 0x44a74f
leave
ret
mov ecx, dword [edx]
and dword [edx], 0
jmp 0x44a75a
pop esi
pop ecx
pop edi
pop ebx
cmp byte [ebp - 0x14], 0
je 0x44a764
push ecx
call dword [edi - 0x18]
sub eax, eax
leave
ret

Function at 0x44aead
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [eax], 0xfffff000
jne 0x44aec2
mov dl, byte [eax + 5]
cmp dl, 0xe8
je 0x44aec8
cmp dl, 0xcc
je 0x44aec8
dec eax
dec ecx
jne fcn.0044aead
jmp 0x44aefb
add eax, 0xa
mov edx, eax
add eax, dword [eax - 4]
mov dword [0x44baf8], eax
add edx, 0xf
mov cl, 0x35
cmp byte [edx], 0xa1
je 0x44aeec
add edx, 0x20
cmp byte [edx], cl
je 0x44aeec
dec edx
dec edx
cmp byte [edx], cl
jne 0x44aefb
mov eax, dword [edx + 1]
test al, 3
jne 0x44aefb
mov ecx, dword [eax]
mov dword [0x44bb0a], ecx
ret
Function at 0x44aefc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebx + 0x3c]
mov edx, dword [ebx + edx + 0x78]
test edx, edx
je 0x44af5e
add edx, ebx
cmp eax, 0x10000
jae 0x44af15
sub eax, dword [edx + 0x10]
jmp 0x44af50
push ebp
push esi
push edi
xchg ebp, eax
mov ecx, dword [edx + 0x18]
mov esi, dword [edx + 0x20]
add esi, ebx
push edx
jecxz 0x44af39
lodsd eax, dword [esi]
sub edi, edi
add eax, ebx
dec ecx
mov dl, byte [edi + eax]
cmp dl, byte [edi + ebp]
jne 0x44af22
inc edi
test dl, dl
jne 0x44af2a
sub eax, eax
pop edx
pop edi
pop esi
pop ebp
test eax, eax
jne 0x44af5e
sub ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x24]
inc ecx
neg ecx
add eax, ebx
movzx eax, word [eax + ecx*2]
mov ecx, ebx
add ecx, dword [edx + 0x1c]
lea edx, [ecx + eax*4]
mov eax, dword [edx]
add eax, ebx
jmp 0x44af60
sub eax, eax
ret

Function at 0x44aff4
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
sete byte [eax]
push ebx
push ebp
cld
cmp byte [0x44b021], 0
je 0x44afff
ret
mov eax, 0x44b022
cmp byte [eax], 0
je 0x44ab2f
push 0x40
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp byte [0x44b021], 0
je 0x44b00d
ret

Function at 0x44b5f7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
or eax, 0x1000
push 0x40
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
leave
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x2ddf4390
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7ce753d9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10001850
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x10
mov esi, 0x34956f8
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
add esi, 0xfffffffe
xor ecx, ecx
test esi, esi
jle 0x100018e2
jmp 0x10001880
movzx edi, byte [edx + ecx]
shr edi, 2
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax], bl
movsx edi, byte [edx + ecx]
movzx ebx, byte [edx + ecx + 1]
and edi, 3
shr ebx, 4
shl edi, 4
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 1], bl
movsx ebx, byte [edx + ecx + 1]
movzx edi, byte [edx + ecx + 2]
and ebx, 0xf
add ebx, ebx
shr edi, 6
add ebx, ebx
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 2], bl
movsx edi, byte [edx + ecx + 2]
and edi, 0x3f
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 3], bl
add ecx, 3
add eax, 4
cmp ecx, esi
jl 0x10001880
cmp ecx, dword [ebp + 8]
jge 0x1000195e
movzx esi, byte [ecx + edx]
shr esi, 2
mov bl, byte [ebp + esi - 0x44]
mov esi, dword [ebp + 8]
dec esi
mov byte [eax], bl
cmp ecx, esi
jne 0x10001921
movsx ecx, byte [ecx + edx]
and ecx, 3
add ecx, ecx
mov dl, byte [ebp + ecx*8 - 0x44]
mov byte [eax + 1], dl
pop edi
mov byte [eax + 2], 0x3d
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ecx + edx + 1]
movsx ecx, byte [ecx + edx]
movzx edx, byte [esi]
and ecx, 3
shl ecx, 4
shr edx, 4
or ecx, edx
movzx ecx, byte [ebp + ecx - 0x44]
mov byte [eax + 1], cl
movsx edx, byte [esi]
and edx, 0xf
movzx ecx, byte [ebp + edx*4 - 0x44]
pop edi
mov byte [eax + 2], cl
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10003940
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xor dword [0x349e210], eax
push ebx
push esi
push edi
mov edi, dword [0x349519c]
call edi
mov ebx, dword [0x3495194]
xor dword [0x349e210], eax
push 0x349622c
call ebx
test eax, eax
je 0x10003981
push 0x34998a4
push eax
call dword [0x3495190]
test eax, eax
je 0x10003981
push 0x349e210
call eax
mov ecx, dword [0x349e210]
mov eax, ecx
xor edx, edx
or esi, 0xffffffff
div esi
lea esi, [ecx + eax]
rdtsc
xor ecx, eax
mov dword [0x349e210], ecx
call edi
xor dword [0x349e210], eax
push 0x349622c
call ebx
test eax, eax
je 0x100039c7
push 0x34998a4
push eax
call dword [0x3495190]
test eax, eax
je 0x100039c7
push 0x349e210
call eax
mov ecx, dword [0x349e210]
push esi
mov eax, ecx
xor edx, edx
or esi, 0xffffffff
div esi
add eax, ecx
push eax
push 0x3495968
push 0x104
push 0x34a9c60
call dword [0x34952f4]
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x1000d7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x349f588
mov dword [ebp - 4], 0x10
call dword [0x34952a4]
push 0x349f588
call dword [0x34952a8]
or ecx, 0xffffffff
mov edx, 0x349f588
test eax, eax
je 0x1000d7ed
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x349f6c8]
inc edx
dec eax
jne 0x1000d7d4
mov edi, dword [0x34954d4]
not ecx
mov esi, ecx
push esi
push 0x349e504
push 0x349f5a0
call edi
lea ebx, [esi + esi]
push ebx
push 0x349e504
push 0x349f54c
call edi
lea ecx, [esi + esi*2]
push ecx
push 0x349e504
push 0x349f5dc
call edi
push esi
push 0x349e580
push 0x349f670
call edi
push ebx
push 0x349e580
push 0x349f630
call edi
add esp, 0x3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000da30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x101
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [0x34954e4]
mov edx, eax
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
test edx, edx
je 0x1000da7a
push esi
lea esp, [esp]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x349f6c8]
inc ecx
dec edx
jne 0x1000da60
pop esi
not eax
mov esp, ebp
pop ebp
ret

Function at 0x1000daf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x34a9ed4]
sub esp, 0x104
push ebx
mov ebx, dword [0x34953a8]
push esi
push edi
push 1
push 5
push eax
call ebx
push eax
call ebx
mov edi, dword [0x349540c]
mov esi, eax
lea esp, [esp]
push esi
call dword [0x34953e4]
test eax, eax
je 0x1000dbb7
push 0xfffffffffffffff0
push esi
call dword [0x349541c]
test eax, 0x40000000
jne 0x1000db9c
push 0x101
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [0x34954e4]
or ecx, 0xffffffff
lea edx, [ebp - 0x104]
test eax, eax
je 0x1000db7f
nop
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x349f6c8]
inc edx
dec eax
jne 0x1000db60
mov ebx, dword [0x34953a8]
not ecx
test ecx, ecx
je 0x1000db96
xor eax, eax
cmp ecx, dword [eax*8 + 0x349e528]
je 0x1000dbcd
inc eax
cmp eax, 0xb
jb 0x1000db87
xor eax, eax
test al, 0x20
je 0x1000dbb7
push 0
push 0x1b
push 0x100
push esi
call edi
push 0xc01b0000
push 0x1b
push 0x101
push esi
call edi
push 3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1000db20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax*8 + 0x349e52c]
jmp 0x1000db98
Function at 0x100282e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x100282f0
xor eax, eax
pop ebp
ret 4
push esi
not eax
cmp edx, 8
jb 0x100283bf
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3497d50]
add ecx, 8
sub edx, 8
dec esi
jne 0x10028302
pop edi
test edx, edx
je 0x100283dc
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x3497d50]
inc ecx
dec edx
jne 0x100283c3
not eax
pop esi
pop ebp
ret 4