joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10070f7c
Capabilities:
Get thread local storage value

Disassembly:
push 4
mov eax, 0x100da5f0
call fcn.100157c2
mov ebx, ecx
mov eax, dword [ebx + 0xc]
push dword [eax + 0x70]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1007103b
push 0
pop edi
and eax, 3
je 0x10070fc4
cmp eax, 1
jne 0x10070fcd
and esi, 0xfffffffe
mov esi, dword [esi + 0x10]
add esi, 8
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10070fc4
mov al, byte [eax + 0x44]
test al, al
jne 0x1007103b
mov ecx, esi
call fcn.10068350
jmp 0x10071002
and esi, 0xfffffffd
lea ecx, [esi + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], ecx
call dword [eax + 0x10]
mov esi, dword [esi + 0x20]
mov eax, dword [esi + 0x2c]
add esi, 0x10
test eax, eax
je 0x10070ff3
mov al, byte [eax + 0x44]
test al, al
je 0x10070ff3
mov esi, edi
jmp 0x10070ffa
mov ecx, esi
call fcn.10068350
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x14]
test esi, esi
je 0x1007103b
cmp dword [esi + 0x14], ebx
je 0x10071035
push 0x3c
call fcn.10091f4e
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x10071028
push esi
push ebx
mov ecx, eax
call fcn.10091f4e
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10068350
jmp 0x10071037
mov edi, esi
mov eax, edi
jmp 0x1007103d
xor eax, eax
call fcn.100157f5
ret

Function at 0x10073f6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x100db7e8
call fcn.100157c2
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor esi, esi
mov dword [edi + 8], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], 0x80000000
mov dword [edi + 0x18], esi
mov dword [edi + 0x38], esi
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::constructor_void_
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
call fcn.10091f4e
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x10073fe8
cmp eax, 2
je 0x10073fe8
xor edx, edx
add eax, 4
inc edx
lock xadd dword [eax], edx
mov ecx, edi
call fcn.10074d68
lea ecx, [edi + 0x3c]
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::set_void_
cmp byte [ebp + 0xc], 0
je 0x10074029
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x10074023
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
je 0x10074031
jmp 0x10074012
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.1001ffa7
mov esi, eax
cmp dword [esi + 0x20], 0
jne 0x10074045
mov ecx, esi
call fcn.10065b8a
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.100157f5
ret 8
Function at 0x10075d62
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100de7b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100e3510]
test dword [ebp + 8], eax
je 0x10075dfc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x808]
call fcn.10091f4e
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [0x100dfd60]
pop ecx
test eax, eax
je 0x10075def
push esi
push edi
lea ecx, [ebp - 0x808]
push ecx
push eax
call sym.MSVCR120.dll_fwprintf
mov edi, dword [0x100e3524]
mov esi, dword [0x100e3520]
pop ecx
pop ecx
push 0
push 0x32
push edi
push esi
call fcn.10032225
add esi, 1
mov dword [0x100e3520], esi
adc edi, 0
or eax, edx
mov dword [0x100e3524], edi
pop edi
pop esi
jne 0x10075dfc
push dword [0x100dfd60]
call sym.MSVCR120.dll_fflush
pop ecx
jmp 0x10075dfc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010cbc
mov esp, ebp
pop ebp
ret

Function at 0x10091f4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10091f5d
pop dword [ebp - 0x24]
mov eax, 0x9249f18f
add eax, 0x7dbf2dce
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x5f575
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x8f8c8813
add ecx, 0x7073c3f4
mov ebx, eax
mov esi, 0x100ece00
add esi, dword [ebp - 0x24]
mov edx, 0x5cd6aa52
add edx, 0xbd2cb52a
sub dword [ebp - 0x1c], ebx
mov edi, dword [esi]
sub dword [ebp - 0x18], esi
xor edi, edx
add dword [ebp - 0xc], 0xe7eb9b5b
mov dword [ebx], edi
add ebx, 4
add esi, 0x432508ec
sub esi, 0x432508e8
loop 0x10091fb1
add eax, 0x3bf46b0e
sub eax, 0x3bf3481f
xor ebx, ebx
add ebx, eax
add eax, 0xb1dc6b3f
add eax, 0x4e2394c6
mov ecx, 0x42374f8f
add ecx, 0xcdc8b071
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x33c463c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3b4404d1
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x423d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
or ebp, 0xffffffff
jmp 0x423d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x423d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x423d48
mov eax, 1
add ebx, ebx
jne 0x423d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x423d60
jne 0x423d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423d60
xor ecx, ecx
sub eax, 3
jb 0x423d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423e02
mov ebp, eax
add ebx, ebx
jne 0x423d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423dcc
inc ecx
add ebx, ebx
jne 0x423db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423dad
jne 0x423dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423ddd
jmp 0x423d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423dec
add edi, ecx
jmp 0x423d4e
pop esi
mov edi, esi
mov ecx, 0x502
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423e0a
cmp byte [edi], 4
jne 0x423e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x423e0f
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x24b20]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x24bc0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423e3c
mov ecx, edi
jns 0x423e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x24bc4]
or eax, eax
je 0x423e81
mov dword [ebx], eax
add ebx, 4
jmp 0x423e59
call dword [esi + 0x24bc8]
popal
jmp section.UPX0

Function at 0x414de0
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], edi
sub ecx, 0xf19ef32a
dec esi
add ebx, 4
sub eax, 0x96295aa5
add esi, esi
cmp ebx, edx
jne fcn.00414de0
or esi, eax
or esi, eax
ret
Function at 0x40262f
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov eax, ebx
mov byte [esp], dl
lea esi, [esp + 4]
call fcn.00406fac
cmp eax, 0x3f6
jae 0x402862
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00406f50
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x40267c
lea edx, [ebx + 1]
jmp 0x40267e
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x4026cf
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x4026a7
jmp 0x4026a0
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x4026a0
mov byte [ebx + eax], 0x20
jmp 0x4026a7
inc eax
cmp byte [ebx + eax], 0
jne 0x402690
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x4026bc
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x4026ce
cmp edx, 0x20
jne 0x4026c5
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x4026d6
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x402685
cmp byte [0x40d0da], 0
je 0x4026e6
mov dword [esi + 0x14], 0x40d0da
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405bc4
mov edi, eax
test edi, edi
je 0x402712
mov edx, str..inf
mov eax, edi
call fcn.004070b4
test eax, eax
jne 0x402712
mov dword [esi + 0xc], 0x40c221
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.004060f4
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x40273a
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00406188
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x40277d
cmp byte [esp + 1], 0
jne 0x40277d
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.0040702c
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.00407100
lea eax, [esp + 0x440]
xor edx, edx
call fcn.004060f4
test al, al
je 0x402862
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4027a7
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x402862
cmp byte [0x40ccd0], 0
jne 0x4027be
cmp byte [esp], 0
je 0x402814
mov ebx, dword [0x40d55c]
test ebx, ebx
je 0x4027d2
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x4027d6
xor eax, eax
jmp 0x4027db
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x4027ee
push 0
push dword [0x40d55c]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
mov eax, dword [esi + 0x38]
call fcn.0040286c
test ebx, ebx
je 0x402814
push 1
push dword [0x40d55c]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x402830
mov edx, str..exe
mov eax, edi
call fcn.004070b4
test eax, eax
je 0x402862
cmp byte [0x40ccd0], 0
je 0x40284b
cmp byte [esp], 0
jne 0x40284b
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x402862
mov edx, 0xc8
cmp byte [esp], 0
jne 0x40285c
add edx, 0x320
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x44a008], 0x8088405
inc edx
mov dword [ebx + 0x44a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x42e58e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x42f8f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x44c54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x44c54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x44b378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f8fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4e3ed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa1000]
push edi
jmp 0x4e3eea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e3ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3ee0
mov eax, 1
add ebx, ebx
jne 0x4e3f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e3f14
jne 0x4e3f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3f33
dec eax
add ebx, ebx
jne 0x4e3f20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e3ef8
add ebx, ebx
jne 0x4e3f2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e3f85
xor ecx, ecx
sub eax, 3
jb 0x4e3f4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e3fba
sar eax, 1
mov ebp, eax
jmp 0x4e3f56
add ebx, ebx
jne 0x4e3f56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3f24
inc ecx
add ebx, ebx
jne 0x4e3f64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3f24
add ebx, ebx
jne 0x4e3f71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e3f66
jne 0x4e3f82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e3f66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e3fa4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e3f96
jmp 0x4e3ee6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e3fa4
add edi, ecx
jmp 0x4e3ee6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e3fc2
cmp byte [edi], 0x13
jne 0x4e3fc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e3fc7
lea edi, [esi + 0xdf000]
mov eax, dword [edi]
or eax, eax
je 0x4e403f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x115f5c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1160b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e3ff4
mov ecx, edi
jns 0x4e4023
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1160b4]
or eax, eax
je 0x4e4039
mov dword [ebx], eax
add ebx, 4
jmp 0x4e4011
call dword [esi + 0x1160c4]
mov ebp, dword [esi + 0x1160b8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e4073
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x1000a36d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10017640
push 0x10017638
push str.FlsAlloc
push 0x1e
call fcn.1000a28b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a3a1
push dword [ebp + 8]
mov ecx, esi
call dword [0x10016178]
call esi
jmp 0x1000a3a7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000a3eb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10017650
push 0x10017648
push str.FlsGetValue
push 0x20
call fcn.1000a28b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a422
push dword [ebp + 8]
mov ecx, esi
call dword [0x10016178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000db32
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000dbcf
push ebx
push esi
call fcn.1000dafb
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000da44
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000db7c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000dbce
push edi
push eax
call fcn.1000b3aa
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000db9c
call fcn.1000a138
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000dbcd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000da44
add esp, 0x20
test eax, eax
jne 0x1000dbbb
push edi
call fcn.1000a138
jmp 0x1000dbc3
push ebx
call fcn.1000a138
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret