joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5fdb00]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [0x59f510]
push eax
call dword [0x59f024]
test eax, eax
je 0x405bb6
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [0x59f004]
test eax, eax
jne 0x405bc6
mov edx, dword [ebp - 0x18]
push edx
call dword [0x59f518]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00507bdc
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [0x59f008]
test eax, eax
jne 0x405c14
mov ecx, dword [ebp - 0x18]
push ecx
call dword [0x59f518]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00507bdc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.00507bdc
mov esp, ebp
pop ebp
ret
Function at 0x4099e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5fdb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0xe
mov esi, ecx
mov dword [ebp - 0x24], eax
mov edi, edx
call fcn.00409ada
push 0x5d0914
lea ecx, [ebp - 0x20]
mov dword [0x607c60], eax
call fcn.00405760
add esp, 8
cmp dword [eax + 0x14], 0x10
jb 0x409a20
mov eax, dword [eax]
mov edx, dword [0x607c60]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x409a28
cmp dword [ebp - 0xc], 0x10
jb 0x409a44
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00409ae5
add esp, 4
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x409a46
call fcn.004097c0
push edi
call fcn.00409950
test edi, edi
jle 0x409a7d
mov esi, dword [ebp - 0x24]
sub eax, ebx
mov ecx, ebx
sub esi, ebx
lea esp, [esp]
mov dl, byte [eax + ecx]
xor dl, byte [ecx]
inc ecx
dec edi
mov byte [esi + ecx - 1], dl
jne 0x409a70
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00507bdc
mov esp, ebp
pop ebp
ret 4

Function at 0x541440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595cf4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
mov dword [ebp - 0xfc], ecx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0xfc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 0x18]
push ecx
push 0
call fcn.0050de74
add esp, 0x18
mov edx, dword [ebp - 0xfc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0xfc]
cmp dword [edx + 0xc], 0
jne 0x5414f4
push str.cannot_create_thread
lea ecx, [ebp - 0x5c]
call fcn.00401340
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x40]
call fcn.0053ca40
push 0x5eb4c8
lea ecx, [ebp - 0x40]
push ecx
call fcn.0050b707
mov dword [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.004014a0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xfc]
cmp dword [edx + 0x14], 0
je 0x541577
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0xfc]
mov eax, dword [edx + 0xc]
push eax
call dword [0x59f400]
test eax, eax
jne 0x541577
push str.cannot_set_thread_priority
lea ecx, [ebp - 0xa8]
call fcn.00401340
mov dword [ebp - 4], 2
push 0
lea ecx, [ebp - 0xa8]
push ecx
lea ecx, [ebp - 0x8c]
call fcn.0053ca40
push 0x5eb4c8
lea edx, [ebp - 0x8c]
push edx
call fcn.0050b707
mov dword [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.004014a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x554a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59727e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
call fcn.00573ce0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.00562500
mov eax, dword [ebp - 0x44]
mov dword [eax], vtable.Poco::ActiveRunnableBase.0
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 4], vtable.Poco::ActiveRunnableBase.1.0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x44]
mov dword [edx], vtable.Poco::ActiveRunnable_class_Poco::Void__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____class_Poco::ArchiveCompressor_.1.0
mov eax, dword [ebp - 0x44]
mov dword [eax + 4], vtable.Poco::ActiveRunnable_class_Poco::Void__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____class_Poco::ArchiveCompressor_.0
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp + 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x44]
add edx, 0x14
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x15]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
push 0
push 0
mov ecx, dword [ebp - 0x38]
call fcn.004014a0
mov edx, dword [0x5cf798]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.004013b0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x44]
add ecx, 0x30
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 4
push ecx
call dword [0x59f3cc]
mov byte [ebp - 4], 4
cmp dword [ebp + 8], 0
jne 0x554b8b
push 0x4d
push str..includePoco_ActiveRunnable.h
push str.pOwner
call fcn.0054ecd0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x7e5c6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jae 0x7f16fe
cmp eax, edx
mov dword [esp], 0x987bc46
pushfd
jmp 0x7e691f
pushal
lea esp, [esp + 0x30]
jb 0x7f16fe
cmc
cmp di, bx
clc
cmp eax, dword [ebp - 0x10]
jmp 0x7e50e0
Function at 0x7e7018
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not al
lea eax, [ebp - 8]
pushfd
xchg dword [esp + 8], eax
mov al, byte [esp]
lea esp, [esp + 8]
je 0x7f1035
push dword [ebp - 4]
lea eax, [esi*8 + 0x1a7ff725]
push ebx
lahf
lahf
push 0xb
cwde
lea eax, [0x7ec39e]
push esp
call fcn.007f1807
mov word [esp], di
jmp 0x7e7715
mov byte [esp], bh
inc al
clc
cmp ebx, 0x5304b644
clc
cmp al, byte [edi]
pop eax
movzx ax, bl
lea eax, [ecx*8 - 0x24602dc7]
mov al, ch
lea edi, [edi + 1]
push 0x644046a5
mov eax, dword [esp + 0x50]
call fcn.007f01fb

Function at 0x7e7754
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x10]
je 0x7e56c0
test ebx, edx
pushfd
clc
cmp ah, 0x36
sub al, 0x30
pushal
cmp al, 9
push ebx
lea esp, [esp + 0x28]
ja 0x7e93a1
jns 0x7e9241
pushfd
mov byte [esp], 0x1d
push ebp
imul edx, edx, 0xa
clc
jmp 0x7e9598

Function at 0x7e7c79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x58]
ja 0x7f171f
sal al, 1
pushal
or al, 0x31
sub ebx, edi
or di, cx
lea esp, [esp + 0x20]
add ebx, esp
xor edi, eax
shld di, dx, 0xd

Function at 0x7e828c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rcr dx, cl
bswap si
mov esi, dword [eax + 0x3c]
sar dh, 4
add esi, eax
inc dx
rcl edx, cl
mov edx, dword [esi + 0x78]
bt eax, 0x1b
pushal
pushal
test edx, edx
pushfd
pushfd
jmp 0x7e9532

Function at 0x7e8ba4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], 0xc5
sub ebx, edi
bsr di, dx
pop edi
pushfd
sub esp, 0xfffffff8
add ebx, esp
sal di, 3
shld di, dx, cl
mov edi, ebx
sbb al, 0xd6
push edx
mov al, 0x2e
pushal
repne scasb al, byte es:[edi]
call fcn.007f16e1
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x7e8c3b
popal
je 0x7e8c3e
inc esp
imul esp, dword [ecx + 0x6c], 0x6e49676f
imul esi, dword fs:[edx + 0x65], 0x61507463
jb 0x7e8c4c
insd dword es:[edi], dx
inc ecx
add byte [eax], al
add byte [ecx + 0x6d], cl
insd dword es:[edi], dx
push edx
insb byte es:[edi], dx
popal
jae 0x7e8c5f
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x7e8c64
js 0x7e8c75
add byte [eax - 0x17], ah
leave
invalid
inc ecx
inc ebx
inc ebx
insb byte es:[edi], dx
insb byte es:[edi], dx
invalid
Function at 0x7e8ebb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
bt cx, 6
movzx ecx, word [edi + ecx*2]
lea edi, [eax*4 + 0x1140d4f6]
dec di
shr di, cl
mov edi, dword [edx + 0x1c]
clc
add edi, eax
jmp 0x7ea9bc
mov byte [esp], 0xfb
add edi, eax
jmp 0x7e86b0
call 0x7e4344
add byte [eax], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x7eaa2d
push eax
jb 0x7eaa34
outsb dx, byte [esi]
je 0x7eaa33
jb 0x7ea9d0
add byte [eax], al
push ebx
dec eax
inc edi
je 0x7eaa1c
jae 0x7eaa46
je 0x7eaa4c
jo 0x7eaa25
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x7ea9e5
add byte [eax], al
inc ebx
jb 0x7eaa4f
popal
je 0x7eaa52
dec eax
popal
je 0x7eaa54
push 0x73757242
jne 0x7eaa69
push 0x43000000
push 0x70557261
jo 0x7eaa67
jo 0x7eaa71
jb 0x7eaa45
jb 0x7eaa45
add byte [ecx], ch
mov al, 0x54
mov edi, 0x465aa742
test eax, 0xafd2b08c
cdq
jge 0x7ea9f4
jl 0x7ea9ff
invalid
les edi, [eax]
daa
or byte [edx - 0x3c], bl
sub dword [0xf507b5ff], 0xb6f8cb1a
mul cl
add byte ds:[edx], ah
mov ch, 7
cmc
sbb cl, bl
clc
mov dh, 0xf6
loope 0x7eaa6d
add byte [edx], ah
push ebp
and edx, ecx
shr dword [edi + ecx + 0x74], 1
je 0x7eaa68
insb byte es:[edi], dx
pcmpeqb mm6, qword [edi + ebp + 0x4a]
dec edx
add al, 0x59
daa
salc
cmp dword [esi], esp
mov eax, dword [0xb20f076e]
outsd dx, dword [esi]
sbb edi, eax
xchg dword [edi - 6], ecx
xchg eax, esi
add al, 0x93
invalid
adc byte [ebx], cl
pop ecx
adc al, byte [eax]
insb byte es:[edi], dx
lodsb al, byte [esi]
cmp ch, al
test al, 0x64
std
scasd eax, dword es:[edi]
insb byte es:[edi], dx
xchg ecx, eax
xor byte [ebp + 0x10], ah
mov ah, 0xc9
xchg edi, eax
and dword [edi], 0xffffffc3
test byte [esi], ah
lodsd eax, dword es:[esi]
lodsd eax, dword [esi]
invalid
adc esi, dword [edx - 0x29285594]
xlatb
salc
dec esi
pop eax
or al, al
jp 0x7eaa76
sar byte [edx - 3], 0xa0
add bl, byte [0x8a9eb387]
mov ch, 0x9f
or esi, dword [eax + 0x7c66c7e2]
cmpsb byte [esi], byte es:[edi]
push 0xf6d10443
sbb dword [ebx + 0x6c00006b], eax
jae 0x7eab0a
mov al, byte [0xb3871d02]
sahf
mov dh, byte [ebp - 0x1d4ff461]
invalid
jb 0x7eab04
outsb dx, byte gs:[esi]
push edi
add byte [eax], al
add byte [ebp + 0x61], cl
jo 0x7eaaf9
imul ebp, dword [esi + 0x64], 0x6f50776f
imul ebp, dword [esi + 0x74], 0xe8540073
push esp
call 0x7e7f51
add byte [eax], al
inc edi
je 0x7eab0d
mov dword [esp + 4], eax
mov eax, eax
inc edx
cmpsd dword [esi], dword es:[edi]
adc eax, 0x6742e581
in eax, 0x42
push ebx
Function at 0x7ea595
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
repne scasb al, byte es:[edi]
jmp 0x7f1350
jmp 0x7e7d67
rol al, 7
mov al, 0x2e
pushal
jmp 0x7e9bd9

Function at 0x7eaaae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, edi
pushfd
lea esp, [esp + 0x38]
je 0x7f16f0
pushal
mov word [esp], di
bt ax, 0xc
jmp 0x7e6c53
push esp
call 0x7e7f51
add byte [eax], al
inc edi
je 0x7eab0d
arpl word [edx + 0x6f], si
insb byte es:[edi], dx
insb byte es:[edi], dx
push eax
outsd dx, dword [esi]
jae 0x7eaac3
add byte [eax], al
dec ecx
outsb dx, byte [esi]
imul esi, dword [ebx + eax*2 + 0x6f], 0x6e6f6d6d
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x7eab46
outsd dx, dword [esi]
insb byte es:[edi], dx
jae 0x7eab1d
js 0x7eaada
xor al, al
stc
repne scasb al, byte es:[edi]
pushfd
pushfd
jmp 0x7f1335
and edi, esp
stosb byte es:[edi], al
inc ebp
mov word [esp + 4], ax
jmp 0x7e9e96
push ebx
pop ecx
jnp 0x7eab2a
std
test eax, 0xdb6c2e8b
push edi
pop ebp
xchg ebx, eax
xchg esi, eax
xor byte [edx - 0x4c7db962], bh
mov edx, 0xb382469e
mov esi, dword [ecx + 0x38]
pop bx
cmp eax, 0xb6516ed7
mov eax, dword [0x5b303693]
cli
push ecx
mov dh, 0xa1
xchg ebx, eax
xor byte ss:[ebx - 6], bl
push edx
jge 0x7eab6d
dec esp
pop es
mov dl, 0xd6
sahf
pop esi
fdivr st(3)
salc
add ah, ch
cwde
jge 0x7eaaf4
push ss
leave
lahf
lahf
les edi, [eax]
iretd
or byte [edi], cl
xchg byte [ebx - 0x63000034], dh
lea esp, [esp + 0xc]
jne 0x7f16f0
bsr cx, ax
stc
btc si, 4
mov ecx, edi
call fcn.007e42c0
lea esp, [esp + 0x44]
jne 0x7e93a1
push esp
cwde
setnp al
pop eax
mov byte [edi - 1], 0
mov eax, ecx
push edx
lahf
mov dword [esp], ebx
call fcn.007e7f89
add byte [eax], al
inc edi
je 0x7f13c6
imul edi, dword [eax + 0x65], 0x6c
inc edi
je 0x7f13c4
insb byte es:[edi], dx
imul esp, dword [ebp + 0x6e], 0x63655274
je fcn.007f138b
mov edx, 0x859c05e3
sar bh, 0x34
and al, 0x60
Function at 0x7ec4fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
jne 0x7f16f0
cmc
call fcn.007e5c6f
add byte [eax], al
inc esi
imul ebp, dword [esi + 0x64], 0x73726946
je 0x7ec556
imul ebp, dword [ebp + 0x41], 0x54000000
jb 0x7ec57b
outsb dx, byte [esi]
jae 0x7ec589
popal
je 0x7ec585
dec ebp
jae 0x7ec597
popal
add byte gs:[bx + si], al
add byte [edi + 0x64], al
imul esi, dword [eax + 0x47], 0x6d497465
popal
push eax
popal
insb byte es:[edi], dx
je 0x7ec5b0
push ebx
imul edi, dword [edx + 0x65], 0x4c79c00
and al, 0xea
loope 0x7ec54c
fisub word [eax - 0x17]
aas
into
invalid
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x7ec5c0
add byte [eax], al
add byte [edi + 0x65], al
je 0x7ec5af
outsb dx, byte gs:[esi]
jne 0x7ec5b9
je 0x7ec5c9
je 0x7ec5cf
add byte [edi + 0x49], dl
dec esi
push ebx
push eax
dec edi
dec edi
dec esp
inc esp
push edx
push esi
add byte [eax], al
add byte [ebx + 0x72], al
popal
jb 0x7ec5e2
popal
je 0x7ec5e5
inc esp
dec ecx
inc edx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [eax], al
add byte [edi + 0x64], al
imul esi, dword [eax + 0x43], 0x656e6f6c
dec ecx
insd dword es:[edi], dx
popal
add byte gs:[bp - 8], dl
jae 0x7f13a8
aad 0x6f
btr ax, ax
push edi
test si, cx
aad 0x22
and ah, byte [esi - 0x3f]
rol byte [edi], 0x53
rol ax, 7
push ebx
btc eax, 0x1a
and al, bl
bsf ax, dx
push edx
test di, sp
not al
shr ax, 0xe
bswap eax
mov eax, dword [ebp + 8]
stc
jge 0x7e925d
jmp fcn.007e912a
inc ebx
outsd dx, dword [esi]
push eax
popal
add byte gs:[di + 0x2464], cl
lea esp, [esp + 0x48]
jb 0x7f16fe
pushfd
test bx, 0xae81
cmp eax, dword [ebp - 0x10]
pushal
lea esp, [esp + 0x24]
jae 0x7f16fe
cmc
xadd di, bx
bsr bx, si
neg bh
mov ebx, eax
shrd ecx, eax, cl
setl ch
movzx cx, bl
sal di, cl
mov edi, eax
shld cx, bx, 8
test bx, 0xa283
mov ecx, 0x104
bt dx, ax
xor al, al
cmp cx, 0x761c
cmc
repne scasb al, byte es:[edi]
jmp 0x7e9310
mov eax, 0x31914bad
Function at 0x7ee32c
Capabilities:
Authenticate hmac

Disassembly:
clc
sub al, al
push 0x57613b42
pushfd
jmp 0x7f0bad
add ch, dh
jmp 0x7e98dd
inc edx
popal
jb 0x7ee305
add byte [eax], al
inc ebx
outsd dx, dword [esi]
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654d7265
jae 0x7ee388
popal
inc esi
imul ebp, dword [esp + esi*2 + 0x65], 0x72
inc edi
je 0x7ee367
imul eax, dword [ebx + 0x6f], 0x6c
outsd dx, dword [esi]
jb fcn.007ee32c
call fcn.007efc65
ja 0x7ee2f0
push edi
clc
inc edx
cmpsd dword [esi], dword es:[edi]
fadd qword [eax]
arpl word [esi - 0x690d7156], ax
jns 0x7ee334
xlatb
mov ah, 0x36
fdivr qword [ecx + esi*2]
add byte [edx + 0x2b4ddaeb], ah
in eax, 0x6c
xlatb
lcall 0x9be2, 0xaded7147
mov eax, 0x4fed42dd
int1
das
pop ebp
xor bl, byte [edx - 0x1b]
or ebp, eax
test eax, 0xe38859b0
mov bl, ah
mov esi, dword [edi - 0x8b2a0cb]
xor eax, 0xc13d0a9c
loope 0x7ee301
inc ebx
mov ebp, 0xc41ea47a
test byte [eax], al
and bh, byte [esi]
push ds
lcall 0x4872, 0x901ebb14
dec eax
xor al, 0xb6
and al, bl
adc ch, byte [edx + 0x32f7bd34]
cmpsb byte [esi], byte es:[edi]
arpl di, cx
and ch, bh
call 0x3d1da20
lcall 0x907f, 0x871b945a
aaa
and ebx, eax
dec edx
stc
std
pop edx
push edx
in eax, 0xc2
jb 0x7ee419
adc dword [ecx + edx*4 + 0x59ba944], ebp
mov cl, 0x9b
xchg dword [ebx - 0x2e928a22], esi
xchg esi, eax
pop esp
adc esi, dword [ecx + 0x1b2270db]
mov al, 0xf8
inc edx
cmpsd dword [esi], dword es:[edi]
invalid
rcl byte [edi - 0x3f]
retf
repne scasb al, byte es:[edi]
call fcn.007e97ed

Function at 0x7f12c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x7e56c0
cmp dl, 0x40
sub al, 0x30
cmc
cmc
cmp al, 9
call fcn.007eff01
add byte [eax], al
inc ebx
jb 0x7f1342
popal
je 0x7f1345
push edx
arpl word gs:[edx + edx*2 + 0x67], si
outsb dx, byte [esi]
add byte [eax], al
add byte [esi + 0x69], dl
jb 0x7f1362
jne 0x7f1351
insb byte es:[edi], dx
push ecx
jne 0x7f1359
jb 0x7f136f
add byte [ebp + 0xf4c2464], cl
test byte [edi - 0x160000bd], bh
or eax, 0xffff5d
add byte [edi + 0x61], dl
imul esi, dword [ebp + ecx*2 + 0x65], 0x67617373
add byte gs:[eax], al
add byte [esp + ebp*2 + 0x73], dl
inc edi
je 0x7f1373
popal
insb byte es:[edi], dx
jne 0x7f1386
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x7f136c
dec ecx
inc edx
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x7f1384
popal
bound ebp, qword [ebp]
enter 0x66f9, 0xf
mov edx, 0xf98904fe
btc esi, 4
and al, 0x44
call dword [eax + ebx*4 + 0xf]
wait
rcr byte [eax - 0x3a], 0x47
inc dword [eax]
sbb dword [edi + edi*8 - 1], ebp
inc dword [eax]
add byte [edi + 0x65], al
je 0x7f13c6
outsb dx, byte [esi]
je 0x7f13d9
push edx
arpl word gs:[eax + eax + 0x29], si
fistp dword [edi + 0x71e89c58]
outsb dx, byte [esi]
invalid
je 0x7f1428
outsb dx, byte gs:[esi]
jne 0x7f1428
je 0x7f1446
insd dword es:[edi], dx
dec ecx
inc esp
add ch, dh
pop esi
ret 0xda5e
pop esi
fstp dword [esi - 0x26]
pop esi
mov ss, word [edx - 0x2b]
pop esi
rcr byte [esi - 0x72], 0x52
retf 0xd65e
Function at 0x7f3972
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not dx
movsx edx, dl
rol dx, 0xb
movzx eax, al
rcr dx, cl
bts dx, 0xb
mov edx, dword [eax*4 + 0x7f2326]
call fcn.007f206f
Function at 0x401090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4010e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4010e0
lea ebx, [ebx]
cmp esi, eax
jae 0x4010e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010d0
cmp esi, eax
jb 0x4010ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401b10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 0xc]
mov dword [esi], eax
call fcn.004012e0
mov eax, dword [eax]
test eax, eax
je 0x401b31
mov eax, dword [eax]
jmp 0x401b33
xor eax, eax
lea ecx, [esi + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, dword [esp + 8]
test edi, edi
mov dword [esi + 4], eax
je 0x401b81
lea edx, [edi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x401b81
test edi, edi
je 0x401b81
mov eax, dword [edi]
test eax, eax
je 0x401b68
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x401b78
push eax
call fcn.004041c4
add esp, 4
push edi
call fcn.00403fc2
add esp, 4
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x401b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x411030
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x416120]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
push 0x41234c
push 0x81
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x401c07
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 0x3ff
push 0x4177f0
push 0x400
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x401bcf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x401bcf
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
jne 0x401c62
push 0x3ff
push str.Unable_to_Lock_Assembly_for_Decryption
push 0x4177f0
call fcn.0040412a
add esp, 0xc
mov byte [0x417bef], bl
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
lea ecx, [esp + 0x1c]
call fcn.00403370
mov eax, dword [0x4177e8]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x18], ebx
call fcn.004012e0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 1
call fcn.00403450
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00401940
cmp edi, ebx
jne 0x401cb2
mov eax, dword [esp + 0x1c]
push eax
jmp 0x401d22
push esi
push ebx
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov esi, eax
cmp esi, ebx
je 0x401d1d
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jge 0x401cdd
push str.Unable_to_Access_SafeArray_Data
jmp 0x401d22
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push edi
push eax
call fcn.00404720
add esp, 0xc
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00402ca0
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push 0x4122cc
mov ecx, 0x4177f0
call fcn.00401180
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00402ca0
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x40383e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x416120]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040377d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00405740
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40388d
cmp dword [ebp - 0x1c], 5
jb 0x4038a5
jmp 0x4038a1
cmp dword [ebp - 0x10], 1
jne 0x4038a5
cmp dword [ebp - 0x1c], 4
ja 0x4038a1
jne 0x4038a5
cmp dword [ebp - 0x18], 0
jbe 0x4038a5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x412628
call fcn.00403630
test eax, eax
jge 0x4038c6
mov byte [0x417bf4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004046f5
add ebp, 0x78
leave
ret

Function at 0x4046f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416120]
jne 0x4046ff
repz ret
jmp fcn.00407ccc