joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008000
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0xffffffff
je 0x1000801f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0xffffffff
jne 0x10008051
xor eax, eax
jmp 0x100080d4
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.1001c43f
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 0
jne 0x100080a2
mov ecx, dword [ebp - 4]
call fcn.10007b80
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.10007bb0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.100080e0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x10008c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, word [ebp + 0xc]
push eax
call fcn.1000a1e0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10008c91
xor al, al
jmp 0x10008d49
movzx edx, byte [0x10057a2b]
cmp edx, 1
jne 0x10008ca4
xor al, al
jmp 0x10008d49
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
imul eax, dword [ebp + 0xc], 0x30
mov ecx, dword [ebp - 4]
sub ecx, dword [eax + 0x1004b71c]
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x201
jne 0x10008ce0
imul edx, dword [ebp + 0xc], 0x30
movzx eax, byte [edx + 0x1004b720]
test eax, eax
jne 0x10008ce0
imul ecx, dword [ebp + 0xc], 0x30
mov byte [ecx + 0x1004b720], 1
cmp dword [ebp + 8], 0x202
jne 0x10008d08
imul edx, dword [ebp + 0xc], 0x30
movzx eax, byte [edx + 0x1004b720]
cmp eax, 1
jne 0x10008d08
imul ecx, dword [ebp + 0xc], 0x30
mov byte [ecx + 0x1004b720], 0
mov al, 1
jmp 0x10008d49
cmp dword [ebp - 8], 0x1f4
jae 0x10008d15
xor al, al
jmp 0x10008d49
imul edx, dword [ebp + 0xc], 0x30
mov byte [edx + 0x1004b720], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ecx, dword [ebp + 0xc], 0x30
mov dword [ecx + 0x1004b71c], eax
imul edx, dword [ebp + 0xc], 0x30
add edx, 0x1004b723
mov dword [0x10057a38], edx
mov byte [0x10057a2b], 1
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1000bd20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.cHwid.0
xor ecx, ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov dword [edx + 0x20], ecx
mov ecx, dword [ebp - 4]
call fcn.1000bde0
movzx eax, al
test eax, eax
jne 0x1000bd7d
push 0
push 0x10031ba8
push str.Failed_getting_HWID
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1000bde0
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1003f340]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
push 0x1003f198
mov ecx, dword [ebp - 0x18]
call fcn.1000bee0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x1000be24
xor al, al
jmp 0x1000beca
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
xor eax, 0x12b586fe
mov dword [ebp - 0x2c], eax
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp + ecx - 0xc]
xor edx, 0x5d78a569
mov dword [ebp - 0x28], edx
mov eax, 1
imul ecx, eax, 6
movzx edx, word [ebp + ecx - 0xc]
and edx, 0xffff
movzx eax, word [ebp - 0x50]
shl eax, 0x10
or edx, eax
xor edx, 0xf45bc123
mov dword [ebp - 0x24], edx
movzx ecx, word [ebp - 0x30]
and ecx, 0xffff
movzx edx, word [ebp - 0x2e]
shl edx, 0x10
or ecx, edx
xor ecx, 0xb542d8e1
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0x14
push 0x1003f19c
mov ecx, dword [ebp - 0x18]
call fcn.1000bee0
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100162c0
mov esp, ebp
pop ebp
ret
Function at 0x10011d30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x10032130
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x102190e4], eax
mov eax, 1
imul ecx, eax, 0
movzx edx, byte [ecx + 0x10219110]
test edx, edx
jne 0x10011d75
mov eax, dword [0x102190e4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
mov ecx, dword [0x102190e4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10011db6
mov edx, dword [0x102190e4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x102190e4]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [0x102190e4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push 1
mov edx, dword [0x102190e4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x102190e4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop ebp
ret
Function at 0x10013340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1003f340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102190c0]
add eax, 1
mov dword [0x102190c0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x102190bc]
cmp eax, 0x3e8
jb 0x100133ad
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x102190bc]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, eax
mov eax, dword [0x102190c0]
xor edx, edx
div ecx
mov dword [0x102190b8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102190bc], eax
mov dword [0x102190c0], 0
xorps xmm0, xmm0
movss dword [ebp - 0x118], xmm0
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.100177c0
add esp, 0xc
movzx edx, word [ebp - 0x108]
push edx
movzx eax, word [ebp - 0x10a]
push eax
movzx ecx, word [ebp - 0x10c]
push ecx
movzx edx, word [ebp - 0x114]
push edx
movzx eax, word [ebp - 0x112]
push eax
movzx ecx, word [ebp - 0x10e]
push ecx
mov edx, dword [0x102190b8]
push edx
push str.UnicMU___www.unicmu.net__FPS:__d___02d:_02d:_02d___02d:_02d:_02d__ROTA:_SP1___V1.03_
lea eax, [ebp - 0x104]
push eax
call fcn.100120e0
add esp, 0x24
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [0x575052c]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100162c0
mov esp, ebp
pop ebp
ret

Function at 0x10013a20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100177c0
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10013a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 8]
push eax
push 0x10032234
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10013ac9
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10013abf
mov eax, dword [ebp - 4]
jmp 0x10013acb
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10013ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
movzx eax, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10013b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, byte [ebp + 8]
cmp edx, 0xff
je 0x10013b3c
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 8]
mov byte [eax], cl
lea edx, [ebp + 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
add eax, 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 1], edx
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10013b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10013cb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10013cf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10013d39
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10017920
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10013d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10013d39
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10016720
Capabilities:
Terminate process

Disassembly:
cmp dword [0x10219878], 6
jl 0x1001673f
vbroadcastss xmm0, xmm0
vcvttps2qq xmm0, xmm0
vmovd eax, xmm0
vpextrd edx, xmm0, 1
ret
movd eax, xmm0
cdq
shl eax, 1
cmp eax, 0x9e000000
jae 0x10016753
cvttss2si eax, xmm0
cdq
ret
cmp eax, 0xbe000000
jae 0x10016773
mov ecx, eax
bts eax, 0x18
shr ecx, 0x18
shl eax, 7
sub cl, 0xbe
xor eax, edx
sub eax, edx
shld edx, eax, cl
shl eax, cl
ret
jne 0x10016779
test edx, edx
js 0x10016781
cvttss2si ecx, dword [0x10034168]
mov edx, 0x80000000
xor eax, eax
ret

Function at 0x10022c66
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10022ca5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022ca5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022ca5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10022ca5
cmp dword [ecx + 0x74], 0xe
jbe 0x10022ca5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10024b1f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036f58
push 0x10036f50
push str.FlsAlloc
push 0x1f
call fcn.100249de
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10024b53
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003121c]
call esi
jmp 0x10024b59
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10024b9d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036f68
push 0x10036f60
push str.FlsGetValue
push 0x21
call fcn.100249de
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10024bd4
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003121c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10024bdc
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036f70
push 0x10036f68
push str.FlsSetValue
push 0x22
call fcn.100249de
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10024c16
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003121c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1002a27f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002a31c
push ebx
push esi
call fcn.1002a248
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10026e08
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002a2c9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002a31b
push edi
push eax
call fcn.10024eb7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002a2e9
call fcn.10024e7d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002a31a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10026e08
add esp, 0x20
test eax, eax
jne 0x1002a308
push edi
call fcn.10024e7d
jmp 0x1002a310
push ebx
call fcn.10024e7d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002a31f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1002a330
pop esi
ret
push ebx
push edi
push esi
call fcn.1002a248
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10024eb7
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1002a358
push ebx
push esi
push edi
call fcn.10017920
add esp, 0xc
push 0
call fcn.10024e7d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1002a728
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a36d

Function at 0x1002ff60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002ff8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002ff8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10007c2e
pop dword [ebp - 0x18]
mov eax, 0x10007c2e
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe01db89
add dword [ebp - 0x28], 0x405069c2
mov dword [ebp - 0x24], 0xd20bb9ef
sub dword [ebp - 0x24], 0x9fd86daa
mov dword [ebp - 0x20], 0x5a635013
sub dword [ebp - 0x20], 0xe170be5
mov dword [ebp - 0x1c], 0x979b1375
add dword [ebp - 0x1c], 0x6864ec8b
lea eax, [ebp - 0x28]
push eax
mov eax, 0x5f3653e4
add eax, 0xb0ca2c70
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x7eaf57a6
sub dword [ebp - 0x28], 0xa3cee50
mov dword [ebp - 0x24], 0xba22b54b
sub dword [ebp - 0x24], 0x78b653d6
mov dword [ebp - 0x20], 0x1091f1d3
add dword [ebp - 0x20], 0x52dd7a99
mov dword [ebp - 0x1c], 0xaca0c0f8
sub dword [ebp - 0x1c], 0xaca0c0f8
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x34ade
push 0
call eax
mov ecx, 0x400c
xor edx, edx
add edx, eax
mov ebx, 0x1000fa00
add ebx, dword [ebp - 0x18]
mov edi, 0x12a89160
add edi, 0x67293c3c
sub dword [ebp - 0x14], edi
mov esi, dword [ebx]
xor dword [ebp - 0xc], eax
sub esi, edi
sub dword [ebp - 0x10], ecx
mov dword [edx], esi
mov dword [ebp - 4], 0xc95f68c2
add edx, 0xb6e8266b
sub edx, 0xb6e82667
add ebx, 0x92096aa9
add ebx, 0x6df6955b
loop 0x10007d3c
add eax, 0x108b9943
add eax, 0xef7559c0
mov ebx, eax
add eax, 0x452a1f59
sub eax, 0x452a1f54
mov ecx, 0x32af35a4
sub ecx, 0x22af35a4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x6d47090a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x649f0f05
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2cde0c95
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3f927b81
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x43cda1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43cdcf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43cded
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043cd0b
jmp 0x43cded
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43cded
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043cd0b
test edi, edi
mov eax, edi
jne 0x43cdd7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x566af4]
test ecx, ecx
je 0x43cea0
jmp 0x43cda0
ret 8

Function at 0x9e8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9e81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9e807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e806a
add dl, dl
jne 0x9e8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e80dc
xor eax, eax
add dl, dl
jne 0x9e8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e817d
add dl, dl
jne 0x9e80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9e80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9e8075
mov eax, 1
add dl, dl
jne 0x9e80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e80e1
sub eax, ebx
mov ebx, 1
jne 0x9e8128
mov ecx, 1
add dl, dl
jne 0x9e810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9e8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9e813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9e814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e8136
cmp eax, 0x7d00
jae 0x9e816d
cmp eax, 0x500
jb 0x9e8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e8075
cmp eax, 0x7f
ja 0x9e8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9e819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9e8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10