joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x47e273
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x47e25a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b325e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00485510
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x8b4f44
call fcn.004a40f8
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x484c83
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a40f8
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x484c7c
push 0
mov ecx, eax
call fcn.0047bd20
mov dword [esi + 0xc], eax
jmp 0x484c85
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x484c85
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4a6785
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a67bd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a4812
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a47ea
jmp 0x4a67c9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a7e7a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a7ebc
call fcn.004ada2a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a7ebc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a7eb3
xor eax, eax
jmp 0x4a7ec4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a7eca
pop edi
pop esi
pop ebx
ret 4
Function at 0x4adf5a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4adf88
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4adfa6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004adec0
jmp 0x4adfa6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4adfa6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004adec0
test edi, edi
mov eax, edi
jne 0x4adf90
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002aaee
pop dword [ebp - 0xc]
mov eax, 0x5f9b078f
add eax, 0xb067a35f
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xf081d5f
sub dword [ebp - 0x1c], 0xc0b5d814
mov dword [ebp - 0x18], 0xeac1711c
sub dword [ebp - 0x18], 0xb88e24d7
mov dword [ebp - 0x14], 0x85253148
add dword [ebp - 0x14], 0xc72712e6
mov dword [ebp - 0x10], 0x5e627154
add dword [ebp - 0x10], 0xa19d8eac
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xda6aba69
sub dword [ebp - 0x1c], 0x65f85113
mov dword [ebp - 0x18], 0xb066a289
add dword [ebp - 0x18], 0x9105beec
mov dword [ebp - 0x14], 0x82234441
sub dword [ebp - 0x14], 0x1eb3d7d5
mov dword [ebp - 0x10], 0x49e63bee
sub dword [ebp - 0x10], 0x49e63bee
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x4f54d1fc
add eax, 0xc0adee2c
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x323b4
push 0
call eax
mov ecx, 0x370e
mov esi, eax
mov edi, 0x7866ed4a
add edi, 0x979ca8b6
add edi, dword [ebp - 0xc]
mov edx, 0x47ed8090
xor dword [ebp - 4], edx
mov ebx, dword [edi]
xor dword [ebp - 4], ebx
add ebx, edx
sub dword [ebp - 8], eax
mov dword [esi], ebx
sub dword [ebp - 8], 0x429e7678
add esi, 4
add edi, 4
loop 0x1002abff
add eax, 0x8f2e083c
add eax, 0x70d2c6cf
mov ebx, eax
add eax, 0xc3a41a0d
add eax, 0x3c5be5f8
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1002d570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002d57f
pop dword [ebp - 0x34]
mov eax, 0x1002d57f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xab40887d
add dword [ebp - 0x44], 0xa311bcce
mov dword [ebp - 0x40], 0x391f12bb
sub dword [ebp - 0x40], 0x6ebc676
mov dword [ebp - 0x3c], 0xb31a46f8
sub dword [ebp - 0x3c], 0x66ce02ca
mov dword [ebp - 0x38], 0xb26b7aee
add dword [ebp - 0x38], 0x4d948512
lea eax, [ebp - 0x44]
push eax
mov eax, 0x958770ea
add eax, 0x7a7cffde
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x3c79e600
add dword [ebp - 0x44], 0x37f88356
mov dword [ebp - 0x40], 0xd7bb64b3
add dword [ebp - 0x40], 0x69b0fcc2
mov dword [ebp - 0x3c], 0x5d46fbf9
sub dword [ebp - 0x3c], 0xf9d78f8d
mov dword [ebp - 0x38], 0x8d96f0e0
sub dword [ebp - 0x38], 0x8d96f0e0
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x42ed4
push 0
call eax
mov ecx, 0x498e
xor edx, edx
add edx, eax
mov ebx, 0xd2d0585f
sub ebx, 0xc2ca285f
add ebx, dword [ebp - 0x34]
mov edi, 0x96497174
mov dword [ebp - 0xc], 0x783a8ab5
mov esi, dword [ebx]
sub dword [ebp - 0x10], 0xd856ec7
add esi, edi
add dword [ebp - 0x1c], ecx
mov dword [edx], esi
xor dword [ebp - 0x28], ecx
add edx, 0x8c151837
sub edx, 0x8c151833
add ebx, 0x59720a28
add ebx, 0xa68df5dc
loop 0x1002d68d
add eax, 0x1190b
xor ebx, ebx
add ebx, eax
add eax, 0x4c294555
sub eax, 0x4c294550
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40ccc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x44c300]
cmp ax, 0xcb
je 0x40cdbf
cmp ax, 0xcc
je 0x40cdbf
mov edx, dword [0x455640]
test edx, edx
je 0x40ccf2
mov eax, dword [0x4554f0]
call edx
mov ebx, eax
jmp 0x40ccf7
mov ebx, 0x4554f4
cmp word [0x4554e0], 0
jle 0x40cd1a
mov eax, 0x4554c0
call fcn.0040cfe0
mov eax, ebx
call fcn.0040c890
mov eax, ebx
call fcn.0040c910
mov esi, dword [ebx]
jmp 0x40cd3d
mov edi, dword [esi + 4]
test byte [esi], 1
jne 0x40cd38
mov edx, esi
mov eax, ebx
call fcn.0040bd30
jmp 0x40cd3b
and dword [esi], 0xfffffffe
mov esi, edi
test esi, esi
jne 0x40cd20
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x4554e0], 0
jle 0x40cdbf
mov edx, 0x455400
mov eax, ebx
call fcn.0040be80
mov esi, eax
test eax, eax
je 0x40cd92
mov eax, dword [0x455494]
mov dword [esi + 0xc], eax
cmp dword [0x455494], 0
je 0x40cd87
mov eax, dword [0x455494]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x94]
mov dword [0x455494], eax
sub word [0x4554e0], 1
cmp word [0x4554e0], 0
sete bl
mov eax, 0x4554c0
call fcn.0040cff0
test bl, bl
je 0x40cdbf
mov eax, 0x4554c0
call fcn.0040cfd0
pop edi
pop esi
pop ebx
ret

Function at 0x40ee60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x21c]
push ebx
push esi
push edi
mov dword [ebp - 0x210], 0
xor eax, eax
push fcn.0040ee50
push ebp
push 0x410030
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x210]
xor dx, dx
mov eax, dword [ebp - 0x218]
call fcn.00408340
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x40eeb6
mov eax, dword [eax - 4]
add eax, 1
mov dword [ebp - 0x214], eax
call fcn.0040c680
mov dword [0x44c370], eax
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x40eed8
mov eax, 0x4552d0
mov edx, dword [0x44c370]
invalid
invalid

Function at 0x424664
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
and eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
imul eax, eax, 0xa
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x3c
jle 0x424678
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword fs:[eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
leave
ret
Function at 0x426580
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
dec ecx
test ecx, ecx
jl 0x42659c
or esi, 0xffffffff
inc esi
lea edi, [edx + esi]
lea ebp, [eax + esi]
mov bl, byte [edi]
xor byte [ebp], bl
cmp esi, ecx
jl 0x42658c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402e82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402e91
pop dword [ebp - 0x38]
mov eax, 0x5796f3bd
add eax, 0xa8a93ad4
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd9b03590
sub dword [ebp - 0x48], 0x8b5df045
mov dword [ebp - 0x44], 0xcecd932e
sub dword [ebp - 0x44], 0x9c9a46e9
mov dword [ebp - 0x40], 0x1e261afa
add dword [ebp - 0x40], 0x2e262934
mov dword [ebp - 0x3c], 0xfd42292f
sub dword [ebp - 0x3c], 0xfd42292f
lea eax, [ebp - 0x48]
push eax
mov eax, 0x413eb165
sub eax, 0x40fe3061
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x84746c3f
add dword [ebp - 0x48], 0xeffdfd17
mov dword [ebp - 0x44], 0xf2a9df3f
sub dword [ebp - 0x44], 0xb13d7dca
mov dword [ebp - 0x40], 0x13051c70
add dword [ebp - 0x40], 0x506a4ffc
mov dword [ebp - 0x3c], 0x10745351
sub dword [ebp - 0x3c], 0x10745351
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x992dc2a6
sub eax, 0x98ed41a6
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x35192
push 0
call eax
mov ecx, 0xb17b9f41
sub ecx, 0xb17b5ed7
xor edx, edx
add edx, eax
mov edi, 0x450400
add edi, dword [ebp - 0x38]
mov esi, 0xac51be24
sub esi, 0x1d8df31e
mov ebx, dword [edi]
sub dword [ebp - 0x34], 0xc6f16994
xor ebx, esi
mov dword [edx], ebx
sub dword [ebp - 0x18], edi
add edx, 0x3db3da6a
add edx, 0xc24c259a
add edi, 0xde05c511
add edi, 0x21fa3af3
loop 0x402faf
add eax, 0x36308916
add eax, 0xc9d06b65
xor ebx, ebx
add ebx, eax
add eax, 0x5bc8e42e
sub eax, 0x5bc8e429
mov ecx, 0x77229331
sub ecx, 0x76e29331
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x405310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x405351
xor al, al
jmp 0x4053e3
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40536c
xor al, al
jmp 0x4053e3
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4053d6
cmp dword [ebp + 0x10], 0
jne 0x40539e
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov byte [ebp - 8], 1
jmp 0x4053cd
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x14]
cmp dword [edx], eax
jl 0x4053cd
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov byte [ebp - 8], 1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004054c0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x41481f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414877
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x4191ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41486a
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x414879
xor eax, eax
pop esi
leave
ret 4
Function at 0x10020b8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10020b99
pop dword [ebp - 0x30]
mov eax, 0x10020b99
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xc73afa47
add dword [ebp - 0x40], 0x87174b04
mov dword [ebp - 0x3c], 0xe6707219
sub dword [ebp - 0x3c], 0xb43d25d4
mov dword [ebp - 0x38], 0x1fcc27bd
add dword [ebp - 0x38], 0x2c801c71
mov dword [ebp - 0x34], 0x2c97541c
add dword [ebp - 0x34], 0xd368abe4
lea eax, [ebp - 0x40]
push eax
mov eax, 0x6f6ba0cb
sub eax, 0x5f692f3f
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x9ae810e6
sub dword [ebp - 0x40], 0x2675a790
mov dword [ebp - 0x3c], 0xefcd0099
add dword [ebp - 0x3c], 0x519f60dc
mov dword [ebp - 0x38], 0x7e7f82e9
add dword [ebp - 0x38], 0xe4efe983
mov dword [ebp - 0x34], 0xe471cc31
sub dword [ebp - 0x34], 0xe471cc31
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xe474dc31
sub eax, 0xd4726ab1
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4012e
push 0
call eax
mov ecx, 0xe3f3139f
add ecx, 0x1c0d3241
xor edi, edi
add edi, eax
mov esi, 0x10039800
add esi, dword [ebp - 0x30]
mov ebx, 0xf00385ca
sub ebx, 0x172572df
add dword [ebp - 0x10], edi
mov edx, dword [esi]
xor dword [ebp - 0x20], eax
xor edx, ebx
add dword [ebp - 0x10], 0x5727cf5f
mov dword [edi], edx
add edi, 0x1a683f30
sub edi, 0x1a683f2c
add esi, 0x35234305
add esi, 0xcadcbcff
loop 0x10020cb2
add eax, 0x4a29abff
add eax, 0xb5d75e54
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x28925637
add ecx, 0xe76da9c9
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x10021388
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100327bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100331a8], 0
jne 0x10021493
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 4
jbe 0x1002147d
cmp dword [ebp - 0x94], 5
je 0x1002143c
cmp dword [ebp - 0x94], 6
jne 0x10021489
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021430
dec eax
je 0x10021424
dec eax
je 0x10021418
dec eax
jne 0x10021489
mov dword [0x100331a8], 0x6b
jmp 0x10021493
mov dword [0x100331a8], 0x6a
jmp 0x10021493
mov dword [0x100331a8], 0x69
jmp 0x10021493
mov dword [0x100331a8], 0x68
jmp 0x10021493
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021471
dec eax
je 0x10021465
dec eax
je 0x10021459
mov dword [0x100331a8], 0x67
jmp 0x10021493
mov dword [0x100331a8], 0x66
jmp 0x10021493
mov dword [0x100331a8], 0x65
jmp 0x10021493
mov dword [0x100331a8], 0x64
jmp 0x10021493
mov dword [0x100331a8], 1
jmp 0x10021493
mov dword [0x100331a8], 0x6c
mov ecx, dword [ebp - 4]
mov eax, dword [0x100331a8]
xor ecx, ebp
call fcn.1002336a
leave
ret

Function at 0x1002336a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100327bc]
jne 0x10023374
repz ret
jmp fcn.10023b89
Function at 0x29a02312
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x29a02321
pop dword [ebp - 0x28]
mov eax, 0x29a02321
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x6e926e4b
sub dword [ebp - 0x38], 0x20402900
mov dword [ebp - 0x34], 0xd5b2537c
sub dword [ebp - 0x34], 0xa37f0737
mov dword [ebp - 0x30], 0x608dd68c
sub dword [ebp - 0x30], 0x1441925e
mov dword [ebp - 0x2c], 0x143aa9b7
sub dword [ebp - 0x2c], 0x143aa9b7
lea eax, [ebp - 0x38]
push eax
mov eax, 0xf4b472fa
add eax, 0x34eccd92
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x509f2eaf
add dword [ebp - 0x38], 0x23d33aa7
mov dword [ebp - 0x34], 0x4e1e778a
sub dword [ebp - 0x34], 0xcb21615
mov dword [ebp - 0x30], 0x5ee6e1d0
sub dword [ebp - 0x30], 0xfb777564
mov dword [ebp - 0x2c], 0xa668c599
add dword [ebp - 0x2c], 0x59973a67
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x7e939fba
sub eax, 0x54f25f76
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5a2
push 0
call eax
mov ecx, 0x20874fe4
add ecx, 0xdf78f7ee
mov esi, eax
mov edi, 0x29a22000
add edi, dword [ebp - 0x28]
mov ebx, 0x6d60fac
add ebx, 0x8eec5606
sub dword [ebp - 0xc], 0x11b49297
mov edx, dword [edi]
sub dword [ebp - 0x24], 0x12329f40
sub edx, ebx
xor dword [ebp - 0xc], 0x26ef8cf1
mov dword [esi], edx
xor dword [ebp - 0xc], 0xce6d722b
add esi, 0x9e800481
add esi, 0x617ffb83
add edi, 4
loop 0x29a02438
add eax, 0x68a2c471
sub eax, 0x68a1b256
mov ebx, eax
add eax, 5
mov ecx, 0x21818d44
sub ecx, 0xf7e18d44
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10005936
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10005945
pop dword [ebp - 0x3c]
mov eax, 0xb75942c4
add eax, 0x58a71681
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xa742442a
add dword [ebp - 0x4c], 0xa7100121
mov dword [ebp - 0x48], 0x6a9cc8ae
sub dword [ebp - 0x48], 0x38697c69
mov dword [ebp - 0x44], 0x27adb229
add dword [ebp - 0x44], 0x249e9205
mov dword [ebp - 0x40], 0xe38961a6
add dword [ebp - 0x40], 0x1c769e5a
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x1def67c5
sub eax, 0xded67c1
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbaa8f11c
sub dword [ebp - 0x4c], 0x463687c6
mov dword [ebp - 0x48], 0x410cd2b1
sub dword [ebp - 0x48], 0xffa0713c
mov dword [ebp - 0x44], 0xac95c8c3
sub dword [ebp - 0x44], 0x49265c57
mov dword [ebp - 0x40], 0x394a29e7
add dword [ebp - 0x40], 0xc6b5d619
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xb715bee8
add eax, 0x58ec4118
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c795
push 0
call eax
mov ecx, 0x6779b533
add ecx, 0x98869264
mov esi, eax
mov edi, 0x234be584
sub edi, 0x13492984
add edi, dword [ebp - 0x3c]
mov edx, 0xc5512062
sub edx, 0x4ef25665
sub dword [ebp - 0x2c], ecx
mov ebx, dword [edi]
add dword [ebp - 0x18], esi
add ebx, edx
xor dword [ebp - 0x18], ebx
mov dword [esi], ebx
sub dword [ebp - 0x2c], eax
add esi, 0xf217c896
add esi, 0xde8376e
add edi, 4
loop 0x10005a67
add eax, 0x1112f
xor ebx, ebx
add ebx, eax
add eax, 0x8acf5df6
add eax, 0x7530a20f
mov ecx, 0xf6a23e5d
add ecx, 0x195dc1a3
add ecx, dword [ebp - 0x3c]
call ebx
leave
jb 0x10005ac0
invalid

Function at 0x702744
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
mov dword [ebp - 0xc], eax
js 0x90cea3
jmp 0x6b2275
push ebx
push edi
cmc
mov dword [ebp - 0x10], eax
test ebp, 0x39cd6e98
cmc
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x665ee2
jne 0x90dcf9
mov edx, dword [eax + ecx + 0x78]
test cl, 0xf3
stc
mov dword [ebp - 4], edx
test edx, edx
je 0x90dcf9
mov eax, dword [eax + ecx + 0x7c]
jmp 0x5f0a39
ja 0x92f832
mov eax, esi
cmp esi, 0x650531bb
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0x9332fc
push ebp
mov ebp, esp
bsr ecx, ecx
btc ecx, esi
mov ecx, dword [ebp + 8]
cmp esp, 0x735251f7
lea esp, [esp - 0x114]
cmp sp, bp
cmp dh, 0x3d
push esi
test dl, al
test dx, 0x66c3
test ecx, ecx
jmp 0x8a5298
je 0x90dcf9
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x90dce0
ret
je 0x90cea3
mov eax, dword [edx + ecx + 0x20]
cmp si, 0x49c6
lea eax, [eax + ecx]
xor ebx, ebx
jmp 0x5d7c5c
je 0x90dcf9
mov eax, 0x5a4d
test cx, 0x863
cmp word [ecx], ax
je 0x937ab7
xor eax, eax
mov si, 0x4b62
mov si, cx
cmova esi, edi
pop esi
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x8b193b
mov edi, dword [edx + ecx + 0x18]
cmp edi, 0x16f063bd
test edi, edi
jmp 0x8e6ef4
jmp 0x90cea3
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x5f6bed
Function at 0x402420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x411b93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00401000
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.004010a0
lea ecx, [esp + 0xc]
call fcn.00410ff8
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push str.delete_from_Czyxxb_where_CzyName_s
push ecx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00402540
push ecx
mov edi, eax
mov dword [esp + 0x14], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x2c], 3
je 0x4024d4
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x4024d6
test edi, edi
je 0x4024d6
push 0x8007000e
call fcn.0041171f
jmp 0x4024d6
xor esi, esi
test esi, esi
mov byte [esp + 0x2c], 2
mov dword [ebp], esi
jne 0x4024ec
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x18]
call fcn.004017a0
lea ecx, [esp + 0x14]
call fcn.00401960
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00401040
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 4