joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036ca9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058aca
call fcn.100573b8
sub esp, 0x40
push ebx
push esi
mov dword [ebp - 0x2c], 0x68be
mov al, dl
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x2c], 0x6b5f
mov byte [ebp - 0x15], al
mov dword [ebp - 0x34], ecx
jle 0x10036d00
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x100720b8
xor eax, edi
cdq
push edx
push eax
call fcn.10001c38
inc ebx
cmp ebx, 0x2472
jl 0x10036cda
inc edi
cmp edi, 0x1ac9
jl 0x10036cd8
mov al, byte [ebp - 0x15]
test al, al
je 0x10036d2b
cmp byte [ebp + 0x24], 0
je 0x10036d1e
mov ecx, dword [ebp + 0x30]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], esi
call fcn.1002dd53
jmp 0x10036e50
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x10036e50
cmp byte [ebp + 0x2c], 0
je 0x10036e3a
xor edi, edi
mov dword [ebp - 0x28], 0x290d
inc edi
cmp dword [ebp - 0x28], 0x2943
jle 0x10036dc3
mov ebx, esi
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
cdq
idiv dword [ebp - 0x20]
lea eax, [ecx + edx]
or eax, ebx
lea ecx, [ebp - 0x4c]
cdq
push edx
push eax
call fcn.10001a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036d75
mov eax, dword [eax]
push eax
call fcn.1003fd76
pop ecx
push esi
push edi
lea ecx, [ebp - 0x4c]
call fcn.10002015
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x161e
mov eax, dword [ebp - 0x24]
jl 0x10036d57
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x3b2c
jl 0x10036d54
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x60bc
jl 0x10036d4f
inc ebx
cmp ebx, 0x2007
jl 0x10036d4a
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp dword [ebp - 0x28], 0x25ba
jge 0x10036dd7
push str.orljd_mhjtbrqs_tuge_tpaufutll
call fcn.1003fd76
pop ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, 4
setg cl
cmp ecx, 0xfffb
mov ecx, dword [ebp - 0x34]
sbb eax, eax
inc eax
mov dword [ecx], eax
cmp dword [ecx], 0xfffe
jae 0x10036e03
mov eax, dword [edx]
cmp dword [eax], esi
jne 0x10036e05
mov edi, esi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x1c]
mov dword [eax], edi
mov ecx, dword [esi]
mov eax, dword [edx]
imul edi, edi, 0x3271
mov dword [eax + ecx*4], edi
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
mov eax, dword [eax]
mov ecx, dword [esi]
imul edx, eax
mov eax, dword [ebp + 0x34]
imul ecx, edi
imul ecx, edx
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [ebp + 0x20]
mov dword [eax], ecx
jmp 0x10036e50
mov eax, dword [ebp + 0x28]
push dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
push dword [ecx + 4]
call fcn.100398da
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x6667
jge 0x10036e6f
mov edx, str.arng_ynythpjp_onljxz_esx_azfgmnu_nscftuoyf_nngrz_mqw_lhymatq
mov ecx, 0x100720b8
call fcn.100035ef
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100372dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058ad4
call fcn.100573b8
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 8], bl
je 0x10037322
mov dword [esi], ebx
jmp 0x1003730d
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, 0x20a6
call fcn.10037a2a
inc dword [esi]
pop ecx
cmp dword [esi], ebx
jle 0x100372fc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10037311
mov dword [ebp - 0x18], 0x5bd3
cmp dword [ebp - 0x18], 0x5cbe
jle 0x10037375
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, edi
mov ecx, 0x100720b8
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001c38
inc ebx
cmp ebx, 0x5d1e
jl 0x10037341
inc edi
push 0
pop ebx
cmp edi, 0x5ed
jl 0x1003733e
inc esi
cmp esi, 0x55c8
jl 0x1003733c
push 1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x57f5
jge 0x10037311
mov edx, str.vsmjlzw_zefml_cjxifck_znbgolhx_gradlzo_qfcnnlu
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x10037311

Function at 0x10037469
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058af0
call fcn.100573b8
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], cl
je 0x10037546
mov dword [ebp - 0x24], 0x4af3
cmp dword [ebp - 0x24], 0x4d21
jle 0x100374e5
xor edi, edi
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], 0x6556
mov eax, esi
mov ecx, 0x100720b8
xor eax, edi
cdq
push edx
push eax
call fcn.10001c38
add esi, ebx
dec dword [ebp - 0x1c]
jne 0x100374ac
mov esi, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x7c62
jl 0x100374a2
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x17e1
jl 0x100374a0
inc edi
cmp edi, 0x5037
jl 0x1003749b
cmp byte [ebp + 0x10], 0
je 0x100374f6
mov eax, dword [ebp + 8]
mov dword [eax], 0xcfd1f2e9
jmp 0x1003750e
push ecx
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
push 0x47de
push eax
xor dl, dl
call fcn.100371d3
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x48cf
jge 0x1003752a
mov edx, str.tsl_lmhmhccv_tmpsyawyc_knsissm
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x1003756e
test cl, cl
je 0x10037556
cmp byte [edx], 0
je 0x1003756e
call fcn.1003759c
jmp 0x1003756e
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1003756e
push ecx
xor dl, dl
mov ecx, 0x2b74
call fcn.10036c8f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ae9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x807a18]
jne 0x405af3
repz ret
jmp fcn.0040883c

Function at 0x4080f6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402b3a
and dword [ebp - 4], 0
cmp dword [0x80c318], 0
mov ebx, eax
jne 0x4081a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408258
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408258
push eax
call fcn.00402ac8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x80c318], eax
call esi
push eax
call fcn.00402ac8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x80c31c], eax
call esi
push eax
call fcn.00402ac8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x80c320], eax
call esi
push eax
call fcn.00402ac8
pop ecx
mov dword [0x80c328], eax
test eax, eax
je 0x4081a7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402ac8
pop ecx
mov dword [0x80c324], eax
mov eax, dword [0x80c324]
cmp eax, ebx
je 0x4081ff
cmp dword [0x80c328], ebx
je 0x4081ff
push eax
call fcn.00402b43
push dword [0x80c328]
mov esi, eax
call fcn.00402b43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4081ff
test edi, edi
je 0x4081ff
call esi
test eax, eax
je 0x4081f6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4081f6
test byte [ebp - 0xc], 1
jne 0x4081ff
or dword [ebp + 0x10], 0x200000
jmp 0x408238
mov eax, dword [0x80c31c]
cmp eax, ebx
je 0x408238
push eax
call fcn.00402b43
pop ecx
test eax, eax
je 0x408238
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408238
mov eax, dword [0x80c320]
cmp eax, ebx
je 0x408238
push eax
call fcn.00402b43
pop ecx
test eax, eax
je 0x408238
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80c318]
call fcn.00402b43
pop ecx
test eax, eax
je 0x408258
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40825a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40893f
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
mov eax, edx
add eax, 0xad98563e
call fcn.0040898c
sub edx, 0xcbcc74d0
dec eax
xor dword [ebx], esi
sub esp, 4
mov dword [esp], edx
mov eax, dword [esp]
add esp, 4
add ebx, 1
sub eax, eax
cmp ebx, edi
jne fcn.0040893f
dec eax
sub eax, 0xbf6f2d5a
ret
Function at 0x40f810
Capabilities:
Hash data with md5

Disassembly:
movsd xmm0, qword [0x4a41e8]
mov edx, ecx
subsd xmm0, qword [0x498960]
comisd xmm0, xmmword [0x496e88]
jbe 0x40f84d
movsd xmm1, qword [0x4a42d8]
mov eax, dword [0x4a4380]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
movsd qword [0x4a4268], xmm1
movsd xmm3, qword [0x496ce0]
mov dword [edx], 0
mov ax, word [0x4a434c]
movsx ecx, ax
mov eax, dword [0x4a421c]
add ecx, eax
mov eax, dword [0x4a431c]
inc word [0x4a434c]
add eax, 0x48358141
dec dword [0x4a431c]
cmp eax, ecx
jg 0x40f8d7
movsd xmm0, qword [0x4a41d0]
subsd xmm0, xmm3
movsd qword [0x4a41d0], xmm0
movsd xmm1, qword [0x4a41d0]
movsx eax, word [0x4a4400]
subsd xmm1, qword [0x498790]
movd xmm0, eax
mov eax, dword [0x4a4434]
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
cvttsd2si eax, xmm0
mov dword [0x4a4434], eax
mov dword [edx + 4], 0
mov ecx, 0x529dd9f9
mov eax, dword [0x4a41e4]
sub ecx, eax
movss xmm0, dword [0x4a4190]
movss xmm4, dword [0x496cd8]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
addss xmm0, xmm1
movss dword [0x4a4190], xmm0
mov dword [edx + 8], 0x67452301
movss xmm0, dword [0x4a445c]
addss xmm0, dword [0x498d88]
addss xmm0, dword [0x498d74]
cvttss2si eax, xmm0
mov word [0x4a4318], ax
mov dword [edx + 0xc], 0xefcdab89
mov eax, dword [0x4a429c]
movss xmm0, dword [0x4a4060]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
movss xmm1, dword [0x498e30]
cvttss2si eax, xmm0
mov dword [0x4a429c], eax
movss xmm0, dword [0x4a4060]
subss xmm0, xmm4
movss dword [0x4a4060], xmm0
mov dword [edx + 0x10], 0x98badcfe
inc dword [0x4a431c]
dec word [0x4a4208]
mov eax, dword [0x4a431c]
movss xmm2, dword [0x4a43ec]
movd xmm0, eax
movsx eax, word [0x4a4208]
cvtdq2ps xmm0, xmm0
addss xmm2, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm2, xmm0
movss xmm0, dword [0x4a4494]
subss xmm1, xmm0
addss xmm1, dword [0x499364]
comiss xmm1, xmm2
jbe 0x40fa81
mov ecx, dword [0x4a40c4]
mov eax, dword [0x4a44a8]
add ecx, 0x6f40a5d4
dec dword [0x4a44a8]
cmp eax, ecx
jg 0x40fa2d
mov eax, dword [0x4a43fc]
movss xmm0, dword [0x4a41b8]
add eax, 0x64f77f0e
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
movss dword [0x4a41b8], xmm0
inc dword [0x4a43fc]
mov dword [edx + 0x14], 0x10325476
add dword [0x4a44a8], 0x7647ddbf
ret
movsd xmm0, qword [0x4a4088]
subsd xmm0, xmm3
movsd qword [0x4a4088], xmm0
movsd xmm0, qword [0x4a42f8]
addsd xmm0, xmm3
movsd qword [0x4a42f8], xmm0
movss xmm0, dword [0x4a40c0]
movsd xmm0, qword [0x4a42f8]
movsd xmm0, qword [0x4a4088]
movss xmm0, dword [0x4a40c0]
subss xmm0, xmm4
movss dword [0x4a40c0], xmm0
mov dword [edx + 0x14], 0x10325476
add dword [0x4a44a8], 0x7647ddbf
ret
Function at 0x41ba50
Capabilities:
Terminate process

Disassembly:
add dword [0x4a41c8], 0xcfba6b8f
push dword [0x4a524c]
call fcn.00401290
mov eax, dword [0x4a4244]
add esp, 4
movss xmm0, dword [0x4a4084]
subss xmm0, dword [0x499684]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
push 1
addss xmm0, dword [0x499330]
subss xmm1, xmm0
cvttss2si eax, xmm1
mov dword [0x4a4244], eax
movss xmm0, dword [0x4a4084]
addss xmm0, dword [0x496cd8]
movss dword [0x4a4084], xmm0
call fcn.0044f139
int3
Function at 0x47d043
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047ce37

Function at 0x47f2a1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047ea7b

Function at 0x47f2ac
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047ecb6

Function at 0x489154
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488d59

Function at 0x48915f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488eda
Function at 0x1016e8ad
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1016e8ec
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1016e8ec
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016e8ec
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1016e8ec
cmp dword [ecx + 0x74], 0xe
jbe 0x1016e8ec
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1017159d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1017163a
push ebx
push esi
call fcn.10171566
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.101714fa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x101715e7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10171639
push edi
push eax
call fcn.1016f53d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10171607
call fcn.1016f58b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10171638
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.101714fa
add esp, 0x20
test eax, eax
jne 0x10171626
push edi
call fcn.1016f58b
jmp 0x1017162e
push ebx
call fcn.1016f58b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x101718a7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10179968
push 0x10179960
push str.FlsAlloc
push 0x1f
call fcn.101717c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101718db
push dword [ebp + 8]
mov ecx, esi
call dword [0x10178120]
call esi
jmp 0x101718e1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10171925
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10179978
push 0x10179970
push str.FlsGetValue
push 0x21
call fcn.101717c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1017195c
push dword [ebp + 8]
mov ecx, esi
call dword [0x10178120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10171964
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10179980
push 0x10179978
push str.FlsSetValue
push 0x22
call fcn.101717c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1017199e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10178120]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10176fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10176ffd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10176ffd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4efadf
Capabilities:
Inspect section memory permissions

Disassembly:
or edx, 0x10
jmp 0x519c35
je 0x5769df
test eax, 0x80000000
je 0x42a8a7
or edx, 4
jmp 0x468842
or edx, 2
jmp 0x555e76
pop ebp
ret 4
jmp 0x519c35
jmp 0x519c35
je 0x423357
or edx, 0x80
jmp 0x4a27bd
jmp 0x519c35
or edx, 0x20
jmp 0x4e5530
test eax, 0x40000000
jmp 0x4279da
jmp 0x519c35
jmp 0x519c35
push ebp
dec ebp
shl ah, cl
bsf ebp, ebp
mov ebp, esp
shl ah, cl
mov eax, dword [ebp + 8]
xor edx, edx
cmp di, 0x53e2
test eax, 0x4000000
je 0x4efb05
or edx, 0x200
test eax, 0x20000000
je 0x4d65f6
test eax, 0x40000000
jmp 0x543c92
je 0x519c32
or edx, 8
jmp 0x4e7670
or edx, 1
mov eax, edx
xchg ebp, ebp
jmp 0x433d01
je 0x59378d
test eax, 0x80000000
je 0x4d0b2c
or edx, 0x40
jmp 0x4b90b9
jmp 0x519c35
test eax, 0x80000000
jmp 0x505d8f
test eax, 0x80000000
jmp 0x4ad12d

Function at 0x51e25d
Capabilities:
Parse pe header

Disassembly:
call fcn.00413a8c
mov edx, eax
bswap cx
xchg cx, cx
lea eax, [ebp - 0x14c]
bswap cx
mov ecx, 0xf8
jmp loc.00414ada
lea eax, [ebp - 0x54]
mov ecx, 0x40
movsx dx, ch
jmp 0x444617
mov dword fs:[eax], edx
jmp 0x4947b9
mov edx, edi
call fcn.0040676c
cmp word [ebp - 0x54], 0x5a4d
jmp 0x52ce06
push edx
jmp 0x555648
jmp fcn.004143ea
push ebp
xor ebp, 0x5ea81f69
stc
rol bp, 0xe0
mov ebp, esp
lea esp, [esp - 0x14c]
push ebx
mov bx, 0x6984
push esi
sub bx, bp
ror bh, cl
push edi
mov ebx, ecx
cmovb cx, dx
movzx cx, ah
mov esi, edx
mov edi, eax
cmovp ecx, edi
cmc
sub eax, eax
inc cx
mov dword [ebp - 8], eax
shrd ecx, edi, 0x15
sub eax, eax
mov ch, 0x86
mov dword [esi], eax
rol cl, 0x6a
sub eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov al, 0x9e
push ebp
cbw
movzx eax, di
push 0x47c2eb
not ah
xchg al, cl
lahf
push dword fs:[edx]
mov ax, cx
cmova eax, edx
setg al
mov dword fs:[edx], esp
xchg cl, dh
lahf
jmp 0x42d265
je 0x5891b9
mov eax, 0x418884
jmp 0x571f52
push eax
bswap eax
mov eax, edi
jmp 0x41da32
call fcn.004043cc
xor eax, eax
bswap dx
movzx cx, ch
pop edx
pop ecx
xchg cl, cl
pop ecx
jmp 0x436852
mov eax, dword [ebp - 0x18]
sete dh
cdq
jmp 0x48b543

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40168e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x42c6f8]
test eax, eax
je 0x4016a9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
push 0x33
mov esi, str._n_nThis_file_appears_to_be_corrupted._Please_try_downloading_it_again._If_the_problem_persists_then_please_contact_Reflexive_Entertainment_for_assistance__see_www.reflexivearcade.com_for_contact_details_.
pop ecx
lea edi, [ebp - 0xcc]
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
call fcn.00418df0
mov esi, eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00418df0
lea eax, [esi + eax + 1]
push eax
call fcn.00418de0
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.00418cf0
lea eax, [ebp - 0xcc]
push eax
push esi
call fcn.00418d00
add esp, 0x1c
push 0
push str.Error
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00418830
pop ecx
pop edi
pop esi
leave
ret

Function at 0x401973
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
cmp dword [ebp + 8], 0
je 0x40199a
push str._nPress_Return_to_continue
call fcn.00418fb7
lea eax, [ebp - 0x400]
push eax
call fcn.00418f6d
pop ecx
pop ecx
push dword [ebp + 8]
call fcn.00418e98