joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432a1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x432bd6
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
test dword [eax - 0x58000008], ebx
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
invalid
invalid
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x25d3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.025d378f
jae 0x25d370e
xor ecx, ecx
call fcn.025d378f
jae 0x25d373d
xor eax, eax
call fcn.025d378f
jae 0x25d374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.025d378f
adc al, al
jae 0x25d372f
jne 0x25d3779
stosb byte es:[edi], al
jmp 0x25d3711
call fcn.025d379b
sub ecx, ebx
jne 0x25d3756
call fcn.025d3799
jmp 0x25d3775
lodsb al, byte [esi]
shr eax, 1
je 0x25d3783
adc ecx, ecx
jmp 0x25d3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.025d3799
cmp eax, 0x7d00
jae 0x25d3772
cmp ah, 5
jae 0x25d3773
cmp eax, 0x7f
ja 0x25d3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x25d3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10162fb0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10163026
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
je 0x10163103
jmp 0x1016311a
mov eax, dword [ebp - 0x24]
mov ecx, 0x106d
xor edx, edx
mov esi, dword [ebp - 0x10]
cmp word [esi + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
je 0x10163055
jmp 0x1016311a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
je 0x10163002
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
jl 0x10163026
jmp 0x10163002
mov eax, 0x106d
xor ecx, ecx
mov dword [0x10169b94], 0x11f2
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0x18], 0x6f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x1016311a
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0x16], 0x61
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x1016311a
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0x14], 0x64
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x1016311a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x29], dl
mov eax, 0x106d
xor ecx, ecx
mov dl, byte [ebp - 0x29]
test dl, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x101630e1
jmp 0x1016311a
mov eax, 0x106d
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0x10], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
je 0x10162fdd
jmp 0x1016311a
mov eax, 1
mov ecx, dword [0x10169b98]
add ecx, 0xef6
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [0x10169b98], ecx
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x10163130
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
lea eax, [esp + 0x98]
lea ecx, [esp + 0x40]
mov edx, dword [0x10169b94]
mov esi, edx
add esi, 0xffffff71
mov dword [0x10169b94], esi
add edx, 0xfffff428
mov dword [0x10169b98], edx
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
call fcn.101622c0
mov ecx, 0xa69
lea edx, [0x101634f0]
mov esi, dword [esp + 0x98]
mov dword [esp + 0x5c], esi
mov dword [0x10169b98], 0x12c8
mov dword [esp + 0x50], 0x132c00
mov esi, dword [0x10169b80]
mov dword [esp + 0x94], esi
mov esi, dword [0x10169b84]
mov dword [esp + 0x74], esi
mov esi, dword [0x10169b88]
mov dword [esp + 0x44], esi
mov esi, dword [0x10169b8c]
mov dword [esp + 0x7c], esi
mov dword [0x10169b94], 0x1bd1
mov esi, dword [0x10169b90]
mov dword [esp + 0x80], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edx
jmp 0x1016323c
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0xa0]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10163a00
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, dword [0x10169b98]
mov dword [esp + 0x2c], eax
mov eax, 1
mov ecx, dword [esp + 0x2c]
add ecx, 0xffffd92f
mov dword [0x10169b94], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp word [eax], 0x5a4d
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jne 0x1016327f
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
cmp dword [eax + ecx], 0x4550
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
je 0x101632a4
mov eax, dword [esp + 0x24]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0xc], eax
mov eax, 0x890
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
jmp 0x1016323c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [0x10169b98], eax
mov dword [esp + 0x78], ecx
mov dword [0x10169b94], 0x39d
mov eax, dword [ecx + edx + 0x50]
mov dword [esp + 0x4c], eax
call fcn.10162fb0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x28], ecx
je 0x101631ec
jmp 0x10163232
Function at 0x10163390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10169b94], 0x66e
mov dword [0x10169b9c], 0
mov dword [0x10169ba0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x10169bac], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
je 0x101633fe
jmp 0x10163406
mov eax, dword [0x10169b9c]
mov ecx, dword [0x10169ba0]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
jmp 0x10163417
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10163417
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10169b9c], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x10169ba0], edx
mov esi, dword [0x10169b98]
add esi, 0xffffe6d4
mov dword [0x10169b98], esi
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10169ba4], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10169ba4]
mov edx, dword [0x10169ba0]
mov byte [edi + edx], cl
mov dword [0x10169b94], 0xa12
mov edx, dword [0x10169b9c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10169ba0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10169bac], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], cl
mov dword [0x10169b94], 0x1c6d
add ebx, 1
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x20], ebx
jne 0x101633e5
jmp 0x101633fe
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x401047
mov eax, dword [esp + 8]
push esi
push 1
push eax
call sub.gnwie.dll_WIgetvar
mov esi, eax
mov ecx, dword [esi + 0x10]
add esp, 8
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40103f
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push edx
push eax
push 0x601
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
call dword [sym.imp.MSVCR80.dll_exit]
pop esi
pop edi
ret

Function at 0x4011d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10c
mov eax, dword [0x438440]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
mov ebp, dword [esp + 0x118]
push esi
mov esi, 1
cmp ebp, esi
push edi
mov edi, dword [esp + 0x124]
jle 0x401269
nop
mov ecx, dword [edi + esi*4]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x401208
sub eax, ebx
cmp eax, 3
jbe 0x401262
cmp byte [ecx], 0x2d
jne 0x401262
cmp byte [ecx + 2], 0x3d
jne 0x401262
movsx eax, byte [ecx + 1]
push eax
call dword [sym.imp.MSVCR80.dll_toupper]
add esp, 4
cmp eax, 0x49
je 0x40124e
cmp eax, 0x50
jne 0x401262
mov ecx, dword [edi + esi*4]
add ecx, 3
push ecx
call dword [sym.imp.MSVCR80.dll_atol]
mov dword [esp + 0x18], eax
jmp 0x40125f
mov edx, dword [edi + esi*4]
add edx, 3
push edx
call dword [sym.imp.MSVCR80.dll_atoi]
mov dword [esp + 0x14], eax
add esp, 4
add esi, 1
cmp esi, ebp
jl 0x401200
push 0x100
lea ebx, [esp + 0x1c]
call fcn.00401050
add esp, 4
test eax, eax
je 0x4012ba
push 0x10
push str.SAP_Graphics_Fatal_Error
mov eax, ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4012b2
mov ecx, dword [esp + 0x10]
push 0
push ecx
push 0x601
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x6f
call dword [sym.imp.MSVCR80.dll_exit]
lea edx, [ebp*4]
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x4012d4
xor ax, ax
jmp 0x40133c
xor edx, edx
test ebp, ebp
jle 0x4012f0
xor ecx, ecx
lea esp, [esp]
mov esi, dword [edi + ecx*4]
add edx, 1
mov dword [eax + ecx*4], esi
movsx ecx, dx
cmp ecx, ebp
jl 0x4012e0
push 1
push eax
push ebp
call sub.gnwie.dll_WIinitialise
movzx esi, ax
add esp, 0xc
test si, si
je 0x4012cf
push 1
push esi
call sub.gnwie.dll_WIgetvar
mov edx, dword [0x438464]
mov ecx, dword [0x438460]
push edx
push ecx
push str.hInst__X__hPrev__X_n
push esi
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
call sub.gnwie.dll_Wtrace
push sym.gnbux.exe_cbexit
push esi
call sub.gnwie.dll_Wregexitproc
add esp, 0x20
mov ax, si
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e930
add esp, 0x10c
ret
Function at 0x401550
Capabilities:
Terminate process

Disassembly:
sub esp, 0x8c
mov eax, dword [0x438440]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x90]
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
push esi
mov dword [esp + 0xc], eax
mov al, byte [ebx]
xor esi, esi
test al, al
push edi
mov ecx, ebx
mov edi, 1
je 0x4015b8
lea esp, [esp]
cmp al, 0x22
jne 0x40159f
xor edx, edx
test esi, esi
sete dl
mov esi, edx
jmp 0x4015ae
cmp al, 0x20
je 0x4015a7
test al, al
jne 0x4015ae
test esi, esi
jne 0x4015ae
add edi, 1
mov al, byte [ecx + 1]
add ecx, 1
test al, al
jne 0x401590
mov ebp, dword [sym.imp.MSVCR80.dll_malloc]
lea eax, [edi*4 + 4]
push eax
call ebp
mov edx, dword [esp + 0x14]
add esp, 4
push 0x80
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4015f0
lea ecx, [esp + 0x18]
sub eax, edx
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x401602
sub ecx, esi
add eax, ecx
je 0x401706
add eax, 2
push eax
call ebp
mov edi, eax
add esp, 4
test edi, edi
jne 0x40162c
push 0xffffffffffffffff
call dword [sym.imp.MSVCR80.dll_exit]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401633
sub eax, edx
add eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call sub.MSVCR80.dll_memcpy
lea eax, [esp + 0x24]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x401657
mov ebp, dword [esp + 0x14]
sub eax, ecx
lea esi, [eax + edi + 1]
mov eax, ebx
mov dword [ebp], edi
mov edi, 1
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x401677
sub eax, ecx
add eax, 1
push eax
push ebx
push esi
call sub.MSVCR80.dll_memcpy
mov eax, esi
add esp, 0xc
xor ebx, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x401697
sub eax, ecx
add eax, 1
test eax, eax
mov dword [ebp + 4], esi
jle 0x40170a
lea ecx, [esi + 1]
mov edx, eax
movsx eax, byte [esi]
sub eax, 0
je 0x4016fc
sub eax, 0x20
je 0x4016e7
sub eax, 2
je 0x4016cb
add esi, 1
add ecx, 1
jmp 0x4016ff
xor eax, eax
test ebx, ebx
sete al
mov byte [esi], 0
mov ebx, eax
test ebx, ebx
je 0x4016df
mov dword [ebp + edi*4], ecx
add esi, 1
add ecx, 1
jmp 0x4016ff
test ebx, ebx
jne 0x4016f4
add edi, 1
mov byte [esi], bl
mov dword [ebp + edi*4], ecx
add esi, 1
add ecx, 1
jmp 0x4016ff
add edi, 1
sub edx, 1
jne 0x4016b1
jmp 0x40170a
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xa4]
push ebp
push edi
mov dword [0x438460], ecx
mov dword [0x438464], edx
call fcn.0042c2e0
mov ecx, dword [esp + 0xa0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042e930
add esp, 0x8c
ret 0x10
Function at 0x4095b0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push esi
call fcn.00409560
mov esi, eax
test esi, esi
je 0x40967a
movzx ecx, word [esi + 8]
push ebx
lea eax, [esp + 0x10]
push eax
push ecx
call sub.gnwie.dll_Wquerywinpos
movzx edx, word [esi + 8]
push 0
push 0
push 0
push 0
push 0
push edx
call sub.gnwie.dll_SHLsetpos
movzx eax, word [esi + 0xe]
push eax
call sub.gnwie.dll_BTNGdestroy
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
movzx edx, word [esi + 6]
movzx eax, word [esi + 0xe]
push ecx
push 0x430874
push ebx
push 0x48
push 0
push edx
push eax
call sub.gnwie.dll_BTNGcreate
movzx edx, word [esi + 0xe]
sub bl, 1
movzx ecx, bl
add esp, 0x40
push ecx
push edx
call sub.gnwie.dll_BTNGsetdefbtn
lea eax, [esp + 0x10]
push eax
mov ax, word [esi + 6]
call fcn.00409590
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
movzx eax, word [esi + 0xc]
push ecx
push edx
push 0
push 0
push 0
push eax
call sub.gnwie.dll_DCONTsetchildpos
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
push 0x82
push ecx
mov ecx, dword [esp + 0x3c]
push edx
movzx edx, word [esi + 8]
push eax
push ecx
push edx
call sub.gnwie.dll_SHLsetpos
add esp, 0x3c
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x42d174
Capabilities:
Read file via mapping

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x438820], ebx
push edi
mov edi, dword [0x4382c0]
jne 0x42d18e
push 0x40
call fcn.0042d139
pop ecx
cmp edi, dword [0x438820]
jle 0x42d19d
xor eax, eax
jmp 0x42d228
cmp byte [esp + 0x14], bl
push esi
je 0x42d1d5
push dword [esp + 0x10]
push dword [esp + 0x18]
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [0x43881c]
push ebx
push ebx
push ebx
push 2
push eax
mov dword [ecx + edi*8], eax
lea esi, [ecx + edi*8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
jmp 0x42d1eb
push dword [esp + 0x14]
mov eax, dword [0x43881c]
push 2
lea esi, [eax + edi*8]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi], eax
mov ecx, dword [0x4382c0]
mov eax, dword [0x4382c4]
jmp 0x42d204
mov edx, dword [0x43881c]
cmp dword [edx + ecx*8], ebx
je 0x42d20a
inc ecx
cmp ecx, eax
jl 0x42d1f8
jmp 0x42d214
cmp ecx, eax
mov dword [0x4382c0], ecx
jne 0x42d21f
inc eax
mov dword [0x4382c4], eax
mov dword [0x4382c0], eax
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x42d2f5
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebx
mov ebx, dword [0x438828]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
inc edi
test ebx, ebx
jne 0x42d31a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
test ebx, ebx
mov dword [0x438828], ebx
je 0x42d376
mov ebp, dword [sym.imp.MSVCR80.dll_malloc]
push 0xc
call ebp
mov esi, eax
test esi, esi
pop ecx
je 0x42d376
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0xc
push 0
push esi
call sub.MSVCR80.dll_memset
mov dword [esi + 4], edi
imul edi, edi, 0x14
push edi
call ebp
add esp, 0x10
test eax, eax
mov dword [esi + 8], eax
je 0x42d376
push edi
push 0
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esi + 8]
xor eax, eax
inc eax
mov dword [ecx + 0x14], eax
mov ecx, dword [esi + 8]
mov dword [ecx + 0x28], eax
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [ecx + 0x3c], eax
and dword [esi], 0
jmp 0x42d378
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42d6a2
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x438440]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x98]
call fcn.0042d37d
mov esi, dword [ebp + 0x94]
imul esi, esi, 0x14
add esi, dword [eax + 8]
xor ebx, ebx
and dword [ebp - 0x80], ebx
cmp dword [ebp + 0x94], 3
mov al, 1
jle 0x42d7e3
cmp dword [esi + 8], ebx
je 0x42d79e
mov eax, dword [esi + 4]
add eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0xc]
jl 0x42d748
mov eax, dword [esi + 8]
mov ecx, 0x100
cmp eax, ecx
jb 0x42d710
mov eax, ecx
push 0
lea ecx, [ebp - 0x80]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x80]
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x80], 0
jl 0x42d777
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
push dword [esi + 4]
call sub.MSVCR80.dll_memcpy
mov eax, dword [esi + 4]
add esp, 0xc
and dword [esi + 0x10], 0
cmp dword [esi + 0xc], 0
jne 0x42d751
mov byte [eax], 0x1a
mov cl, byte [eax]
cmp cl, 0x1a
je 0x42d784
cmp cl, 0xa
je 0x42d790
cmp cl, 0xd
je 0x42d771
mov byte [edi], cl
mov ecx, dword [ebp + 0x9c]
inc edi
inc ebx
dec ecx
cmp ebx, ecx
je 0x42d794
inc eax
inc dword [esi + 0x10]
jmp 0x42d6fa
call fcn.0042d37d
or dword [eax], 0xffffffff
xor eax, eax
inc eax
jmp 0x42d7e6
test ebx, ebx
setne al
dec al
and eax, 3
jmp 0x42d796
xor al, al
jmp 0x42d796
mov al, 2
mov byte [edi], 0
inc dword [esi + 0x10]
jmp 0x42d7e3
push 0
lea eax, [ebp - 0x80]
push eax
push 1
lea eax, [ebp - 0x79]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x80], 0
jne 0x42d7bf
mov al, 0x1a
mov byte [ebp - 0x79], al
jmp 0x42d7c2
mov al, byte [ebp - 0x79]
cmp al, 0x1a
je 0x42d7fe
cmp al, 0xa
je 0x42d80a
cmp al, 0xd
je 0x42d79e
mov byte [edi + ebx], al
mov eax, dword [ebp + 0x9c]
inc ebx
dec eax
cmp ebx, eax
jne 0x42d79e
mov al, 2
mov byte [edi + ebx], 0
movzx eax, al
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e930
add ebp, 0x8c
leave
ret
test ebx, ebx
setne al
dec al
and eax, 3
jmp 0x42d7df
xor al, al
jmp 0x42d7df