joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40117b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x4071c4
cmp dword [edi], ebx
je 0x401220
push str._mozilla.org_observer_service_1
mov edx, 0x408ee8
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.004052a8
mov eax, dword [ebp - 4]
test eax, eax
je 0x401200
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_qm
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_telemetry
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00405395
mov eax, dword [ebp - 4]
test eax, eax
je 0x401220
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x401257
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x401257
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.00401bad
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.00405073
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x401273
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x401280
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x40128c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x40129c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret

Function at 0x40147d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x40ea8c]
mov edx, dword [ebp + 8]
mov eax, dword [0x40ea88]
test ecx, ecx
je 0x4014b3
mov ecx, dword [ecx + eax*4]
cmp dword [edx + 8], ecx
je 0x4014b3
push ecx
push dword [edx + 8]
push str.DoTransaction_expected__d_got__d._n
call fcn.00401bad
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
inc eax
mov dword [0x40ea88], eax
mov eax, dword [edx + 0xc]
and al, 1
movsx eax, al
neg eax
sbb eax, eax
and eax, 0x80004005
pop ebp
ret 4
Function at 0xe86830
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe8683a
pushal
call 0xe86840
pop ebp
sub ebp, 0x10
sub ebp, 0xa86830
jmp 0xe86856
mov eax, 0xa86830
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
dec esp
add byte [eax], al
add byte [ecx + 0x5c3], bh
mov edx, 0x32bf5817
xor byte [eax], dl
inc eax
dec ecx
jne 0xe8686d
jmp 0xe86880
pushfd
ficomp dword [esi + ebx*4 + 0x1717172b]
xchg esi, eax
salc
out dx, eax
pop ss
pop ss
pop ss
adc al, 0xda
scasd eax, dword es:[edi]
sbb al, 0x17
pop ss
pop ss
lodsd eax, dword [esi]
aas
pop ss
pop ss
pop ss
loopne 0xe86891
adc al, 0xdf
pushfd
xchg esi, eax
sbb edx, dword [edi]
pop ss
pop ss
adc al, 0xd2
lcall 0x3313, 0x9eeb3373
inc edi
jg 0xe8685f
add eax, 0x6f7f1735
inc edx
xchg ecx, eax
pop ss
push ss
cmp esi, dword [ebx]
jg 0xe8688a
xchg ecx, eax
push 0x1712ff79
pop ss
pop ss
invalid
Function at 0x1001aee9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d0db4
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100dbeac
mov dword [esi + 8], 0x100d97c0
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push fcn.1000b96d
push 0x1001b0f6
push 6
lea eax, [esi + 0x160]
push 8
push eax
mov byte [ebp - 4], 7
call fcn.1007f41d
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dbe78
mov dword [esi + 4], 0x100dbe5c
mov dword [esi + 8], 0x100dbe4c
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100248ea
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x10024919
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
shr eax, 8
movzx ecx, word [ecx*2 + 0x100f75d0]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x100248f9
pop edi
pop esi
ret 4

Function at 0x10029218
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d1c35
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100d9c7c
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dd620
mov dword [esi + 4], 0x100dd610
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1007f41d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1007f42c
pop dword [ebp - 0x44]
mov eax, 0x1094fa05
add eax, 0xff72fa27
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x46f88
push 0
mov eax, 0x55287eb
add eax, 0xabb083d
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x5468
xor edi, edi
add edi, eax
mov edx, 0x98f7662e
sub edx, 0x88e5482e
add edx, dword [ebp - 0x44]
mov esi, 0x3ca29283
add esi, 0x2b0764d8
add dword [ebp - 8], edx
mov ebx, dword [edx]
xor dword [ebp - 0x34], 0xfc3f556d
sub ebx, esi
mov dword [edi], ebx
add edi, 0x6d630791
sub edi, 0x6d63078d
add edx, 0x79725227
sub edx, 0x79725223
loop 0x1007f487
add eax, 0xa5a8443b
add eax, 0x5a590038
xor ebx, ebx
add ebx, eax
add eax, 0xc4c09f00
sub eax, 0xc4c09efb
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1007f713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d7204
call fcn.100cece0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.1007f8eb
xor edi, edi
cmp eax, edi
jne 0x1007f8da
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x1007f76b
push 1
pop eax
jmp 0x1007f76d
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100786d5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x1007f8bf
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x1007f892
cmp word [eax + 0x20], 1
jne 0x1007f892
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10080f40
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.1007f41d
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007e9a8
test eax, eax
jne 0x1007f8aa
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1007f826
cmp byte [ebx + 0x2c], 0
je 0x1007f8c5
xor eax, eax
cmp byte [edi + eax], 0
jne 0x1007f8c5
inc eax
cmp eax, 0x14
jb 0x1007f816
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x1007f83e
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10080ecb
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.1007f41d
test eax, eax
jne 0x1007f8aa
cmp byte [ebp + 0x17], al
je 0x1007f892
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x1007f8a6
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x1007f8a6
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x1007f892
cmp dword [eax + 0x24], 1
jne 0x1007f892
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x1007f88a
test al, al
je 0x1007f8c5
test al, al
je 0x1007f892
test cl, cl
je 0x1007f8ae
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x1007f8bf
jmp 0x1007f792
xor cl, cl
jmp 0x1007f86a
mov esi, eax
jmp 0x1007f8cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
push 1
pop eax
jmp 0x1007f8da
cmp byte [ebp + 0x17], 0
je 0x1007f8ca
push 1
pop esi
jmp 0x1007f8cc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.1007f41d
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.1007f41d
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.1007f41d
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.1007f41d
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.1007f41d
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.1007f41d
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.1007f41d
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.1007f41d
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.1007f41d
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x100093f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10009405
pop dword [ebp - 0x20]
mov eax, 0xe09d4f0b
add eax, 0x2f6344fa
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x4f1844fa
sub dword [ebp - 0x30], 0xc5ffaf
mov dword [ebp - 0x2c], 0xf181b010
add dword [ebp - 0x2c], 0x40b19c35
mov dword [ebp - 0x28], 0xf2ab04b0
add dword [ebp - 0x28], 0x59a13f7e
mov dword [ebp - 0x24], 0x672a25cc
add dword [ebp - 0x24], 0x98d5da34
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x546ea6f0
add dword [ebp - 0x30], 0x2003c266
mov dword [ebp - 0x2c], 0xd5ab9c8
add dword [ebp - 0x2c], 0x3411a7ad
mov dword [ebp - 0x28], 0xdb275178
add dword [ebp - 0x28], 0x88481af4
mov dword [ebp - 0x24], 0xb33d5f3a
add dword [ebp - 0x24], 0x4cc2a0c6
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x64cb541
add eax, 0x9b3faeb
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37b8c
push 0
call eax
mov ecx, 0x4dc09594
add ecx, 0xb23fb36f
mov ebx, eax
mov edx, 0x802078ee
sub edx, 0x701c16ee
add edx, dword [ebp - 0x20]
mov edi, 0x7ce7dd80
add edi, 0xa5855ee0
sub dword [ebp - 0x18], edi
mov esi, dword [edx]
xor dword [ebp - 0xc], 0xe77df137
add esi, edi
add dword [ebp - 0x18], 0x44e63f91
mov dword [ebx], esi
sub dword [ebp - 0x10], edi
add ebx, 0x1ef49ec7
add ebx, 0xe10b613d
add edx, 0xbe1d073b
add edx, 0x41e2f8c9
loop 0x10009522
add eax, 0xdca45e8c
sub eax, 0xdca347ad
xor ebx, ebx
add ebx, eax
add eax, 0x5ff6e248
sub eax, 0x5ff6e243
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401e12
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401e51
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401e51
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401e51
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401e51
cmp dword [ecx + 0x74], 0xe
jbe 0x401e51
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407d0b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155b0
push 0x4155a8
push str.FlsAlloc
push 0x1e
call fcn.00407bcc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407d3f
push dword [ebp + 8]
mov ecx, esi
call dword [0x414128]
call esi
jmp 0x407d45
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407d89
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155c0
push 0x4155b8
push str.FlsGetValue
push 0x20
call fcn.00407bcc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407dc0
push dword [ebp + 8]
mov ecx, esi
call dword [0x414128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40b2c3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b360
push ebx
push esi
call fcn.0040b28c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b1d5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b30d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b35f
push edi
push eax
call fcn.004084be
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b32d
call fcn.00407a5f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b35e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b1d5
add esp, 0x20
test eax, eax
jne 0x40b34c
push edi
call fcn.00407a5f
jmp 0x40b354
push ebx
call fcn.00407a5f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4132e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41330d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41330d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e59
pop dword [ebp - 0x50]
mov eax, 0xb0678621
add eax, 0x4fd8b838
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x6b060904
add dword [ebp - 0x60], 0xe34c3c47
mov dword [ebp - 0x5c], 0x98892f52
add dword [ebp - 0x5c], 0x99aa1cf3
mov dword [ebp - 0x58], 0xc1af41c0
sub dword [ebp - 0x58], 0x7562fd92
mov dword [ebp - 0x54], 0x49b6bfd0
add dword [ebp - 0x54], 0xb6494030
lea eax, [ebp - 0x60]
push eax
mov eax, 0xdfb814c0
sub eax, 0xdf779434
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4aa5a3c4
add dword [ebp - 0x60], 0x29ccc592
mov dword [ebp - 0x5c], 0x81ec7bf7
add dword [ebp - 0x5c], 0xbf7fe57e
mov dword [ebp - 0x58], 0xd96eff75
add dword [ebp - 0x58], 0x8a006cf7
mov dword [ebp - 0x54], 0x6fb7b82d
add dword [ebp - 0x54], 0x904847d3
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xa570ac07
add eax, 0x5acfd4cd
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a045
push 0
call eax
mov ecx, 0x5514
mov esi, eax
mov edx, 0xd660f9e4
sub edx, 0xd61fe9e4
add edx, dword [ebp - 0x50]
mov edi, 0x8e84e74d
add edi, 0x89a15bee
xor dword [ebp - 0x40], edi
mov ebx, dword [edx]
xor dword [ebp - 0x1c], ecx
xor ebx, edi
sub dword [ebp - 0x24], 0xba375202
mov dword [esi], ebx
sub dword [ebp - 0x34], 0xf0528910
add esi, 0x1be748b2
add esi, 0xe418b752
add edx, 4
loop 0x403f75
add eax, 0x775cad41
add eax, 0x88a499e2
mov ebx, eax
add eax, 0x447c9678
sub eax, 0x447c9673
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x44c4e0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x44c54a
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x44c51a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x44c566
push ecx
push esi
call fcn.0044f6a0
add esp, 8
mov ebx, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x44c5d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x44c662
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x44c654
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x44c64c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x44c615
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx