joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100329b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100329bf
pop dword [ebp - 0x48]
mov eax, 0xbbc50e8
sub eax, 0xfbb92729
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x8d147f99
sub dword [ebp - 0x58], 0x3ec23a4e
mov dword [ebp - 0x54], 0xba320686
sub dword [ebp - 0x54], 0x87feba41
mov dword [ebp - 0x50], 0x3083a492
add dword [ebp - 0x50], 0x1bc89f9c
mov dword [ebp - 0x4c], 0xa27e3963
sub dword [ebp - 0x4c], 0xa27e3963
lea eax, [ebp - 0x58]
push eax
mov eax, 0x605e57cc
add eax, 0xafa4f94c
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa8a2f071
add dword [ebp - 0x58], 0xcbcf78e5
mov dword [ebp - 0x54], 0x489b1c03
add dword [ebp - 0x54], 0xf8d14572
mov dword [ebp - 0x50], 0x2504f58d
add dword [ebp - 0x50], 0x3e6a76df
mov dword [ebp - 0x4c], 0x4490742
add dword [ebp - 0x4c], 0xfbb6f8be
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d02e
push 0
call eax
mov ecx, 0xf1b2313e
add ecx, 0xe4e1e7f
mov ebx, eax
mov esi, 0x1392ad68
add esi, 0xfc75d698
add esi, dword [ebp - 0x48]
mov edx, 0xfa326152
add edx, 0x6ffc0e8e
add dword [ebp - 0x30], 0xe90b6448
mov edi, dword [esi]
xor dword [ebp - 0x14], 0x798c4ec0
sub edi, edx
xor dword [ebp - 0xc], 0x937e7053
mov dword [ebx], edi
mov dword [ebp - 4], 0x2adb4bcb
add ebx, 4
add esi, 4
loop 0x10032adc
add eax, 0x131c7
mov ebx, eax
add eax, 5
mov ecx, 0x7da08c3a
add ecx, 0x925f73c6
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x1003384b
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x54]
jae 0x10033862
mov bl, byte [eax]
inc eax
mov dword [esi + 0x50], eax
jmp 0x100338ce
cmp dword [esi + 0x4c], 0
jl 0x100338cc
mov edi, dword [esi + 0x58]
push 0xfa0
push edi
push dword [esi + 0x4c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1003389a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x1003386b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x1003386b
cmp ebx, 1
jge 0x100338a7
or dword [esi + 0x4c], 0xffffffff
xor bl, bl
jmp 0x100338ec
lea eax, [edi + 1]
mov dword [esi + 0x50], eax
lea eax, [ebx + edi]
mov dword [esi + 0x54], eax
mov bl, byte [edi]
test bl, bl
jne 0x100338ce
push esi
call fcn.100348ff
mov eax, dword [esi + 0x50]
or dword [esi + 0x4c], 0xffffffff
pop ecx
mov dword [esi + 0x54], eax
jmp 0x100338ce
xor bl, bl
cmp bl, 0xa
jne 0x100338e2
mov eax, dword [esp + 0x18]
and dword [eax], 0
mov eax, dword [esp + 0x14]
inc dword [eax]
jmp 0x100338ec
test bl, bl
je 0x100338ec
mov ecx, dword [esp + 0x18]
inc dword [ecx]
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x100347ff
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x54]
jae 0x10034812
mov al, byte [eax]
jmp 0x10034855
cmp dword [esi + 0x4c], 0
jl 0x10034853
mov edi, dword [esi + 0x58]
push 0xfa0
push edi
push dword [esi + 0x4c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1003484a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x1003481b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x1003481b
cmp ebx, 1
jge 0x10034859
or dword [esi + 0x4c], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
ret
lea ecx, [ebx + edi]
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], ecx
mov al, byte [edi]
jmp 0x10034855
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000bb8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000bb9a
pop dword [ebp - 0x44]
mov eax, 0x1000bb9a
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x39c92
push 0
mov eax, 0xaa04ef66
sub eax, 0x9a041e5e
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x726def64
add ecx, 0x8d926240
xor edi, edi
add edi, eax
mov esi, 0x10021400
add esi, dword [ebp - 0x44]
mov ebx, 0x2923e588
xor dword [ebp - 0x3c], 0xdd560f3
mov edx, dword [esi]
xor dword [ebp - 0x24], 0x29f94fa2
sub edx, ebx
xor dword [ebp - 0x30], 0xe236907b
mov dword [edi], edx
mov dword [ebp - 0x20], 0xf4f4cc34
add edi, 4
add esi, 4
loop 0x1000bbea
add eax, 0x6b2e8214
sub eax, 0x6b2d48b1
xor ebx, ebx
add ebx, eax
add eax, 0x9aee8abf
add eax, 0x65117546
mov ecx, 0x51ec170b
sub ecx, 0x41ec170b
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x448d63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x448d72
pop dword [ebp - 0x28]
mov eax, 0x448d72
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3b3f8
push 0
mov eax, 0xc0ab582c
sub eax, 0xc0617ad0
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xec84d15c
sub ecx, 0xec84820c
mov edi, eax
mov edx, 0x53a5d5d0
add edx, 0xaca4b630
add edx, dword [ebp - 0x28]
mov esi, 0x4f8e01dc
add esi, 0x101cac41
mov dword [ebp - 0x18], 0x87c679b3
mov ebx, dword [edx]
sub dword [ebp - 0x18], edi
xor ebx, esi
sub dword [ebp - 0xc], 0x473a2d12
mov dword [edi], ebx
xor dword [ebp - 0x24], 0x7827717b
add edi, 4
add edx, 0xf1e5b230
sub edx, 0xf1e5b22c
loop 0x448dcc
add eax, 0x13013
mov ebx, eax
add eax, 0x1f5793a5
add eax, 0xe0a86c60
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x44d4c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x44d53a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x44d575
cmp dword [esp + 4], 0
je 0x44d55c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44d598
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x4a126c]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x4a126c], edi
jne 0x44d520
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x44d56c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x44d5df
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x44d560
mov esi, dword [esp]
jmp 0x44d56c
mov esi, dword [edi]
jmp 0x44d56b
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x462c80
push 0x462cb4
push eax
call fcn.0044e1a0
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x462cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x4613d0
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x462ce0
push eax
call fcn.0044dc10
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x462cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x4613d0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0044e200
ud2
Function at 0x1000d40f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10015406
call fcn.10013c9a
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x1000d630
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.10010a72
add esp, 0x10
test eax, eax
js 0x1000d62a
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x1000d4b3
push edi
call fcn.100081d8
pop ecx
test al, al
je 0x1000d4b3
mov eax, edi
call fcn.10013eb0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000d4c5
push edi
lea ecx, [ebp - 0x424]
call fcn.10010a72
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.10010a72
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000d62a
push 0x60
push ebx
push eax
call fcn.1000e9b2
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x1000d51d
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.1000e9b2
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x1000d51d
call fcn.100037d1
mov ebx, eax
jmp 0x1000d5f9
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x1000d544
call fcn.100037d1
jmp 0x1000d5ec
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x1000d53a
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x1000d577
mov ebx, 0x8007000e
jmp 0x1000d5ee
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10010a72
jmp 0x1000d59d
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000d570
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.10010a72
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.10010a72
mov ebx, eax
test edi, edi
je 0x1000d5f9
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000d612
lea ecx, [ebp - 0x418]
call fcn.1000cc05
or dword [ebp - 4], 0xffffffff
jmp 0x1000d622
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x1000d618
mov eax, ebx
jmp 0x1000d65e
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1000d645
lea ecx, [ebp - 0x418]
call fcn.1000cc05
or dword [ebp - 4], 0xffffffff
jmp 0x1000d655
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x1000d64b
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.10013be7
ret 0x10
Function at 0x1000f1e0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [ebp + 0x10]
add esi, 0x568
push 0x10017bc0
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000f269
push str.file:__
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000f269
push dword [ebp + 0xc]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000f269
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x1000f26c
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x1000f265
add eax, 0xfffffffd
cmp eax, 1
ja 0x1000f26c
mov esi, edi
jmp 0x1000f26c
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.10010a72
add esp, 0x10
pop edi
pop esi
leave
ret 0x20
Function at 0x100188d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x100188e4
pop dword [ebp - 0x38]
mov eax, 0x100188e4
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3bd2e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4cd4
mov ebx, eax
mov esi, 0x10046c00
add esi, dword [ebp - 0x38]
mov edx, 0xd46b1225
sub edx, 0xf2c27def
xor dword [ebp - 4], ebx
mov edi, dword [esi]
add edi, edx
add dword [ebp - 8], edi
mov dword [ebx], edi
xor dword [ebp - 0x34], ebx
add ebx, 0xf7a3615f
add ebx, 0x85c9ea5
add esi, 0x56ad8505
add esi, 0xa9527aff
loop 0x1001892d
add eax, 0x3bb28db5
sub eax, 0x3bb16792
mov ebx, eax
add eax, 5
mov ecx, 0xe0448986
sub ecx, 0xd0448986
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x32011584
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, ecx
push edi
push 0x3204c4f4
xor edi, edi
push dword [ebx + 4]
call esi
push str.SolidConverterCreate
push dword [ebx + 4]
mov dword [ebx + 0xc], eax
call esi
push str.SolidConverterClose
push dword [ebx + 4]
mov dword [ebx + 0x10], eax
call esi
push str.SolidAttachCallback
push dword [ebx + 4]
mov dword [ebx + 0x14], eax
call esi
push str.SolidDetachCallback
push dword [ebx + 4]
mov dword [ebx + 0x18], eax
call esi
push str.SolidSetConfiguration
push dword [ebx + 4]
mov dword [ebx + 0x1c], eax
call esi
push str.SolidSetOCRInterface
push dword [ebx + 4]
mov dword [ebx + 0x20], eax
call esi
push str.SolidConvert
push dword [ebx + 4]
mov dword [ebx + 0x24], eax
call esi
push str.SolidConvertSelection
push dword [ebx + 4]
mov dword [ebx + 0x28], eax
call esi
push str.SolidExtractTables
push dword [ebx + 4]
mov dword [ebx + 0x2c], eax
call esi
push str.SolidExtractSelectedTables
push dword [ebx + 4]
mov dword [ebx + 0x30], eax
call esi
push str.SolidExtractImages
push dword [ebx + 4]
mov dword [ebx + 0x34], eax
call esi
push str.SolidResetOptions
push dword [ebx + 4]
mov dword [ebx + 0x38], eax
call esi
push str.SolidSetOptionInt
push dword [ebx + 4]
mov dword [ebx + 0x3c], eax
call esi
push str.SolidGetOptionInt
push dword [ebx + 4]
mov dword [ebx + 0x40], eax
call esi
push str.SolidSetOptionString
push dword [ebx + 4]
mov dword [ebx + 0x44], eax
call esi
push str.SolidGetOptionString
push dword [ebx + 4]
mov dword [ebx + 0x48], eax
call esi
mov dword [ebx + 0x4c], eax
cmp dword [ebx + 0xc], edi
je 0x320116c6
cmp dword [ebx + 0x10], edi
je 0x320116c6
cmp dword [ebx + 0x14], edi
je 0x320116c6
cmp dword [ebx + 0x18], edi
je 0x320116c6
cmp dword [ebx + 0x1c], edi
je 0x320116c6
cmp dword [ebx + 0x20], edi
je 0x320116c6
cmp dword [ebx + 0x24], edi
je 0x320116c6
cmp dword [ebx + 0x28], edi
je 0x320116c6
cmp dword [ebx + 0x2c], edi
je 0x320116c6
cmp dword [ebx + 0x30], edi
je 0x320116c6
cmp dword [ebx + 0x34], edi
je 0x320116c6
cmp dword [ebx + 0x38], edi
je 0x320116c6
cmp dword [ebx + 0x3c], edi
je 0x320116c6
cmp dword [ebx + 0x40], edi
je 0x320116c6
cmp dword [ebx + 0x44], edi
je 0x320116c6
cmp dword [ebx + 0x48], edi
je 0x320116c6
xor ecx, ecx
inc ecx
test eax, eax
cmovne edi, ecx
mov ax, di
pop edi
pop esi
pop ebx
ret
Function at 0x3201ff18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x3201ff27
pop dword [ebp - 0x38]
mov eax, 0x9713e6aa
add eax, 0x9aee187d
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xc1942e68
sub dword [ebp - 0x48], 0x7341e91d
mov dword [ebp - 0x44], 0xe17a8f12
sub dword [ebp - 0x44], 0xaf4742cd
mov dword [ebp - 0x40], 0x467b943a
add dword [ebp - 0x40], 0x5d0aff4
mov dword [ebp - 0x3c], 0x36e4dc29
sub dword [ebp - 0x3c], 0x36e4dc29
lea eax, [ebp - 0x48]
push eax
mov eax, 0x95779025
add eax, 0x9c8d1043
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xba542b19
add dword [ebp - 0x48], 0xba1e3e3d
mov dword [ebp - 0x44], 0x289a77d6
add dword [ebp - 0x44], 0x18d1e99f
mov dword [ebp - 0x40], 0xea976227
sub dword [ebp - 0x40], 0x8727f5bb
mov dword [ebp - 0x3c], 0x7821ce7f
sub dword [ebp - 0x3c], 0x7821ce7f
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x82371258
sub eax, 0x503271f8
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x4a25b
push 0
call eax
mov ecx, 0x67bc3b4f
sub ecx, 0x67bbe609
mov esi, eax
mov edx, 0xc413d1c6
add edx, 0x6df3183a
add edx, dword [ebp - 0x38]
mov edi, 0x14ada63c
add edi, 0x636014a4
add dword [ebp - 0x1c], edx
mov ebx, dword [edx]
add dword [ebp - 4], 0xb00cb6d0
xor ebx, edi
mov dword [ebp - 0x28], 0x9d577519
mov dword [esi], ebx
add dword [ebp - 0x30], 0xa9fc4c5c
add esi, 0x7f2ee5b8
sub esi, 0x7f2ee5b4
add edx, 0x90082034
add edx, 0x6ff7dfd0
loop 0x32020049
add eax, 0x147eb
mov ebx, eax
add eax, 0x361cf1d4
add eax, 0xc9e30e31
mov ecx, 0x32000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x41c498
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x41c4a7
pop dword [ebp - 0x1c]
mov eax, 0xe729afed
add eax, 0x191814ba
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x41bce
push 0
mov eax, 0x413b829a
add eax, 0xbf074062
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x339924a4
sub ecx, 0x3398e10b
mov ebx, eax
mov esi, 0x448800
add esi, dword [ebp - 0x1c]
mov edi, 0xe86fc957
sub edi, 0xaa859b2f
sub dword [ebp - 8], 0xa23a92b8
mov edx, dword [esi]
xor dword [ebp - 8], edx
sub edx, edi
add dword [ebp - 0x10], 0x80fcc6db
mov dword [ebx], edx
add ebx, 4
add esi, 4
loop 0x41c500
add eax, 0xe75abd65
sub eax, 0xe759bc2e
mov ebx, eax
add eax, 0xd42771bb
sub eax, 0xd42771b6
mov ecx, 0x7b865ee
add ecx, 0xf8879a12
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10035bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1008ba4c]
test eax, eax
jne 0x10035c19
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035c19
push esi
push 0x16c
call fcn.10055e70
add esp, 4
test eax, eax
je 0x10035be6
mov ecx, eax
call fcn.10055e70
mov esi, eax
jmp 0x10035be8
xor esi, esi
cmp byte [0x1008ba48], 0
jne 0x10035c02
mov ecx, esi
mov dword [0x1008ba4c], esi
call fcn.1001d780
mov eax, esi
pop esi
ret
push esi
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d780
mov eax, esi
pop esi
ret

Function at 0x10035c20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1008a930]
cmp eax, 0xffffffff
je 0x10035c76
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c67
mov ecx, dword [0x1008ba4c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x1008ba4c], ecx
mov ecx, esi
call fcn.1001d7b0
mov ecx, esi
call fcn.1001d750
push 0x16c
push esi
call fcn.10055e70
add esp, 8
push 0
push dword [0x1008a930]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret