joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x4072ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x4072ab
lcall 0x5de5, 0x8b10c483
jmp fcn.00a6d134
Function at 0x401f40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x418adc]
push esi
mov esi, ecx
test eax, eax
je 0x401f6d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x418adc], 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x418adc], eax
mov eax, 2
mov word [ebp - 0x14], ax
mov eax, dword [0x418ad0]
mov dword [ebp - 0x10], eax
movzx eax, word [0x418ad4]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x418adc]
call dword [sym.imp.WS2_32.dll_connect]
push 0x23
push 0x8001
push esi
push dword [0x418adc]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00402ea0
mov esp, ebp
pop ebp
ret

Function at 0x401fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, bx
movzx esi, ax
push edi
add esi, 0x10
mov dword [ebp - 8], edx
push esi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
call fcn.00406b03
mov edi, eax
add esp, 4
test edi, edi
je 0x402126
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0xffffffffffffffff
mov word [edi + 2], ax
call dword [sym.imp.WS2_32.dll_ntohl]
push 0
mov dword [edi + 4], eax
mov word [edi + 8], 1
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [edi + 0xa], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0xc], ax
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push ebx
push dword [ebp - 8]
mov word [edi + 0xe], ax
lea eax, [edi + 0x10]
push eax
call fcn.00404bb0
lea edx, [esi + 0xa]
mov eax, 8
mov ecx, edx
and ecx, 7
sub eax, ecx
test ecx, ecx
cmove eax, ecx
add eax, edx
mov dword [ebp + 8], eax
add eax, 0x12
push eax
call fcn.00406b03
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x402126
lea eax, [ebp + 8]
mov edx, esi
push eax
lea ecx, [ebx + 0x12]
push ecx
push ecx
mov ecx, edi
call fcn.00401140
mov esi, dword [ebp + 8]
push edi
add esi, 0x12
call fcn.00406ae8
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_htonl]
push 0x74
mov dword [ebx], eax
call dword [sym.imp.WS2_32.dll_ntohs]
push 0
mov word [ebx + 4], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push 0
mov word [ebx + 6], ax
call edi
push 0
mov dword [ebx + 8], eax
call edi
mov dword [ebx + 0xc], eax
mov edi, ebx
mov word [ebx + 0x10], 1
test esi, esi
jle 0x40211d
push 0
push esi
push edi
push dword [0x418adc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x40211d
sub esi, eax
add edi, eax
test esi, esi
jg 0x402101
push ebx
call fcn.00406ae8
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402280
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040f8f0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
mov dword [ebp - 0x100c], ecx
sub eax, 1
jne 0x402486
push ebx
push esi
push eax
lea ebx, [ebp - 0x1004]
push 0x1000
mov eax, ebx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x402484
mov ecx, dword [0x418ac4]
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
push edi
test ecx, ecx
je 0x402416
cmp dword [0x418acc], 4
jae 0x402335
mov ebx, dword [0x418acc]
lea eax, [ebp - 0x1004]
mov edi, 4
sub edi, ebx
cmp esi, edi
cmovl edi, esi
push edi
push eax
lea eax, [ebx + ecx]
push eax
call fcn.00404bb0
add ebx, edi
add esp, 0xc
mov dword [0x418acc], ebx
cmp ebx, 4
jb 0x402483
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
lea ebx, [ebp - 0x1004]
mov ecx, dword [0x418ac4]
add ebx, edi
sub esi, edi
push dword [ecx]
call eax
mov edx, dword [0x418acc]
mov ecx, eax
sub eax, edx
mov dword [ebp - 0x1010], ecx
mov dword [ebp - 0x1008], eax
cmp ecx, dword [0x418ac8]
jle 0x40238a
push ecx
push dword [0x418ac4]
mov dword [0x418ac8], ecx
call fcn.00406add
mov edi, eax
add esp, 8
test edi, edi
je 0x402483
mov eax, dword [ebp - 0x1008]
mov edx, dword [0x418acc]
mov dword [0x418ac4], edi
jmp 0x402390
mov edi, dword [0x418ac4]
test eax, eax
js 0x4023f0
cmp esi, eax
cmovl eax, esi
push eax
mov dword [ebp - 0x1008], eax
lea eax, [edx + edi]
push ebx
push eax
call fcn.00404bb0
mov ecx, dword [0x418acc]
add esp, 0xc
add ecx, dword [ebp - 0x1008]
mov eax, dword [ebp - 0x1010]
mov dword [0x418acc], ecx
cmp ecx, eax
jl 0x402483
mov ecx, dword [ebp - 0x100c]
mov edx, edi
push eax
call fcn.00402130
add ebx, dword [ebp - 0x1008]
add esp, 4
sub esi, dword [ebp - 0x1008]
mov edi, dword [0x418ac4]
push edi
call fcn.00406ae8
add esp, 4
mov dword [0x418ac4], 0
mov dword [0x418acc], 0
test esi, esi
jle 0x402483
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
cmp esi, 4
jae 0x402422
mov edi, 4
jmp 0x402428
push dword [ebx]
call eax
mov edi, eax
push edi
cmp edi, esi
jg 0x40245b
mov ecx, dword [ebp - 0x100c]
mov edx, ebx
call fcn.00402130
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
sub esi, edi
add esp, 4
add ebx, edi
test esi, esi
jg 0x402416
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402ea0
mov esp, ebp
pop ebp
ret
mov dword [0x418ac8], edi
call fcn.00406b03
add esp, 4
test eax, eax
je 0x402483
push esi
push ebx
push eax
mov dword [0x418ac4], eax
call fcn.00404bb0
add esp, 0xc
mov dword [0x418acc], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402ea0
mov esp, ebp
pop ebp
ret
Function at 0x4037ee
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40382d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40382d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40382d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40382d
cmp dword [ecx + 0x74], 0xe
jbe 0x40382d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408f86
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x408fd1
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00409121
test al, al
jne 0x408fcb
sub edx, 2
cmp edx, edi
jne 0x408fb1
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x408ff3
lea eax, [edi + 2]
cmp edx, eax
je 0x408ff3
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00408ed2
add esp, 0x10
jmp 0x4090ed
push esi
lea ecx, [ebp - 0x255]
call fcn.00409121
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409036
push dword [ebp - 0x25c]
jmp 0x408fe3
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x409073
cmp word [ebp - 0x226], 0
je 0x409094
cmp word [ebp - 0x226], ax
jne 0x409073
cmp word [ebp - 0x224], 0
je 0x409094
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00408ed2
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4090e0
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40904d
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4090c8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4090ed
push 0x408d02
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040bb50
add esp, 0x10
jmp 0x4090bd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402ea0
leave
ret

Function at 0x40ab50
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41233c
push 0x412334
push str.FlsAlloc
push 0x1f
call fcn.0040aa8b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ab84
push dword [ebp + 8]
mov ecx, esi
call dword [0x410248]
call esi
jmp 0x40ab8a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x40abce
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41234c
push 0x412344
push str.FlsGetValue
push 0x21
call fcn.0040aa8b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ac05
push dword [ebp + 8]
mov ecx, esi
call dword [0x410248]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40ac0d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412354
push 0x41234c
push str.FlsSetValue
push 0x22
call fcn.0040aa8b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ac47
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x410248]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40f800
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f82d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f82d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x4010a8
mov eax, esi
pop esi
ret

Function at 0x401258
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x18], 0x29
cmp dword [ebp - 0x18], 0x1abc
jle 0x4012b9
sub bh, byte [eax + 0x74bf54a6]
sbb eax, 0x67e917ce
movsd dword es:[edi], dword [esi]
or dword [eax], eax
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x1f
jmp 0x4012cd
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x401449
mov dword [ebp - 0x1c], 0x32c
cmp dword [ebp - 0x1c], 0x1b5e
jle 0x401350
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x401363
mov byte [ebp - 1], 1
jmp 0x401367
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x401380
mov byte [ebp - 2], 1
jmp 0x401384
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
mov dword [ebp - 0x20], 0xb28
cmp dword [ebp - 0x20], 0x1d75
jle 0x40140d
pop es
cmc
enter 0xffffffffffffb044, 0x77
fistp qword [ecx - 0x1d]
invalid
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x40141f
and dword [ebp - 0x14], 0
jmp 0x40142c
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4012c6
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x100091c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x10082280]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x2f30e418
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
sub eax, 0xb1913b99
je 0x10009390
jmp 0x100091fc
mov eax, dword [ebp - 0x28]
sub eax, 0xebf4b1c6
je 0x10009337
jmp 0x1000920f
mov eax, dword [ebp - 0x28]
sub eax, 0x2f30e418
je 0x1000924d
jmp 0x10009222
mov eax, dword [ebp - 0x28]
sub eax, 0x5915b0e4
je 0x100092b8
jmp 0x10009235
mov eax, dword [ebp - 0x28]
sub eax, 0x753642d0
je 0x10009343
jmp 0x10009248
jmp 0x1000939d
mov ecx, dword [0x10083794]
mov eax, dword [0x10083790]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb1913b99
mov ecx, 0x5915b0e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x1000939d
mov eax, dword [ebp - 0x24]
push eax
mov ecx, esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [0x10083794]
mov eax, dword [0x10083790]
mov edx, ecx
add edx, 0x5d801982
sub edx, 1
sub edx, 0x5d801982
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb1913b99
mov ecx, 0xebf4b1c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x1000939d
mov dword [ebp - 0x1c], 0x753642d0
jmp 0x1000939d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x18]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0x14]
mov edi, dword [edx]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x64
sub byte [edi], 0x88
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x1000935d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10022840
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x5915b0e4
jmp 0x100091e6
Function at 0x1000b960
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Execute shellcode via indirect call
Hash data using murmur3
Hide graphical window
Parse credit card information
Parse pe header
Resume thread

Disassembly:
jmp 0x10012b76
push ebp
cmc
lahf
rcr ecx, 0x9d
mov ebp, esp
bsr ax, ax
push ebx
adc dl, al
lahf
push edi
push esi
mov cl, ah
lea esp, [esp - 0x258]
mov eax, dword [0x10082280]
bts ecx, esi
test dx, 0xb12d
xor eax, ebp
movzx ecx, bx
cmovp ecx, eax
mov ecx, edx
mov dword [ebp - 0x10], eax
rol dl, 0x8f
neg dh
xor dh, 0xae
mov ecx, dword [0x1008376c]
cwde
mov eax, dword [0x10083768]
ror edx, cl
rcr dh, 0x8e
mov edx, ecx
lea edx, [edx + 0x3af91df]
cmp dl, 0x25
test sp, sp
lea edx, [edx - 1]
cmp ebx, ebp
cmp bl, 0xa8
clc
add edx, 0xfc506e21
test si, 0xc605
imul ecx, edx
clc
test esi, ebx
and ecx, 1
test di, si
clc
cmp ecx, 0
sete cl
clc
and cl, 1
cmc
test ecx, esp
mov byte [ebp - 0x25a], cl
cmp eax, 0xa
setl al
and al, 1
cmp edi, 0xb0461a4
mov byte [ebp - 0x259], al
and al, dh
lahf
mov dword [ebp - 0x260], 0x21e2c4d3

Function at 0x1002785a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10027899
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10027899
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10027899
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10027899
cmp dword [ecx + 0x74], 0xe
jbe 0x10027899
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002a224
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002a2c1
push ebx
push esi
call fcn.1002a1ed
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002a181
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002a26e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002a2c0
push edi
push eax
call fcn.10028b22
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002a28e
call fcn.10028b70
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002a2bf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002a181
add esp, 0x20
test eax, eax
jne 0x1002a2ad
push edi
call fcn.10028b70
jmp 0x1002a2b5
push ebx
call fcn.10028b70
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002a52e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10032780
push 0x10032778
push str.FlsAlloc
push 0x1f
call fcn.1002a44a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002a562
push dword [ebp + 8]
mov ecx, esi
call dword [0x10030150]
call esi
jmp 0x1002a568
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002a5ac
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10032790
push 0x10032788
push str.FlsGetValue
push 0x21
call fcn.1002a44a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002a5e3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10030150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002a5eb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10032798
push 0x10032790
push str.FlsSetValue
push 0x22
call fcn.1002a44a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002a625
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10030150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1002fb30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002fb5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002fb5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4013c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4087b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
push 0x409768
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x1c
call fcn.0040369a
mov esi, dword [ebp + 0x10]
push 0x40b08c
push 0x40b09c
mov edi, dword [esi + 4]
mov dword [ebp - 0x1c], edi
call dword [0x409004]
push eax
call dword [section..rdata]
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebp - 0x14], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x4014cf
add ebx, 0x10
jmp 0x401443
mov edi, dword [ebp - 0x1c]
cmp dword [ebx], 0
jne 0x40147f
mov edx, dword [ebp + 0xc]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x4014b2
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, edi
push esi
push eax
call dword [0x40e628]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4014b2
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, edi
push eax
push ecx
call dword [0x40e628]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [ebp + 8]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x401440
mov eax, 0x4014d5
ret
Function at 0x4014f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4087c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esp
push 0x409768
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x29
call fcn.0040369a
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0
mov eax, dword [ecx]
mov dx, word [eax + 0x14]
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor ecx, ecx
mov cx, word [edx + 6]
mov edx, dword [ebp - 0x20]
cmp edx, ecx
jge 0x401650
mov eax, dword [eax + 0x24]
push 0x409768
mov edx, eax
mov ecx, eax
shr edx, 0x1d
and edx, 1
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x28]
shr ecx, 0x1e
and ecx, 1
push edx
shr eax, 0x1f
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x4d
call fcn.0040369a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x24]
test eax, 0x2000000
je 0x4015bd
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 8]
push 0x4000
push eax
push ecx
call dword [0x40e614]
mov eax, 0x40163b
ret
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
test eax, 0x4000000
lea edx, [edx + esi*2]
mov esi, dword [ebp - 0x2c]
lea edx, [esi + edx*2]
mov edx, dword [edx*4 + 0x40b0ac]
mov dword [ebp - 0x1c], edx
je 0x4015e3
or dh, 2
mov dword [ebp - 0x1c], edx
mov ecx, dword [ecx + 0x10]
test ecx, ecx
mov dword [ebp - 0x18], ecx
jne 0x401611
test al, 0x40
je 0x401602
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, 0x401617
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x18], edx
ret
test al, 0x80
je 0x401611
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, 0x401617
ret
mov eax, 0x401656
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219