joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4108c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
xor edx, eax
xor eax, edx
xor edx, eax
push reloc.shlwapi.dll_AssocGetPerceivedType
nop
clc
nop
jb reloc.gdi32.dll_SetWorldTransform
nop
ret
dec byte [ebx - reloc.gdi32.dll_SetWorldTransform]
push reloc.gdi32.dll_GetPath
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 0x14], eax
nop
call sub.kernel32.dll_GetTickCount
push eax
push reloc.opengl32.dll_glStencilOp
push dword [ebp - 0x14]
call sub.user32.dll_wsprintfA
add esp, 0xc
push reloc.gdi32.dll_GetPath
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 4], eax
mov edx, edx
mov ecx, ecx
nop
push reloc.gdi32.dll_GetPath
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 0x10], eax
nop
push reloc.gdi32.dll_GetPath
call fcn.00401888
mov edx, edx
mov ecx, ecx
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 8], eax
mov ecx, ecx
mov edx, edx
mov edx, edx
mov ecx, ecx
nop
push reloc.gdi32.dll_AbortPath
push dword [ebp - 4]
push dword [0x4186a0]
call sub.kernel32.dll_GetModuleFileNameA
nop
mov edx, edx
mov ecx, ecx
mov edx, edx
mov ecx, ecx
push dword [ebp - 0x10]
push reloc.gdi32.dll_AbortPath
call sub.kernel32.dll_GetTempPathA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov ecx, ecx
mov edx, edx
nop
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcatA
mov edx, edx
push 0
push 0
push 2
push 0
push 3
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov ecx, ecx
mov dword [ebp - 0xc], eax
mov ecx, ecx
inc eax
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcpyA
push reloc.shlwapi.dll_PathIsUNCServerShareW
push 0
push dword [ebp - 0x10]
call sub.shlwapi.dll_StrRChrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
inc eax
push dword [ebp - 0x14]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
push 0
push 2
push 0
push 3
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.wsock32.dll_recvfrom
call sub.kernel32.dll_lstrlenA
push eax
push reloc.wsock32.dll_recvfrom
push dword [ebp - 0xc]
call fcn.0040145e
push eax
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
pop eax
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
push reloc.opengl32.dll_glClearStencil
push dword [ebp - 8]
call sub.user32.dll_wsprintfA
add esp, 0xc
push reloc.gdi32.dll_GdiComment
call sub.kernel32.dll_LoadLibraryA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_ChrCmpIA
push eax
call sub.kernel32.dll_GetProcAddress
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
push reloc.shlwapi.dll_PathMakePrettyA
push 0
call eax
push dword [ebp - 0x14]
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 8]
call fcn.00401871
leave
ret
Function at 0x4108dd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
xor edx, eax
xor eax, edx
xor edx, eax
push reloc.shlwapi.dll_AssocGetPerceivedType
nop
clc
nop
jb reloc.gdi32.dll_SetWorldTransform
nop
ret
dec byte [ebx - reloc.gdi32.dll_SetWorldTransform]
push reloc.gdi32.dll_GetPath
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 0x14], eax
nop
call sub.kernel32.dll_GetTickCount
push eax
push reloc.opengl32.dll_glStencilOp
push dword [ebp - 0x14]
call sub.user32.dll_wsprintfA
add esp, 0xc
push reloc.gdi32.dll_GetPath
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 4], eax
mov edx, edx
mov ecx, ecx
nop
push reloc.gdi32.dll_GetPath
call fcn.00401888
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 0x10], eax
nop
push reloc.gdi32.dll_GetPath
call fcn.00401888
mov edx, edx
mov ecx, ecx
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 8], eax
mov ecx, ecx
mov edx, edx
mov edx, edx
mov ecx, ecx
nop
push reloc.gdi32.dll_AbortPath
push dword [ebp - 4]
push dword [0x4186a0]
call sub.kernel32.dll_GetModuleFileNameA
nop
mov edx, edx
mov ecx, ecx
mov edx, edx
mov ecx, ecx
push dword [ebp - 0x10]
push reloc.gdi32.dll_AbortPath
call sub.kernel32.dll_GetTempPathA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov ecx, ecx
mov edx, edx
nop
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcatA
mov edx, edx
push 0
push 0
push 2
push 0
push 3
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov ecx, ecx
mov dword [ebp - 0xc], eax
mov ecx, ecx
inc eax
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcpyA
push reloc.shlwapi.dll_PathIsUNCServerShareW
push 0
push dword [ebp - 0x10]
call sub.shlwapi.dll_StrRChrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
inc eax
push dword [ebp - 0x14]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
push 0
push 2
push 0
push 3
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.wsock32.dll_recvfrom
call sub.kernel32.dll_lstrlenA
push eax
push reloc.wsock32.dll_recvfrom
push dword [ebp - 0xc]
call fcn.0040145e
push eax
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
pop eax
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
push reloc.opengl32.dll_glClearStencil
push dword [ebp - 8]
call sub.user32.dll_wsprintfA
add esp, 0xc
push reloc.gdi32.dll_GdiComment
call sub.kernel32.dll_LoadLibraryA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_ChrCmpIA
push eax
call sub.kernel32.dll_GetProcAddress
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
push reloc.shlwapi.dll_PathMakePrettyA
push 0
call eax
push dword [ebp - 0x14]
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 8]
call fcn.00401871
leave
ret
Function at 0x410bb1
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
push edi
xor edx, eax
xor eax, edx
xor edx, eax
push reloc.shlwapi.dll_StrFormatKBSizeW
nop
clc
nop
jb reloc.gdi32.dll_SetWorldTransform
nop
ret
inc byte [ebx + reloc.gdi32.dll_SetWorldTransform]
add byte [eax], al
je reloc.gdi32.dll_SetWorldTransform
cmp dword [0x415407], 0
jne reloc.gdi32.dll_SetWorldTransform
sub eax, eax
pop edi
pop ebx
leave
ret
mov ebx, dword [0x41867b]
jmp reloc.gdi32.dll_SetWorldTransform
call fcn.00402b94
cmp dword [0x41867f], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebx + 4]
push dword [0x41867f]
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebx + 4]
push 0
push dword [ebx + 4]
call dword [0x415407]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebx + 4]
call fcn.004029e7
mov dword [ebp - 8], eax
push dword [ebx + 4]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 8]
push eax
push dword [ebx + 4]
push reloc.gdi32.dll_CancelDC
push reloc.gdi32.dll_SetWorldTransform
call sub.kernel32.dll_LCMapStringA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push dword [ebp - 8]
push 0
push dword [ebx + 4]
call dword [0x415407]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
call fcn.00401871
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
call fcn.00401871
mov edi, reloc.shlwapi.dll_UrlGetPartA
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push edi
push 0
push dword [ebx + 4]
call dword [0x415407]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x28], reloc.opengl32.dll_glClearStencil
mov dword [ebp - 0x24], 1
push dword [ebx + 4]
pop dword [ebp - 0x20]
push dword [ebx + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call sub.userenv.dll_LoadUserProfileA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0xc], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0xc]
pop dword [reloc.gdi32.dll_SetWorldTransform]
mov dword [ebp - 0x2c], 1
jmp reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x2c], 0
push dword [ebp - 4]
call dword [0x4153fb]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
call fcn.004107b0
cmp dword [0x4153f3], 0
je reloc.gdi32.dll_SetWorldTransform
call dword [0x4153f3]
mov dword [0x4150e8], 0x80000001
cmp dword [ebp - 0x2c], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.userenv.dll_UnloadUserProfile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
cld
xor eax, eax
mov ecx, reloc.gdi32.dll_SetWorldTransform
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne reloc.gdi32.dll_SetWorldTransform
mov ebx, dword [ebx]
and ebx, ebx
jne reloc.gdi32.dll_SetWorldTransform
mov eax, 1
pop edi
pop ebx
leave
ret
Function at 0x411cbd
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
cmp dword [esp + 0x44], 0
push esi
mov esi, ecx
jne reloc.gdi32.dll_SetWorldTransform
xor eax, eax
pop esi
add esp, 0x38
ret 0x18
mov eax, dword [esp + 0x40]
test eax, eax
jne reloc.gdi32.dll_SetWorldTransform
or eax, reloc.gdi32.dll_SetWorldTransform
pop esi
add esp, 0x38
ret 0x18
mov ecx, dword [esp + 0x44]
test ecx, ecx
je reloc.gdi32.dll_SetWorldTransform
mov edx, dword [esp + 0x4c]
test edx, edx
je reloc.gdi32.dll_SetWorldTransform
mov dword [esi + 0x414], eax
dec eax
mov dword [esi + 0x420], eax
mov dword [esi + 0x410], ecx
mov eax, reloc.gdi32.dll_SetWorldTransform
xor ecx, ecx
push edi
movzx edi, byte [ecx + section..data1]
rol eax, 1
xor eax, edi
movzx edi, byte [ecx + reloc.gdi32.dll_SetWorldTransform]
rol eax, 1
xor eax, edi
movzx edi, byte [ecx + reloc.gdi32.dll_SetWorldTransform]
inc eax
inc ecx
add cl, dl
sal byte [ebx], 0xc7
movzx edi, byte [ecx + reloc.gdi32.dll_SetWorldTransform]
rol eax, 1
add ecx, 4
xor eax, edi
cmp ecx, reloc.gdi32.dll_CancelDC
jb reloc.gdi32.dll_SetWorldTransform
test eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push ebx
mov dword [esi], edx
lea ecx, [esi + 4]
add edx, reloc.gdi32.dll_SetWorldTransform
mov edi, reloc.gdi32.dll_CancelDC
lea ebx, [eax + 1]
push ebp
mov dword [ecx], edx
xor eax, eax
add eax, 0
mov ebp, dword [ecx]
mov dword [ebp + eax], 0
add eax, 4
cmp eax, reloc.gdi32.dll_SetWorldTransform
jb reloc.gdi32.dll_SetWorldTransform
add edx, reloc.gdi32.dll_SetWorldTransform
add ecx, 4
sub edi, ebx
jne reloc.gdi32.dll_SetWorldTransform
mov ecx, dword [esi + 0x414]
mov edx, dword [esi]
or eax, reloc.gdi32.dll_SetWorldTransform
mov dword [esi + 0x424], eax
mov dword [esi + 0x408], ecx
mov dword [esi + 0x404], ebx
mov dword [esi + 0x40c], edi
mov dword [edx], edi
mov ecx, dword [esi + 0x414]
mov edx, dword [esi + 0x410]
mov dword [esi + 0x428], edi
mov cl, byte [ecx]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov byte [edx], cl
add dword [esi + 0x414], ebx
add dword [esi + 0x410], ebx
dec eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x41c], ebx
mov dword [esp + 0x58], ebx
cmp eax, ebx
jbe reloc.gdi32.dll_SetWorldTransform
lea ebx, [ebx]

Function at 0x412780
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
movzx ecx, byte [edx + reloc.gdi32.dll_SetWorldTransform]
mov ebx, ecx
sar ebx, 3
movzx ebx, byte [ebx + eax]
mov esi, ecx
and esi, 7
movzx esi, word [esi + esi + 0x4188cc]
and ebx, esi
setne bl
mov byte [ebp + edx - 0x38], bl
inc edx
cmp edx, 0x38
jl reloc.gdi32.dll_SetWorldTransform
xor eax, eax
Function at 0x401430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x82c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x828], eax
movups xmm0, xmmword [str.2V6mbDOr2zHaX5dBd7ILOTJdOP4dfl8R.exe]
movzx eax, word [0x413de8]
push esi
movups xmmword [esp + 8], xmm0
push 0x1be
movups xmm0, xmmword [0x413db0]
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push 0
movups xmmword [esp + 0x20], xmm0
push eax
movups xmm0, xmmword [0x413dc0]
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [0x413dd0]
movups xmmword [esp + 0x44], xmm0
movq xmm0, qword [0x413de0]
movq qword [esp + 0x54], xmm0
call fcn.00402c20
add esp, 0xc
lea edx, [esp + 8]
push 0x6a
call fcn.00401160
add esp, 4
mov esi, eax
xor eax, eax
mov word [esp + 0x418], ax
push 0x206
push eax
lea eax, [esp + 0x422]
push eax
call fcn.00402c20
add esp, 0xc
lea eax, [esp + 0x418]
push esi
push 0x104
push eax
call fcn.00404650
movzx eax, word [0x413dfc]
add esp, 0xc
movups xmm0, xmmword [str.main.exe]
mov word [esp + 0x220], ax
lea eax, [esp + 0x222]
push 0x1f6
push 0
push eax
movups xmmword [esp + 0x21c], xmm0
call fcn.00402c20
add esp, 0xc
lea edx, [esp + 0x210]
push 0x66
call fcn.00401160
add esp, 4
mov esi, eax
xor eax, eax
mov word [esp + 0x620], ax
push 0x206
push eax
lea eax, [esp + 0x62a]
push eax
call fcn.00402c20
add esp, 0xc
lea eax, [esp + 0x620]
push esi
push 0x104
push eax
call fcn.00404650
add esp, 0xc
push 0x9c40
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x418]
push eax
call esi
lea eax, [esp + 0x620]
push eax
call esi
mov ecx, dword [esp + 0x82c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00401696
mov esp, ebp
pop ebp
ret

Function at 0x401f1f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401f5e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401f5e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401f5e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401f5e
cmp dword [ecx + 0x74], 0xe
jbe 0x401f5e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407c78
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407d15
push ebx
push esi
call fcn.00407c41
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407bd5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407cc2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407d14
push edi
push eax
call fcn.0040668b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407ce2
call fcn.00406736
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407d13
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407bd5
add esp, 0x20
test eax, eax
jne 0x407d01
push edi
call fcn.00406736
jmp 0x407d09
push ebx
call fcn.00406736
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408f24
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411040
push 0x411038
push str.FlsAlloc
push 0x1f
call fcn.00408de3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408f58
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f138]
call esi
jmp 0x408f5e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408fa2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411050
push 0x411048
push str.FlsGetValue
push 0x21
call fcn.00408de3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408fd9
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408fe1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411058
push 0x411050
push str.FlsSetValue
push 0x22
call fcn.00408de3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40901b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f138]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e3e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e40d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e40d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5fa65f55
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2ed25055
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x50374020
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x6c7b472f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1000b623
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000b662
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000b662
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000b662
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000b662
cmp dword [ecx + 0x74], 0xe
jbe 0x1000b662
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000e2df
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000e37c
push ebx
push esi
call fcn.1000e2a8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000e23c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000e329
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000e37b
push edi
push eax
call fcn.1000f29a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000e349
call fcn.1000cd84
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000e37a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000e23c
add esp, 0x20
test eax, eax
jne 0x1000e368
push edi
call fcn.1000cd84
jmp 0x1000e370
push ebx
call fcn.1000cd84
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000e5e9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10016678
push 0x10016670
push str.FlsAlloc
push 0x1f
call fcn.1000e505
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e61d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10015158]
call esi
jmp 0x1000e623
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000e667
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10016688
push 0x10016680
push str.FlsGetValue
push 0x21
call fcn.1000e505
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e69e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10015158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000e6a6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10016690
push 0x10016688
push str.FlsSetValue
push 0x22
call fcn.1000e505
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000e6e0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10015158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10013d60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10013d8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013d8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret