joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc13b0c
Capabilities:
Allocate or change rwx memory

Disassembly:
add esp, 0xfffffff8
mov eax, dword [0xc1712c]
add eax, 0x80
mov dword [esp], eax
xor ecx, ecx
mov dl, 0x74
mov eax, dword [esp]
call fcn.00c11a94
test al, al
jne 0xc13b3f
mov ecx, 2
mov dl, 0xa1
mov eax, dword [esp]
call fcn.00c11a94
test al, al
je 0xc13b49
mov eax, 0xc13b84
call fcn.00c0f230
lea eax, [esp + 4]
push eax
push 0x40
push 1
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esp]
mov byte [eax], 0xeb
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 1
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
ret
Function at 0xc13ccc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, esp
cmp byte [0xc17248], 1
jne 0xc13dbe
mov dl, 1
mov eax, 0xc13e9c
call fcn.00c0e470
mov dword [esp + 8], eax
mov cl, 1
xor edx, edx
mov eax, dword [esp + 8]
call fcn.00c0e4f4
mov eax, dword [esp + 8]
mov eax, dword [eax + 8]
add eax, 0x5b
mov dword [ebx], eax
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, dword [ebx]
call fcn.00c11a94
test al, al
je 0xc13d22
mov eax, 0xc13eac
call fcn.00c0f230
lea eax, [esp + 4]
push eax
push 0x40
push 4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc187e8]
mov edx, dword [eax + 0x28]
mov eax, dword [ebx]
dec eax
call fcn.00c119ac
mov edx, dword [ebx]
mov dword [edx], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esp + 8]
mov eax, dword [eax + 8]
add eax, 0x87
mov dword [ebx], eax
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, dword [ebx]
call fcn.00c11a94
test al, al
je 0xc13d83
mov eax, 0xc13f00
call fcn.00c0f230
lea eax, [esp + 4]
push eax
push 0x40
push 4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc187e8]
mov edx, dword [eax + 0x28]
mov eax, dword [ebx]
dec eax
call fcn.00c119ac
mov edx, dword [ebx]
mov dword [edx], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0xc13e1d
mov eax, dword [0xc17164]
add eax, 7
xor edx, edx
mov dl, byte [0xc17100]
add edx, edx
add eax, edx
mov dword [ebx], eax
mov ecx, 0xfffffffd
mov edx, 0x752a3880
mov eax, dword [ebx]
call fcn.00c11aa8
test al, al
je 0xc13df3
mov eax, 0xc13f54
call fcn.00c0f230
lea eax, [esp + 4]
push eax
push 0x40
push 1
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx]
mov byte [eax], 0xeb
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 1
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov dl, 1
mov eax, 0xc13fa8
call fcn.00c0e470
mov dword [esp + 8], eax
mov cl, 1
xor edx, edx
mov eax, dword [esp + 8]
call fcn.00c0e4f4
mov eax, dword [esp + 8]
mov eax, dword [eax + 8]
add eax, 0x49
mov dword [ebx], eax
or ecx, 0xffffffff
mov dx, 0x752a
mov eax, dword [ebx]
call fcn.00c11a9c
test al, al
je 0xc13e62
mov eax, 0xc13fbc
call fcn.00c0f230
lea eax, [esp + 4]
push eax
push 0x40
push 1
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx]
mov byte [eax], 0xeb
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 1
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
add esp, 0xc
pop ebx
ret
Function at 0xc14170
Capabilities:
Allocate or change rwx memory

Disassembly:
add esp, 0xfffffff8
cmp byte [0xc170f4], 0x30
jne 0xc141ad
lea eax, [esp + 4]
push eax
push 0x40
push 1
mov eax, dword [0xc171c4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc171c4]
mov byte [eax], 0xc3
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 8]
push edx
push 1
push eax
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
ret
mov eax, dword [0xc171c4]
add eax, 0xb
xor edx, edx
mov dl, byte [0xc17100]
lea edx, [edx + edx*8]
add eax, edx
mov dword [esp], eax
xor ecx, ecx
mov dl, 0xf
mov eax, dword [esp]
call fcn.00c11a94
test al, al
je 0xc14224
xor eax, eax
mov al, byte [0xc17100]
lea eax, [eax + eax*2]
add eax, dword [0xc171c4]
cmp byte [eax], 0x8b
je 0xc141f4
mov eax, 0xc14278
call fcn.00c0f230
lea eax, [esp + 4]
push eax
push 0x40
push 1
mov eax, dword [0xc171c4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc171c4]
mov byte [eax], 0xc3
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 8]
push edx
push 1
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0xc1426a
lea eax, [esp + 4]
push eax
push 0x40
push 6
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esp]
mov byte [eax], 0xe9
mov eax, dword [esp]
mov edx, eax
add edx, 2
mov edx, dword [edx]
inc edx
inc eax
mov dword [eax], edx
mov eax, dword [esp]
add eax, 5
mov byte [eax], 0x90
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 6
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
ret

Function at 0xc142b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
add esp, 0xfffffff4
lea ebx, [esp + 4]
mov dl, 1
mov eax, 0xc143ac
call fcn.00c0e470
mov dword [esp], eax
mov cl, 1
xor edx, edx
mov eax, dword [esp]
call fcn.00c0e4f4
mov eax, dword [esp]
mov eax, dword [eax + 8]
add eax, 0x28
mov dword [ebx], eax
xor ecx, ecx
mov dl, 0x75
mov eax, dword [ebx]
call fcn.00c11a94
test al, al
jne 0xc14305
mov ecx, 0xfffffffe
mov dx, 0xc085
mov eax, dword [ebx]
call fcn.00c11a9c
test al, al
je 0xc1430f
mov eax, 0xc143c0
call fcn.00c0f230
lea eax, [esp + 8]
push eax
push 0x40
push 1
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx]
mov byte [eax], 0xeb
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push 1
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebx]
add eax, 0x13
mov dword [ebx], eax
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, dword [ebx]
call fcn.00c11a94
test al, al
je 0xc1435a
mov eax, 0xc14400
call fcn.00c0f230
mov eax, dword [ebx]
call fcn.00c119a4
mov dword [0xc171c8], eax
lea eax, [esp + 8]
push eax
push 0x40
push 4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc112e8
mov eax, dword [ebx]
dec eax
call fcn.00c119ac
mov edx, dword [ebx]
mov dword [edx], eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push 4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
add esp, 0xc
pop ebx
ret
Function at 0xc14b98
Capabilities:
Allocate or change rwx memory

Disassembly:
add esp, 0xfffffff8
mov eax, dword [0xc171d0]
add eax, 7
mov dword [esp], eax
mov ecx, 0xfffffffc
mov edx, 0xe856006a
mov eax, dword [esp]
call fcn.00c11aa8
test al, al
je 0xc14bc6
mov eax, 0xc14c10
call fcn.00c0f230
lea eax, [esp + 4]
push eax
push 0x40
push 4
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc11348
mov eax, dword [esp]
dec eax
call fcn.00c119ac
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 4
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
ret

Function at 0xc14fac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, dword [0xc18674]
mov esi, dword [0xc1867c]
sub esi, 0xf
sub esi, ebx
jb 0xc15063
inc esi
mov edx, 0xc17960
mov ecx, 0x10
mov eax, ebx
call fcn.00c119e0
test al, al
je 0xc1505b
lea eax, [ebx + 1]
mov eax, dword [eax]
mov dword [esp], eax
push 0
mov ecx, dword [0xc1867c]
mov edx, dword [0xc18674]
mov eax, dword [esp + 4]
call fcn.00c119bc
test al, al
jne 0xc1505b
mov edx, 0xc15074
mov ecx, 0xb
mov eax, dword [esp]
call fcn.00c0f690
test eax, eax
jne 0xc1505b
sub ebx, 5
mov dword [esp], ebx
lea eax, [esp + 4]
push eax
push 0x40
push 4
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc10920
mov eax, dword [esp]
dec eax
call fcn.00c119ac
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 4
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0xc1506d
inc ebx
dec esi
jne 0xc14fc9
mov eax, 0xc15080
call fcn.00c0f7b0
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0xc15098
Capabilities:
Allocate or change rwx memory

Disassembly:
add esp, 0xfffffff4
mov dl, 1
mov eax, 0xc15140
call fcn.00c0e470
mov dword [esp], eax
mov cl, 1
xor edx, edx
mov eax, dword [esp]
call fcn.00c0e4f4
cmp byte [0xc17278], 0
je 0xc15119
mov eax, dword [esp]
mov eax, dword [eax + 8]
add eax, 0xe
xor edx, edx
mov dl, byte [0xc17100]
lea edx, [edx + edx*2]
add eax, edx
mov dword [esp + 4], eax
lea eax, [esp + 8]
push eax
push 0x40
push 4
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc11730
mov eax, dword [esp + 4]
dec eax
call fcn.00c119ac
mov edx, dword [esp + 4]
mov dword [edx], eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push 4
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0xc15134
call fcn.00c11884
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [0xc171bc], eax
mov eax, 0xc1181c
mov edx, dword [esp]
mov dword [edx + 8], eax
add esp, 0xc
ret
Function at 0x1000c920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1000c978
cmp byte [esi + ebx - 1], 0xa
je 0x1000c94c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1001b0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x1000cfa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x1000d178
mov edi, dword [0x1001b0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x1000d087
test byte [0x1000e23c], 8
jne 0x1000d120
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x1000e24c], 8
jne 0x1000d0e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000d029
cmp esi, 3
jbe 0x1000d098
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000d03a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100164bc]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x1000d029
mov dword [esp], 0x1000e24c
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000d000
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x1000d000
mov dword [esp], 0x1000e23c
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000cfeb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x1000cff3
mov eax, 0xffffffff
jmp 0x1000d087
Function at 0x1000d210
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x1001b0c0]
test eax, eax
je 0x1000d2c8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x1000d250
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000d23c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000d2fd
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1001b0c0], eax
sub esp, 8
test eax, eax
jne 0x1000d22d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000d23e
Function at 0x1000d310
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x1000d4a0
mov eax, dword [esi]
test eax, eax
je 0x1000d488
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000d4ac
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x1000d478
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1000d43c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x1000d376
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x1000d4a2
Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a6f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a49
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a44
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406aa0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406a82
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x383231d0
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x16a5590e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4012f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 2
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x401438
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40142e
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.00401630
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x40135f
mov eax, dword [ebx]
mov ecx, dword [esp + 0x2c]
lea edi, [esp + 0x18]
mov edx, dword [esp + 0x10]
cmp ecx, 7
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
cmova edi, ebx
cmp esi, dword [edx + 0x10]
jne 0x4013da
test esi, esi
je 0x40139c
sub edi, eax
movzx edx, word [edi + eax]
movzx ecx, word [eax]
cmp dx, cx
jne 0x4013d6
add eax, 2
sub esi, 1
jne 0x401384
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x38]
cmp ecx, 7
jbe 0x40142e
lea ecx, [ecx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4013ca
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401426
push ecx
push ebx
call fcn.00401d3d
add esp, 8
jmp 0x40142e
mov ecx, dword [esp + 0x2c]
cmp ecx, 7
jbe 0x40140a
lea ecx, [ecx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x401400
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401426
push ecx
push ebx
call fcn.00401d3d
add esp, 8
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40142c
mov ebx, dword [esp + 0x10]
jmp 0x401347
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor esi, esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x264]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401cff
mov esp, ebp
pop ebp
ret
Function at 0x401450
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402a65
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor esi, esi
cmp dword [ebp + 8], 1
jle 0x401499
mov esi, dword [edi + 4]
jmp 0x4014ad
push 0x10
push str.Something
push str.ERROR
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
lea ecx, [ebp - 0x28]
call fcn.00401630
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
push dword [ebp - 0x18]
cmova edx, dword [ebp - 0x28]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00401b10
add esp, 4
mov ecx, eax
push 0x401a70
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push str.AndroidEmulatorEx.exe
lea ecx, [ebp - 0x40]
call fcn.00401630
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004012f0
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x40153b
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401531
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401596
push ecx
push edx
call fcn.00401d3d
add esp, 8
cmp dword [ebp - 0x14], 7
lea edx, [ebp - 0x28]
mov ecx, esi
cmova edx, dword [ebp - 0x28]
call fcn.00401170
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Done
call fcn.00401820
push 0x401a40
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x4015a6
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40159c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40159c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401d3d
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401cff
mov esp, ebp
pop ebp
ret
Function at 0x40259f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4025de
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4025de
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4025de
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4025de
cmp dword [ecx + 0x74], 0xe
jbe 0x4025de
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret