joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428ad0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x428af7
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00428380
mov dword [esp + 4], eax
jmp 0x428b11
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x428b1d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x428b39
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x428b49
mov esi, 2
jmp 0x428b65
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x428b58
mov esi, 3
jmp 0x428b65
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x428bc2
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x428b94
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.00428380
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x42bbe0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x42bc12
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42bc0d
cmp dword [esp + 0xc], esi
je 0x42bc29
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x42f799
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x43a870]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x42f7fa
push esi
push dword [0x43a86c]
push 8
push dword [0x438d40]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x43a870]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x43a868]
jmp 0x42f7ea
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x42f7e8
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x42f7d8
push edi
push 0x42f737
call fcn.004310a7
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4
Function at 0x42f804
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x42f81a
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x43a86c]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42f851
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x438d40]
mov dword [0x43a870], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x43a870]
call ebx
mov eax, dword [0x43a86c]
mov edi, eax
add eax, esi
push eax
push dword [0x43a870]
mov dword [0x43a86c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x438d40]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x43a870]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x42f891
test ebx, ebx
je 0x42f8b2
push 0x14
push 0x43a868
call fcn.0043011d
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x42f8b2
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x430210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x430256
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x43ab10]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x430277
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x43ab10]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00430930
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x430300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x430410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x430440
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x430620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x430644
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x430694
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x43ab10]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4306dc
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x4306dc
cmp dword [ebp - 8], 0x100000
jge 0x4306b0
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x43ab10]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x430700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x430880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x4308be
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x4308be
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x4308c0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x430980
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x430a90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x436d3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4310a7
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x43a8b0], 0
push ebx
push esi
mov esi, 0x43a8b8
jne 0x4310d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x43a8d0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x43a8b0], 1
push dword [0x43a8d0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x431170
push 0x14
push 8
push dword [0x438d40]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x43119a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x43a8b4]
test eax, eax
je 0x431115
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x43a8b4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x43119f
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x43a8d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x438d40]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x43119a
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x40afa0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push edi
mov edi, ecx
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x40afba
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40afb1
sub eax, ebx
mov ebp, eax
cmp eax, 2
jbe 0x40b036
lea edx, [eax - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov edi, edi
movzx eax, byte [edi]
movzx ebx, byte [edi + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [edi + 2]
shl eax, 8
or eax, ebx
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 1], bl
mov ebx, eax
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 0x3f
mov byte [esi + ecx + 2], bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx + 3], al
add edi, 3
add ecx, 4
sub ebp, 3
dec edx
jne 0x40afd0
test ebp, ebp
je 0x40b0aa
movzx eax, byte [edi]
shl eax, 0x10
cmp ebp, 1
jbe 0x40b04e
movzx edx, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], dl
cmp ebp, 1
jbe 0x40b096
shr eax, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
pop edi
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
mov al, 0x3d
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
pop ebp
mov byte [ecx + esi], 0
mov eax, ecx
pop ebx
ret

Function at 0x41bcc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4ba388], eax
mov edx, 1
mov eax, 0x4ba388
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4bad44
jl 0x41bcd0
mov dword [0x4b79c8], 1
mov dword [0x4bbd20], 1
pop edi
ret
Function at 0x41bd10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4bbd20], 0
push esi
mov esi, 0x4ba388
jne 0x41bd2a
call dword [0x4a52bc]
call fcn.0041bcc0
mov dword [0x4b79c8], 0x270
mov dword [0x4ba380], esi
mov ecx, 0xe3
nop
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x41bd40
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x41bd75
mov ecx, dword [esi]
mov eax, dword [0x4ba388]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x41bde0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4b79c8]
jne 0x41bded
call fcn.0041bd10
mov eax, dword [0x4ba380]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4ba380], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x41be30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x4b79c8]
jne 0x41be3e
call fcn.0041bd10
mov ecx, dword [0x4ba380]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4ba380], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
jns 0x41be85
fadd qword [0x4b1630]
fmul qword [0x4b1680]
pop ecx
ret
Function at 0x4275f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x4b79d2]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov dword [esp + 0x1e], 0x7b3f2e
mov edi, ebp
test ebp, ebp
je 0x42765a
mov dl, byte [ebp]
test dl, dl
je 0x42765a
lea ecx, [ecx]
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x4276ae
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x427646
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x427640
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427660
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x427680
mov al, byte [edi]
cmp al, 0x20
je 0x42767b
cmp al, 9
jne 0x427680
dec edi
cmp edi, ebp
ja 0x427671
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x4276b5
cmp byte [esp + 0x30], 0
je 0x4276a3
mov ecx, dword [esp + 0x28]
push ebp
push 0x4abc44
call fcn.0043b780
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x427680
dec edi
jmp 0x42766d
push esi
push ebp
push ebx
call fcn.00496040
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x100010d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100010e5
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000111b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10001117
cmp esi, edx
jae 0x1000111b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10001107
cmp esi, edx
jb 0x10001121
pop esi
pop edi
xor eax, eax
pop ebx
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10001130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0
mov ecx, 0x10019288
mov dword [esp + 0x14], ebx
call fcn.100044f6
mov edi, eax
mov ebp, 1
test edi, edi
je 0x100011e0
mov eax, ebx
shr eax, 4
mov dword [esp + 0x14], eax
inc eax
push 0
movzx eax, ax
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
je 0x100011be
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100011be
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100011be
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100011b4
cmp esi, edx
jae 0x100011be
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x100011a4
cmp esi, edx
jae 0x100011be
cmp word [esi], 0
jne 0x100011d6
push ebp
mov ecx, 0x10019288
call fcn.100044f6
mov edi, eax
inc ebp
test edi, edi
je 0x100011e0
mov eax, dword [esp + 0x14]
jmp 0x10001161
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x10001410
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
je 0x10001424
mov ecx, eax
call fcn.100030c0
mov cl, byte [esi]
or eax, 0xffffffff
test cl, cl
je 0x100014c7
movzx ecx, cl
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
lea esi, [esi + 1]
xor eax, ecx
mov cl, byte [esi]
test cl, cl
jne 0x10001431
not eax
pop esi
ret
Function at 0x10002d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
lea eax, [esp]
push eax
mov word [esp + 0x18], 0x6574
mov dword [esp + 0x29], 0x746f68
mov dword [esp + 0x1b], 0x686c6f6f
mov dword [esp + 0x14], 0x61657243
mov word [esp + 0x1f], 0x6c65
mov dword [esp + 0x25], 0x7370616e
mov byte [esp + 0x1a], 0x54
mov word [esp + 0x22], 0x3233
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x21], 0x70
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002de7
push 0
push 2
call eax
add esp, 0x2c
ret
or eax, 0xffffffff
add esp, 0x2c
ret

Function at 0x10002df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
push edi
lea eax, [esp + 8]
push eax
mov esi, edx
mov edi, ecx
mov dword [esp + 0x1d], 0x65636f72
mov dword [esp + 0x26], 0x74737269
mov dword [esp + 0x21], 0x32337373
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x2a], 0
mov byte [esp + 0x25], 0x46
mov dword [esp + 0x12], 0x642e3233
mov word [esp + 0x16], 0x6c6c
mov byte [esp + 0x18], 0
mov word [esp + 0xd], 0x7265
mov word [esp + 0x10], 0x6c65
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xf], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002e71
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x20
ret
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret

Function at 0x10002e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
push edi
lea eax, [esp + 0x14]
push eax
mov esi, edx
mov edi, ecx
mov word [esp + 0xc], 0x7243
mov dword [esp + 0x14], 0x41656c
mov dword [esp + 0xf], 0x46657461
mov byte [esp + 0xe], 0x65
mov byte [esp + 0x13], 0x69
mov dword [esp + 0x1e], 0x642e3233
mov word [esp + 0x22], 0x6c6c
mov byte [esp + 0x24], 0
mov word [esp + 0x19], 0x7265
mov word [esp + 0x1c], 0x6c65
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x1b], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002f07
push 0
push 0
push dword [esp + 0x38]
push 0
push 0
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x1c
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x1c
ret