joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0090
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404f2c
xor eax, eax
push ebp
push 0x4b01ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b0181
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f3c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b015e
test byte [ebp - 0x14c], 0x10
jne 0x4b0141
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404ce8
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00409068
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4b0104
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x4b016a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0188
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4b4d84
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
movzx eax, byte [ebx + 4]
sub al, 1
jb 0x4b4d93
je 0x4b4d98
jmp 0x4b4dbc
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x4b4db7
lea eax, [ebx + 8]
push eax
movzx eax, byte [ebx + 0xc]
push eax
mov eax, dword [0x4f18bc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x4d6c98
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d6cc6
mov eax, ebx
call fcn.004d774c
cmp dword [ebx + 0x40], 0
je 0x4d6cbf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d6d37
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d6d29
cmp dword [ebx + 8], 0
je 0x4d6ce8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d6cfa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d6d29
cmp dword [ebx + 8], 0
je 0x4d6cdb
cmp eax, 3
je 0x4d6d0d
dec eax
jne 0x4d6cdb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d6cdb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d6cdb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d6d55
cmp dword [ebx + 0x14], 0xcc
je 0x4d6d55
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d6d60
pop ebx
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x124ab50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x124ab5a
pushal
call 0x124ab60
pop ebp
sub ebp, 0x10
sub ebp, 0xe4ab50
jmp 0x124ab76
mov eax, 0xe4ab50
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d5
mov edx, 0x998a5808
xor byte [eax], dl
inc eax
dec ecx
jne 0x124ab8d
jmp 0x124aba0
add ebp, 0xffffff83
xor dword [eax + ecx], 0xc9890808
lock or byte [eax], cl
or byte [ebx], cl
lds esi, [eax + 0x808080c]
mov dl, 0x20
or byte [eax], cl
or bh, bh
ljmp 0x804
Function at 0x10851058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x108511a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1085107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1085106a
add dl, dl
jne 0x10851089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108510dc
xor eax, eax
add dl, dl
jne 0x10851096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1085117d
add dl, dl
jne 0x108510a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108510b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108510bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108510c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108510d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10851075
mov eax, 1
add dl, dl
jne 0x108510ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108510f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108510e1
sub eax, ebx
mov ebx, 1
jne 0x10851128
mov ecx, 1
add dl, dl
jne 0x1085110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10851119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10851105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10851075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1085113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1085114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10851136
cmp eax, 0x7d00
jae 0x1085116d
cmp eax, 0x500
jb 0x10851168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10851075
cmp eax, 0x7f
ja 0x10851170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10851075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1085119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10851075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x6575c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00658300
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00658300
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x657620
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x65c070]
test esi, esi
jle 0x657740
mov eax, dword [0x65c074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x657654
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6576d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x657640
mov dword [esp], ebx
call fcn.00658010
mov edi, eax
test eax, eax
je 0x657767
mov eax, dword [0x65c074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00658150
mov edx, dword [0x65c074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x657747
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6576d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6576e0
add dword [0x65c070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x65c074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6576d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.006575c0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x65765e
mov eax, dword [0x65c074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.006575c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.006575c0
lea esi, [esi]
nop
Function at 0x657c80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x65c08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x65c084]
sub esp, 4
test ebx, ebx
je 0x657cd5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x657cce
test esi, esi
je 0x657cce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x657cb0
mov dword [esp], 0x65c08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x658010
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x658035
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x658040
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x658035
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x658088
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x65807e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x65808a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x658070
xor eax, eax
pop ebx
pop esi
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x40645c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406480
xor eax, eax
test eax, eax
je 0x406492
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406492
xor ecx, ecx
jmp 0x406495
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406581
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232bc], 0
push esi
jne 0x4065b8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406592
mov dword [ecx*4 + 0x4232b8], eax
inc ecx
cmp ecx, 0x100
jl 0x40658d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065e9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232b8]
xor eax, esi
inc ecx
dec edx
jne 0x4065cb
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2e5e33b8
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x17e8543b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1e007f8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + edx*8 + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
jmp 0x1e007fe4
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x1e00802c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.1e007f1c
add esp, 8
cmp eax, dword [ebp + 0x10]
jne 0x1e00802a
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x1e00802e
jmp 0x1e007fdb
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1e00803c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 0xc
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x1e0080b3
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x30]
push eax
call fcn.1e007acc
add esp, 4
cmp dword [ebp + 8], eax
jne 0x1e0080a9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x18]
jmp 0x1e0080b5
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x1e00807f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1e009700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x2814]
mov ecx, dword [ebx + 0x10]
push esi
push edi
push eax
push ecx
lea edi, [ebx + 0x14]
push 1
push edi
call dword [sym.imp.MSVCR90.dll_fwrite]
mov esi, eax
mov eax, dword [ebx + 0x10]
add esp, 0x10
cmp esi, eax
jne 0x1e009758
mov dword [ebx + 0x10], 0
test esi, esi
jbe 0x1e00974f
mov edx, dword [ebx + 0x2814]
push edx
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 4
test eax, eax
jne 0x1e009771
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, esi
push eax
lea edx, [esi + ebx + 0x14]
push edx
push edi
call dword [sym.imp.MSVCR90.dll_memmove]
sub dword [ebx + 0x10], esi
add esp, 0xc
test esi, esi
jne 0x1e009739
mov eax, dword [ebx + 0xc]
push eax
call sym.python27.dll_PyString_AsString
mov ecx, dword [sym.python27.dll_PyExc_IOError]
add esp, 4
push eax
push ecx
call sym.python27.dll_PyErr_SetFromErrnoWithFilename
add esp, 8
call fcn.1e009f90
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1e0113e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c8], 0x270
jl 0x1e01149e
xor edx, edx
push esi
mov eax, dword [ecx + edx*4 + 0xc]
xor eax, dword [ecx + edx*4 + 8]
inc edx
and eax, 0x7fffffff
xor eax, dword [ecx + edx*4 + 4]
mov esi, eax
shr eax, 1
and esi, 1
xor eax, dword [esi*4 + 0x1e26a9d8]
xor eax, dword [ecx + edx*4 + 0x638]
cmp edx, 0xe3
mov dword [ecx + edx*4 + 4], eax
jl 0x1e0113f3
cmp edx, 0x26f
jge 0x1e011463
mov edi, edi
mov eax, dword [ecx + edx*4 + 0xc]
xor eax, dword [ecx + edx*4 + 8]
inc edx
and eax, 0x7fffffff
xor eax, dword [ecx + edx*4 + 4]
mov esi, eax
shr eax, 1
and esi, 1
xor eax, dword [esi*4 + 0x1e26a9d8]
xor eax, dword [ecx + edx*4 - 0x388]
cmp edx, 0x26f
mov dword [ecx + edx*4 + 4], eax
jl 0x1e011430
mov eax, dword [ecx + 0x9c4]
xor eax, dword [ecx + 8]
pop esi
and eax, 0x7fffffff
xor eax, dword [ecx + 0x9c4]
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x1e26a9d8]
xor edx, dword [ecx + 0x638]
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9c4], edx
mov dword [ecx + 0x9c8], 0
mov eax, dword [ecx + 0x9c8]
mov edx, dword [ecx + eax*4 + 8]
inc eax
mov dword [ecx + 0x9c8], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x1e011570
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea ecx, [esi + 8]
mov dword [ecx], eax
mov eax, 1
push edi
jmp 0x1e011580
mov edx, dword [ecx]
mov edi, edx
shr edi, 0x1e
xor edi, edx
imul edi, edi, 0x6c078965
add edi, eax
mov dword [ecx + 4], edi
inc eax
add ecx, 4
cmp eax, 0x270
jl 0x1e011580
mov dword [esi + 0x9c8], eax
pop edi
ret
Function at 0x1e041a20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [sym.python27.dll_Py_IgnoreEnvironmentFlag], 0
push ebx
push esi
push edi
jne 0x1e041abf
push str.PYTHONSTARTUP
call dword [sym.imp.MSVCR90.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x1e041abf
cmp byte [esi], 0
je 0x1e041abf
push 0x1e1f4d0c
push esi
call dword [sym.imp.MSVCR90.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x1e041a88
mov eax, dword [ebp + 8]
push eax
push 0
push esi
push edi
call sym.python27.dll_PyRun_SimpleFileExFlags
call sym.python27.dll_PyErr_Clear
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.MSVCR90.dll__errno]
call edi
mov ebx, dword [eax]
push str.Could_not_open_PYTHONSTARTUP_n
call sym.python27.dll_PySys_WriteStderr
add esp, 4
call edi
mov dword [eax], ebx
mov ecx, dword [sym.python27.dll_PyExc_IOError]
push esi
push ecx
call sym.python27.dll_PyErr_SetFromErrnoWithFilename
push 1
call sym.python27.dll_PyErr_PrintEx
add esp, 0xc
call sym.python27.dll_PyErr_Clear
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219