joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
clc
sbb esi, dword [edi + 0x342a892]
adc eax, 0x843a93ad
outsd dx, dword [esi]
rcl byte [edx + 0x3e]
pop ebx
jp 0x414afb
xchg ecx, eax
push ebx
insd dword es:[edi], dx
add bh, byte [ecx + ecx + 0x14abac54]
xchg edx, eax
mov dl, 0x16
lodsd eax, dword [esi]
sub byte [esi - 0x4c], dl
out dx, eax
xchg edx, eax
ljmp 0xfdbc
test dword [ebx], ebp
insd dword es:[edi], dx
lodsd eax, dword [esi]
popfd
outsb dx, byte [esi]
xchg edx, eax
push edx
push esp
lodsd eax, dword [esi]
xchg edx, eax
push edx
push esp
lodsd eax, dword [esi]
xchg edx, eax
push edx
push esp
lodsd eax, dword [esi]
xchg edx, eax
push edx
push esp
push edx
insd dword es:[edi], dx
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
xchg edx, eax
push edx
push esp
push edx
insd dword es:[edi], dx
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
xchg edx, eax
push edx
push esp
lodsd eax, dword [esi]
xchg edx, eax
push edx
push esp
lodsd eax, dword [esi]
xchg edx, eax
push edx
push esp
lodsd eax, dword [esi]
xchg edx, eax
sar dword [eax + 0x705655a9], 1
inc ecx
cmp dl, byte [eax]
push esp
movsb byte es:[edi], byte [esi]
imul ebx, dword [0x13e2ad3c], 0xead5e354
mov word [edi], gs
test al, 0xd4
out dx, eax
invalid
Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x582ac3
Capabilities:
Encode data using xor

Disassembly:
fdiv qword [edi - 0x37]
and dword [ecx + 0x30], edx
or al, 0x5f
sub ah, byte [esi]
xor al, 0xee
test eax, 0x7b468cfe
mov ah, byte [edi + ebx - 0x65]
pop edi
dec esp
adc ecx, dword [eax - 0x74894609]
les ecx, [edx + 0x79dcf9be]
inc edx
loop 0x5829ea
mov al, byte [edx - 0x6f]
mov word [ebx - 0x78], gs
lodsb al, byte cs:[esi]
dec edx
lahf
cmp byte [edi + 0x43ecd86e], ch
retf 0xf35e
add dword [ebx], ebx
fistp dword [edi + ebx*8 - 0x22]
out 0x4c, eax
mul dword [ebx - 0x69fd9439]
jae 0x582a6f
jecxz 0x582a7b
insb byte es:[edi], dx
pop esi
or ebp, dword [esi]
xchg esi, eax
adc esi, dword [ebx + 0x3ae3181b]
jnp 0x5829d9
outsd dx, dword [esi]
wait
mov ebp, 0x2a893b3b
jmp 0x582a7a
lahf
sbb ebx, dword [edi]
pop esi
retf
and al, byte [esi]
push eax
std
mov edx, 0xef74e059
int1
in al, dx
push ebx
lea edi, [ecx - 0x6c]
jns 0x582a13
dec esp
jae 0x582a46
pop esi
pop esp
ja 0x582a7d
sub edi, dword [ebx + 0x3a075232]
inc ebx
movsd dword es:[edi], dword [esi]
sub eax, dword [edi - 0x26]
dec eax
sub eax, 0xdfabfe73
xchg dword [edi - 0x2383205], ebx
push ebx
das
sahf
lahf
jns 0x582b06
imul edx, dword [ebx - 0x38], 0xbb330b6a
and eax, 0x30ff157
push edi
int1
lsl ecx, word [eax - 0x78ec46ee]
invalid
cdq
ret
enter 0xb6a, 0x33
mov ebx, 0xff15725
push edi
int1
lsl ecx, word [eax - 0x78ec46ee]
xor ebx, dword [ecx + 0x319ec8c3]
sub ebp, ebx
scasd eax, dword es:[edi]
sbb edi, dword [edx]
inc esp
lodsd eax, dword [esi]
and dword [ebp + 0x29], eax
sub esi, ebp
sub esi, ebp
fcmovnb st(0), st(1)
cli
adc eax, 0x7a016a69
je 0x582aed
pop edx
fld xword [eax]
sar byte [edx + 0x3c], 1
jp 0x582b11
fnsave dword [0x48eb60fc]
loop 0x582a80
invalid
imul ebp, dword [ecx], 0x4a
dec edx
xor al, 0x50
dec eax
mov ecx, 0xa2c2889f
aas
jnp 0x582aa5
jmp 0x582aeb
loopne 0x582ad3
push ds
fistp qword [edx]
imul ebp, dword [edi], 0xcb43e152
mov eax, ecx
movsb byte es:[edi], byte [esi]
pop edi
cmc
cmp cl, byte [ebx - 0x70]
mov ebp, 0x72fe87ea
cld
mov ch, byte [ecx - 0x9d4acd2]
stosb byte es:[edi], al
or byte [edi + 7], cl
insd dword es:[edi], dx
sub esi, dword [eax + 0x43f3d660]
ror byte [esi - 0x3f], 0x94
cld
pop eax
dec dword [ebx + 0x7489ead8]
jg 0x582b09
imul ebx, dword [ebx + 0x355cab2f], 0x6e
loopne 0x582bb7
dec ebx
dec ebp
in eax, 0xf7
lodsb al, byte [esi]
das
push eax
and al, 0x38
out dx, al
pop ebx
mov eax, dword [0xd16ffcfb]
mov ecx, dword [esi - 0x6070730e]
sti
push cs
dec ebx
dec esi
in al, 0x13
pop dword ss:[eax + 0x76]
invalid
push ss
cli
xchg ebp, eax
test al, 0x70
cmp eax, 0xeb4394e7
dec esi
ljmp 0xa757
Function at 0x5c4c97
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
test edi, edi
je 0x5c4b6b
mov eax, dword [ebp]
cmp eax, 0x270
jne 0x5c4b7b
mov ecx, dword [ebp + 4]
mov eax, 0xfffffd90
nop word cs:[eax + eax]
and ecx, 0x80000000
mov edx, dword [ebp + eax*4 + 0x9c8]
mov esi, edx
and esi, 0x7ffffffe
or esi, ecx
shr esi, 1
mov ecx, edx
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [ebp + eax*4 + 0xff8]
xor edx, esi
mov dword [ebp + eax*4 + 0x1384], edx
inc eax
jne 0x5c4b1b
mov eax, dword [ebp]
jmp 0x5c4c56
xor ecx, ecx
xor esi, esi
jmp 0x5c4c92
cmp eax, 0x4e0
jb 0x5c4c56
mov ecx, dword [ebp + 0x9c4]
xor eax, eax
nop word cs:[eax + eax]
and ecx, 0x80000000
mov edx, dword [ebp + eax*4 + 0x9c8]
mov esi, edx
and esi, 0x7ffffffe
or esi, ecx
shr esi, 1
mov ecx, edx
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [ebp + eax*4 + 0xff8]
xor edx, esi
mov dword [ebp + eax*4 + 4], edx
inc eax
cmp eax, 0xe3
jne 0x5c4b9b
mov ecx, dword [ebp + 0xd50]
mov eax, 0x80000000
and ecx, eax
xor eax, eax
nop word [eax + eax]
mov edx, dword [ebp + eax*4 + 0xd54]
mov esi, edx
and esi, 0x7ffffffe
or esi, ecx
shr esi, 1
mov ecx, edx
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [ebp + eax*4 + 4]
xor edx, esi
mov dword [ebp + eax*4 + 0x390], edx
and ecx, 0x80000000
inc eax
cmp eax, 0x18c
jne 0x5c4beb
mov eax, dword [ebp + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, ecx
shr edx, 1
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ebp + 0x634]
xor eax, edx
mov dword [ebp + 0x9c0], eax
mov dword [ebp], 0
xor eax, eax
lea ecx, [eax + 1]
mov dword [ebp], ecx
mov eax, dword [ebp + eax*4 + 4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [ebp + 0x1384]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
mov esi, 0xffffffff
xor edx, edx
mov eax, ecx
div ebx
mov edi, eax
mov edi, eax
xor edx, edx
mov eax, esi
div ebx
cmp edi, eax
mov edi, dword [esp + 4]
jb 0x5c4cb6
xor edx, edx
mov eax, esi
div ebx
cmp edx, edi
jne 0x5c4afb
xor edx, edx
mov eax, ecx
div ebx
mov eax, edx
mov edi, dword [esp]
jmp 0x5c4e2d
add eax, edi
xor eax, 0x80000000
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5c4cf3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
and ecx, 0x80000000
mov edx, dword [ebp + eax*4 + 0x9c8]
mov esi, edx
and esi, 0x7ffffffe
or esi, ecx
shr esi, 1
out dx, al
out dx, al
mov ecx, edx
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [ebp + eax*4 + 0xff8]
xor edx, esi
mov dword [ebp + eax*4 + 0x1384], edx
inc eax
jne 0x5c4cdb
mov eax, dword [ebp]
jmp 0x5c4df6
lea ecx, [eax + 1]
mov dword [ebp], ecx
mov eax, dword [ebp + eax*4 + 4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [ebp + 0x1384]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
Function at 0x758c73
Capabilities:
Encode data using xor

Disassembly:
clc
cmp cl, ah
stosd dword es:[edi], eax
paddusw mm1, qword [edx + 0x5d]
nop
jnp 0x758cc0
out 0x4b, al
add cl, byte [ebx]
push 0x8cef8474
sti
cmp eax, 0xffffffe0
xchg byte [eax - 0x22012149], ch
pop ds
invalid
jmp 0x758d00
mov bl, 0x5c
jge 0x758d1a
scasd eax, dword es:[edi]
popal
aaa
fisubr word [edi]
shl dword [0x9cc19091], 0xdc
xor al, 0xfd
invalid
enter 0x7b27, 0x30
dec eax
xchg byte [ecx - 0x62], bh
sbb ch, al
aad 0x99
mov cl, 8
and eax, 0x46097f0b
or esp, dword [ebp - 0x14]
and al, 0x50
test al, 0x33
dec edx
sti
and al, ah
retf 0xafb2
Function at 0x401000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
add ecx, edi
mov ebx, dword [eax + 0x18]
add edx, edi
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x1c]
add ecx, edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ecx
test ebx, ebx
je 0x401071
mov eax, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
add eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401060
test dl, dl
je 0x40105c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401060
add eax, 2
add ecx, 2
test dl, dl
jne 0x401040
xor eax, eax
jmp 0x401065
sbb eax, eax
or eax, 1
test eax, eax
je 0x40107a
mov edx, dword [ebp - 8]
inc esi
cmp esi, ebx
jb 0x401038
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x6e72656b
push eax
mov dword [ebp - 0x30], 0x32336c65
mov dword [ebp - 0x2c], 0x6c6c642e
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [str.UuidFromStringA]
mov esi, eax
movups xmmword [ebp - 0x54], xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x44], 0x74726956
movaps xmm0, xmmword [str.EnumSystemLocale]
push eax
mov dword [ebp - 0x40], 0x416c6175
mov dword [ebp - 0x3c], 0x636f6c6c
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x18], 0x72637052
mov dword [ebp - 0x14], 0x642e3474
mov word [ebp - 0x10], 0x6c6c
mov byte [ebp - 0xe], 0
movups xmmword [ebp - 0x68], xmm0
mov word [ebp - 0x58], 0x4173
mov byte [ebp - 0x56], 0
mov dword [ebp - 0x24], 0x74726956
mov dword [ebp - 0x20], 0x466c6175
mov dword [ebp - 0x1c], 0x656572
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea edx, [ebp - 0x54]
mov ecx, eax
call section..text
lea edx, [ebp - 0x68]
mov ecx, esi
mov ebx, eax
call section..text
lea edx, [ebp - 0x24]
mov dword [ebp - 8], eax
mov ecx, esi
call section..text
lea edx, [ebp - 0x44]
mov dword [ebp - 0xc], eax
mov ecx, esi
call section..text
push 0x40
push 0x1000
push 0x100000
push 0
call eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x40117a
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, eax
mov esi, 0x4993d8
push edi
push dword [esi]
call ebx
test eax, eax
jne 0x4011a9
add esi, 4
add edi, 0x10
cmp esi, 0x4a6f14
jl 0x401182
push eax
push dword [ebp - 4]
call dword [ebp - 8]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push dword [ebp - 4]
call dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401895
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018d4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018d4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018d4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018d4
cmp dword [ecx + 0x74], 0xe
jbe 0x4018d4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407423
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4074c0
push ebx
push esi
call fcn.004073ec
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407380
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40746d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4074bf
push edi
push eax
call fcn.00408040
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40748d
call fcn.00405ee1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4074be
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407380
add esp, 0x20
test eax, eax
jne 0x4074ac
push edi
call fcn.00405ee1
jmp 0x4074b4
push ebx
call fcn.00405ee1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4087bd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410fe8
push 0x410fe0
push str.FlsAlloc
push 0x1f
call fcn.0040867c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4087f1
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f114]
call esi
jmp 0x4087f7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40883b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410ff8
push 0x410ff0
push str.FlsGetValue
push 0x21
call fcn.0040867c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408872
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f114]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40887a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411000
push 0x410ff8
push str.FlsSetValue
push 0x22
call fcn.0040867c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4088b4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f114]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40dd10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40dd3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40dd3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4172d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x417329
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x417329
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x417318
cmp esi, edx
jae 0x417329
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x417306
cmp esi, edx
jae 0x417329
cmp word [esi], 0
je 0x417329
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x41cb60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e588
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0x4bf048
mov dword [ebp - 0x20], 0x4bf048
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x1c], 1
push 0
push 0
push esi
push 0x41cb00
push 0
mov dword [ebp - 4], 0
push 0
mov byte [ebp - 4], 1
call fcn.00465970
mov esi, eax
add esp, 0x18
xor ebx, ebx
test esi, esi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41cbe2
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x41cc44
jmp 0x41cc25
push 0x4bf048
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.00417140
int3
Function at 0x41d2b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e5f6
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x4ba070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], 0
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], 0
mov dword [ebp - 0x414], ecx
push 0
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
push ecx
push 0x14
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x418], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41d377
call fcn.004173b0
test eax, eax
js 0x41d4b9
mov eax, dword [ebx]
mov ecx, ebx
mov edi, dword [ebp - 0x414]
call dword [eax]
mov edx, edi
mov esi, 0xc
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41d3fb
add edx, 4
add eax, 4
sub esi, 4
jae 0x41d351
mov esi, dword [edi + 0x10]
add esi, 0x14
cmp esi, 0xffffffff
jae 0x41d4aa
jmp 0x41d386
cmp dword [ebp - 0x418], 0x14
jne 0x41d4b4
jmp 0x41d33e
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x41d3aa
cmp esi, 0x400
jbe 0x41d42f
push esi
lea ecx, [ebp - 0x414]
call fcn.00427550
jmp 0x41d3f1
lea ecx, [ebp - 0x410]
cmp esi, 0x400
jbe 0x41d405
cmp eax, ecx
lea ecx, [ebp - 0x414]
push esi
jne 0x41d3ec
call fcn.00427550
mov ecx, dword [ebp - 0x414]
lea eax, [ebp - 0x410]
push 0x400
push eax
mov edx, esi
call fcn.00416fc0
push eax
call fcn.00417180
add esp, 0xc
jmp 0x41d3f1
call fcn.00427520
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x41d43b
push 0x80004005
jmp 0x41d4ba
cmp eax, ecx
je 0x41d42f
push esi
push eax
mov edx, 0x400
lea ecx, [ebp - 0x410]
call fcn.00416fc0
push eax
call fcn.00417180
add esp, 0xc
lea ecx, [ebp - 0x414]
call fcn.00427510
lea eax, [ebp - 0x410]
mov dword [ebp - 0x414], eax
push dword [edi + 0x10]
add eax, 0x14
lea ecx, [ebp - 0x420]
push eax
call fcn.0041cda0
test eax, eax
js 0x41d4b9
mov edx, dword [edi + 0x10]
push ecx
mov ecx, dword [ebp - 0x414]
lea ecx, [ecx + 0x14]
call fcn.00438020
add esp, 4
mov ecx, ebx
push dword [ebp - 0x414]
call fcn.0041d810
lea eax, [ebp - 0x410]
cmp dword [ebp - 0x414], eax
je 0x41d48c
lea ecx, [ebp - 0x414]
call fcn.00427510
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045561a
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00417140
mov eax, 0x80070026
push eax
lea ecx, [ebp - 0x418]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
int3
Function at 0x422b10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ed38
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xbb8
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
neg eax
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x422b7d
movzx eax, ax
or eax, 0x80070000
test esi, esi
je 0x422c67
cmp dword [ebp - 0x10], 0x103
jne 0x422c55
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_GetThreadId]
push 0
push dword [edi + 0x34]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.00452480
mov esi, eax
mov ecx, esi
call fcn.00452220
cmp byte [0x4be580], 0
jne 0x422c0d
mov ecx, 0xf0
call fcn.00452af0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x422bff
sub esp, 8
xorps xmm0, xmm0
mov ecx, eax
movsd qword [esp], xmm0
push 0x4be580
sub esp, 0xc
push 0x1a5
push str.C:BuildAgentwork4d643bb3f4c71f96RemoteInstallerAuxiliaryServiceAuxiliaryService.cpp
push 0x20
call fcn.004522f0
jmp 0x422c01
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x4bf19c], eax
mov ecx, esi
call fcn.00452230
mov ecx, dword [0x4bf19c]
lea ecx, [ecx + 0xd0]
call fcn.00452220
mov eax, dword [0x4bf19c]
push ebx
push str.Thread__Id0x_x__terminated
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [0x4bf19c]
add esp, 0xc
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4bf19c]
lea ecx, [ecx + 0xd0]
call fcn.00452230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
lea ecx, [ebp - 0x14]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
int3