joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x438600]
sub esi, 1
jne 0x407f10
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc4], ebx
jne 0x407f47
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0041a3c0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435571
mov esp, ebp
pop ebp
ret 4

Function at 0x40b7e0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40b81d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40b803
cmp byte [esi], bl
jne 0x40b803
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x438600]
test bl, bl
jne 0x40b7f4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.0040b770
Function at 0x418f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
cmp dword [esi + 0x5e2c], 0
lea ecx, [esi + 0x5e30]
je 0x418fcc
push 0
call fcn.0041af80
push dword [ebp + 8]
lea ecx, [esi + 0x5e30]
push ebx
call fcn.00405b30
mov edx, dword [esi + 0x5e30]
mov ecx, 0x440418
push dword [esi + 0x5e2c]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x5e38]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push ebx
call fcn.00405b30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419370
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x44041c]
test bl, bl
je 0x4193b6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x419397
cmp byte [esi], bl
jne 0x419397
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x438600]
test bl, bl
jne 0x419388
mov edi, dword [0x44041c]
mov ecx, dword [edi + 0x5dd0]
not eax
mov edx, dword [edi + 0x5dd8]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x4193dd
cmp dword [edx + 4], eax
je 0x4193e0
add edx, 0x24
cmp edx, ecx
jne 0x4193d1
xor eax, eax
ret
mov eax, edx
ret

Function at 0x4195d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [0x44041c]
mov eax, ecx
mov dword [ebp - 0xc], eax
mov dword [edi + 0x5dc0], 0
test eax, eax
je 0x41968d
lea ebx, [edi + 0x5dc4]
mov dword [edi + 0x5dc0], 0
push 0
mov ecx, ebx
call fcn.0041af80
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
mov ecx, ebx
call fcn.0041af00
mov eax, dword [edi + 0x5dd0]
mov esi, dword [edi + 0x5dd8]
lea eax, [eax + eax*8]
lea eax, [esi + eax*4]
mov dword [ebp - 8], eax
cmp esi, eax
je 0x41964a
mov eax, dword [esi + 0x1c]
push ebx
push esi
push edi
call eax
add esi, 0x24
add esp, 0xc
cmp esi, dword [ebp - 8]
jne 0x419637
mov esi, dword [ebx]
mov edx, 0x438200
mov ecx, dword [ebp - 0xc]
mov ebx, 0x440418
lea eax, [esi - 1]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [edi + 0x5dcc]
test eax, eax
cmovne ebx, eax
call fcn.00405450
mov edi, eax
test edi, edi
je 0x41968d
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x422d73
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.004087f0
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x422d94
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.004087f0
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x422db5
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.004087f0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x422df2
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.004087f0
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x422e13
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.004087f0
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x422e34
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.004087f0
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.004250d0
Function at 0x425980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
cmp byte [ecx + 0x3c], 0
jne 0x425a21
push dword [0x440414]
lea edi, [ebx + 0x3c]
push 0x60
call fcn.004049f0
mov esi, dword [0x44041c]
add esp, 8
mov ecx, eax
test esi, esi
je 0x425a06
movsx edx, word [esi + 0x5ee4]
lea eax, [esi + 0x5ee8]
mov edi, dword [esi + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], edi
je 0x4259f9
lea eax, [edx + 1]
mov dword [ebp - 8], 6
cdq
idiv dword [ebp - 8]
movzx eax, dx
mov word [esi + 0x5ee4], ax
cwde
add eax, 0xbdd
xor edx, edx
lea eax, [esi + eax*8]
mov dword [eax], edi
mov dword [eax + 4], edx
inc word [eax + 4]
lea edi, [ebx + 0x3c]
inc dword [esi + 0x5edc]
test ecx, ecx
je 0x425a11
call fcn.00427920
jmp 0x425a13
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, edi
lea eax, [ebp - 8]
push eax
call fcn.0041ab70
mov ecx, dword [ebx + 0x54]
mov edi, dword [ebx + 0x58]
cmp ecx, edi
jne 0x425a7c
lea esi, [ecx + 1]
test edi, edi
je 0x425a3d
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x425a42
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, edi
jle 0x425a7c
imul ecx, esi, 0x7c
call fcn.00408750
mov edi, eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x425a73
imul ecx, dword [ebx + 0x54], 0x7c
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebx + 0x5c]
add esp, 0xc
call fcn.004087f0
mov ecx, dword [ebx + 0x54]
mov dword [ebx + 0x5c], edi
mov dword [ebx + 0x58], esi
mov edi, dword [ebx + 0x5c]
mov edx, dword [ebp + 8]
mov esi, edx
imul eax, ecx, 0x7c
mov ecx, 0x1f
add edi, eax
rep movsd dword es:[edi], dword [esi]
inc dword [ebx + 0x54]
imul edi, dword [ebx + 0x54], 0x7c
add edi, dword [ebx + 0x5c]
mov ecx, dword [edi - 4]
test ecx, ecx
jne 0x425aae
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax + ecx*4 - 4]
mov dword [edi - 4], ecx
cmp byte [edi - 0x74], 0
jne 0x425ada
mov ecx, dword [edi - 0x78]
call fcn.00408750
mov ecx, dword [ebp + 8]
push dword [edi - 0x78]
mov dword [edi - 0x7c], eax
mov byte [edi - 0x74], 1
push dword [ecx]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0xffff
cmp word [ecx + 0x3c], ax
jne 0x425aed
mov ax, word [edx + 0x4c]
mov word [ecx + 0x3c], ax
imul esi, dword [ebx + 0x54], 0x7c
mov ecx, dword [ebx + 0x5c]
add esi, ecx
cmp ecx, esi
je 0x425b20
nop word [eax + eax]
cmp byte [ecx + 0x3c], 0
mov edx, dword [ecx + 0x78]
jne 0x425b10
mov dword [edx + 0x34], ecx
xor eax, eax
jmp 0x425b14
movzx eax, word [edx + 0x38]
inc eax
add ecx, 0x7c
mov word [edx + 0x38], ax
cmp ecx, esi
jne 0x425b00
mov ecx, dword [ebx + 0x1c]
mov byte [ebx + 0x18], 0
test ecx, ecx
je 0x425b30
call fcn.004087f0
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x425b3c
call fcn.004087f0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov byte [ebx + 0x19], 0
mov eax, dword [edi - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4277e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
call fcn.004274e0
mov ecx, ebx
call fcn.00427610
xor eax, eax
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x48], eax
jle 0x4278ef
xor ecx, ecx
mov dword [esp + 0x14], ecx
nop
mov edi, dword [ebx + 0x50]
add edi, ecx
cmp dword [edi + 0x18], 0
je 0x4278da
cmp dword [edi + 8], 0
je 0x4278da
movzx eax, word [edi + 4]
sub esp, 0x20
movzx esi, word [edi]
movzx ecx, word [edi + 6]
movzx edx, word [edi + 2]
movss xmm0, dword [edi + 0xc]
movss xmm4, dword [edi + 0x14]
movss dword [esp + 0x1c], xmm0
movd xmm6, eax
add eax, esi
movd xmm3, ecx
cvtdq2ps xmm3, xmm3
movd xmm2, eax
lea eax, [edx + ecx]
mulss xmm3, dword [ebx + 0x30]
mov ecx, dword [edi + 0x18]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
mulss xmm1, dword [ebx + 0x30]
mulss xmm2, dword [ebx + 0x2c]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm6, xmm6
movss dword [esp + 0x18], xmm1
addss xmm0, xmm4
mulss xmm6, dword [ebx + 0x2c]
movss dword [esp + 0x14], xmm2
movss dword [esp + 0x10], xmm3
movss xmm3, dword [edi + 0x10]
movss dword [esp + 0xc], xmm6
movss dword [esp + 8], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [edi + 0x10]
movss dword [esp + 4], xmm0
movss dword [esp], xmm4
push dword [edi + 8]
push 0
call fcn.00428110
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ecx, 0x1c
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
cmp eax, dword [ebx + 0x48]
jl 0x427810
mov esi, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x427914
nop dword [eax]
mov ecx, dword [esi]
cmp byte [ecx + 0x48], 0
je 0x42790d
call fcn.00427ad0
add esi, 4
cmp esi, edi
jne 0x427900
pop edi
pop esi
mov byte [ebx + 0x18], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a390
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x44000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x44041c]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42a541
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42a541
push dword [0x440414]
push 0x38
call fcn.004049f0
mov esi, dword [0x44041c]
add esp, 8
mov edi, eax
test esi, esi
je 0x42a438
movsx edx, word [esi + 0x5ee4]
lea eax, [esi + 0x5ee8]
mov ecx, dword [esi + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ecx
je 0x42a42e
lea eax, [edx + 1]
mov dword [ebp - 0x1c], 6
cdq
idiv dword [ebp - 0x1c]
movzx eax, dx
mov word [esi + 0x5ee4], ax
cwde
add eax, 0xbdd
lea eax, [esi + eax*8]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
inc word [eax + 4]
inc dword [esi + 0x5edc]
test edi, edi
je 0x42a44b
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x42a44d
xor edi, edi
or dword [ebx + 0xc], 6
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x6c], str.imgui_impl_win32
mov ebx, dword [ebp - 0x24]
mov dword [edi], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x42a488
mov esi, dword [esi + 0x74]
jmp 0x42a48a
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42a4ad
mov dword [esi], eax
mov eax, dword [0x44041c]
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov eax, dword [eax + 0x4a34]
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x28], ebx
mov byte [edi + 0x29], 1
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x42a50f
inc esi
cmp esi, 5
jl 0x42a4e6
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435571
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435571
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435571
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40288e
pop dword [ebp - 0x30]
mov eax, 0x80728a57
add eax, 0x7fcd9e37
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xf9d2ac40
sub dword [ebp - 0x40], 0xab8066f5
mov dword [ebp - 0x3c], 0x45a5cd27
sub dword [ebp - 0x3c], 0x137280e2
mov dword [ebp - 0x38], 0xd9a1550a
add dword [ebp - 0x38], 0x72aaef24
mov dword [ebp - 0x34], 0x9d093006
add dword [ebp - 0x34], 0x62f6cffa
lea eax, [ebp - 0x40]
push eax
mov eax, 0xdac90c96
sub eax, 0xda888c0a
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x57275aef
add dword [ebp - 0x40], 0x1d4b0e67
mov dword [ebp - 0x3c], 0x655ddcb9
sub dword [ebp - 0x3c], 0x23f17b44
mov dword [ebp - 0x38], 0xa2e8841e
sub dword [ebp - 0x38], 0x3f7917b2
mov dword [ebp - 0x34], 0xb7d05988
add dword [ebp - 0x34], 0x482fa678
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x2d84782a
sub eax, 0x2d43f756
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3436a
push 0
call eax
mov ecx, 0x334d7ebe
add ecx, 0xccb2bfba
mov ebx, eax
mov edx, 0xf593e08c
add edx, 0xaad2f74
add edx, dword [ebp - 0x30]
mov edi, 0xe6e62dcb
add edi, 0x744e8c3b
add dword [ebp - 0x10], 0x7bdf17be
mov esi, dword [edx]
add dword [ebp - 0x28], eax
xor esi, edi
xor dword [ebp - 0x28], 0xb8a5dfbf
mov dword [ebx], esi
xor dword [ebp - 0x24], eax
add ebx, 0x8187ef5a
sub ebx, 0x8187ef56
add edx, 0x6d069ec8
add edx, 0x92f9613c
loop 0x4029b0
add eax, 0x71d5092e
sub eax, 0x71d41c7b
xor ebx, ebx
add ebx, eax
add eax, 0x5cca436f
add eax, 0xa335bc96
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10008e2d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10016688
push 0x10016680
push str.FlsAlloc
push 0x1e
call fcn.10008d4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008e61
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001511c]
call esi
jmp 0x10008e67
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10008eab
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10016698
push 0x10016690
push str.FlsGetValue
push 0x20
call fcn.10008d4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008ee2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001511c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000c59b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000c638
push ebx
push esi
call fcn.1000c564
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000c4ad
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000c5e5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000c637
push edi
push eax
call fcn.100095e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000c605
call fcn.10008bf8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000c636
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000c4ad
add esp, 0x20
test eax, eax
jne 0x1000c624
push edi
call fcn.10008bf8
jmp 0x1000c62c
push ebx
call fcn.10008bf8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100653f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x5f]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xfffe6493
xchg dword [esp], ecx
mov edi, edi
xchg dword [esp + 4], ecx
lea esi, [esi]
xchg dword [esp], ecx
push ebp
mov ebp, esp
leave
popfd
push ebp
mov ebp, esp
leave
jmp fcn.1006a194

Function at 0x1006a194
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0x1006a1ef
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
sub dword [ebp + 8], 1
mov byte [edi - 1], dl
jne 0x1006a1b4
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret

Function at 0x1006cfc3
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.10069d04
aas
leave
sub bl, ch
push 0xffffffffffffffbd
xor eax, 0x7c00
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x7d]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xfffe1600
xchg dword [esp], eax
push ebp
mov ebp, esp
leave
xchg dword [esp + 4], eax
lea edx, [edx]
xchg dword [esp], eax
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x76]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
popfd
push eax
mov eax, ebx
pop eax
jmp 0x1004e5a0

Function at 0x1007246b
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov ecx, ecx
add dword [esp], 0xffffa40f
xchg dword [esp], ecx
push ebp
mov ebp, esp
leave
xchg dword [esp + 4], ecx
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x69]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], ecx
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x16]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
popfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 4]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp 0x1006c86c
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via createthreadpoolwait

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
push 0x40
push 0x719
push 0x10003058
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0x10003058
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001068
mov esp, ebp
pop ebp
ret
Function at 0x40229a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.0040182c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004017e1
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.0040181c
sahf
xor edx, dword [edi - 0x27]
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.0040182c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004017e1
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0040182c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004017e1
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0040181c
std
insb byte es:[edi], dx
invalid
Function at 0xcb12b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0xcb50a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.00cb11ad
test eax, eax
jne 0xcb1323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xcb1340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0xcb1323
cmp dword [ebp - 0x10], 4
jne 0xcb1323
cmp dword [ebp - 8], 1
jne 0xcb1323
cmp dword [esi + 0xc], ebx
je 0xcb136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0xcb133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0xcb1323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0xcb1323