joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e33f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
jmp 0x40e399
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x40e3dd
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040e29f
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x40e3db
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x40e3df
jmp 0x40e390
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40e438
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
test al, 0x45
mov byte [ebp - 0x57], 0x43
mov byte [ebp - 0x56], 0x29
mov byte [ebp - 0x55], 0x4b
mov byte [ebp - 0x54], 0x2b
mov byte [ebp - 0x53], 0x36
mov byte [ebp - 0x52], 0x23
mov byte [ebp - 0x51], 0x79
mov byte [ebp - 0x50], 0x73
mov byte [ebp - 0x4f], 0x7a
mov byte [ebp - 0x4e], 0x42
mov byte [ebp - 0x4d], 0x4b
mov byte [ebp - 0x4c], 0x7a
mov byte [ebp - 0x4b], 0x67
mov byte [ebp - 0x4a], 0x52
mov byte [ebp - 0x49], 0x64
mov byte [ebp - 0x48], 0x71
mov byte [ebp - 0x47], 0x6c
mov byte [ebp - 0x46], 0x54
mov byte [ebp - 0x45], 0x45
mov byte [ebp - 0x44], 0x40
mov byte [ebp - 0x43], 0x3e
mov byte [ebp - 0x42], 0x23
mov byte [ebp - 0x41], 0x5a
mov byte [ebp - 0x40], 0x46
mov byte [ebp - 0x3f], 0x45
mov byte [ebp - 0x3e], 0x42
mov byte [ebp - 0x3d], 0x26
mov byte [ebp - 0x3c], 0x6b
mov byte [ebp - 0x3b], 0x28
mov byte [ebp - 0x3a], 0x46
mov byte [ebp - 0x39], 0x7a
mov byte [ebp - 0x38], 0x33
mov byte [ebp - 0x37], 0x3f
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x5e
mov byte [ebp - 0x34], 0x56
mov byte [ebp - 0x33], 0x6b
mov byte [ebp - 0x32], 0x3f
mov byte [ebp - 0x31], 0x45
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x49
mov byte [ebp - 0x2e], 0x31
mov byte [ebp - 0x2d], 0x52
mov byte [ebp - 0x2c], 0x77
mov byte [ebp - 0x2b], 0x7a
mov byte [ebp - 0x2a], 0x71
mov byte [ebp - 0x29], 0x50
mov byte [ebp - 0x28], 0x37
mov byte [ebp - 0x27], 0x78
mov byte [ebp - 0x26], 0x45
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x7d], 0xf8
cmp byte [edi], cl
xchg dword [ebx - 0x75fffffa], ecx
sbb byte [edi], 0xe5
inc eax
add bh, bh
and al, 0x85
pop eax
in eax, 0x40
add byte [edi], cl
add byte [eax], al
add byte [eax], al
sldt word [eax]
add byte [eax], al
add byte [eax], al
add byte [0], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
push cs
add byte [eax], al
add byte [eax], al
add byte [eax], al
or eax, dword [eax]
or al, 5
add eax, dword [eax]
add al, byte [esi]
add byte [eax], al
add byte [eax], al
add al, 7
add byte [eax], al
add byte [eax], al
or byte [ecx], cl
add byte [eax], al
add byte [eax], al
add dword [edx], ecx
popfd
jmp 0x40e59b
sti
invalid

Function at 0x40fde0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40fe19
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404a64
jmp 0x40fe22
mov eax, ebx
mov edx, esi
call fcn.004049c8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40fe2c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40fe4d
mov al, byte [esp]
jmp 0x40fe4f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4d1930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d1ace
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x56f58c
call fcn.00404974
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.00402da4
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.00405288
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.004419a8
lea eax, [ebp - 0x110]
mov edx, 0x4d1ae0
call fcn.00405320
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.00404c28
mov eax, dword [ebx]
call fcn.0040b458
test al, al
jne 0x4d1a33
lea eax, [ebp - 0x11c]
mov edx, dword [ebx]
call fcn.00405288
mov eax, dword [ebp - 0x11c]
call fcn.00441b1c
test al, al
jne 0x4d1a33
lea eax, [ebp - 0x109]
push eax
push 0
push 0x4d1af8
lea eax, [ebp - 0x120]
call fcn.004422f8
mov eax, dword [ebp - 0x120]
call fcn.00404e60
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, 0x56f58c
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404bf4
mov eax, ebx
mov edx, dword [0x56f58c]
call fcn.004049c8
mov eax, dword [ebx]
call fcn.0040b458
test al, al
jne 0x4d1a8f
push 0x4d1b04
push 0xa
mov ecx, dword [reloc.gdi32.dll_GetEnhMetaFilePaletteEntries]
mov dl, 1
mov eax, dword [0x41bc88]
call fcn.00421084
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d1a88
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00420d50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1a8f
mov eax, dword [ebp - 4]
call fcn.00403b24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1ad5
lea eax, [ebp - 0x120]
call fcn.00404974
lea eax, [ebp - 0x11c]
call fcn.004050b0
lea eax, [ebp - 0x118]
call fcn.00404974
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.004050c8
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x1957b6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x77d57dbd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x404ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov edx, 0xcec83ec
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x38]
push esi
sub edi, ebx
test byte [eax], 0
mov eax, dword [edi + 4]
xor ebx, ebp
insb byte es:[edi], dx
invalid

Function at 0x408db0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x36
adc byte [ebx], dh
leave
test eax, eax
bswap ebp
ror dword [ecx + 0x4d8bfc4d], 0xc
cmp ecx, 0x40
push esi
jg 0x8d40adc7
je 0x408fdb
fild word [ebx - 0x78f0f007]
add byte [ebx], al
add byte [eax], al
xor eax, dword [edx + ecx*4 - 0x6f]
adc byte [ecx + 0x24ff0040], dl
xchg ebp, eax
clc
nop
inc eax
add byte [ecx + 0x75], ah
or byte [ebx], dh
push ds
mov edi, ebp
cmp byte [ebx - 0x67ffd53], al
add ah, cl
xchg esp, eax
fdivr dword [ebx]
ret 0x2f74
mov edx, dword [ebp + 8]
lea esi, [ebp + 0x10]
push 4
push ecx
mov eax, dword [edx + 4]
push 0x10db
push 0x2b00ffff
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x25408e31
jmp 0x409065
mov esi, dword [0x4038d8]
clc
popal
test dword [eax - 0x74a1f809], eax
in eax, 0x8d
ret 0xc
Function at 0x10d1f01f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10d1b110]
jne 0x10d1f029
repz ret
jmp fcn.10d1f2ab

Function at 0x10d22e11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10d1b110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10d1f3b1
and dword [ebp - 0x14], 0
cmp dword [0x10d1e224], 0
mov dword [ebp - 0x18], eax
jne 0x10d22ec4
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10d22f6c
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10d22f6c
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10d1e224], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10d1e228], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10d1e22c], eax
call edi
push eax
call esi
mov dword [0x10d1e234], eax
test eax, eax
je 0x10d22ec4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10d1e230], eax
mov eax, dword [0x10d1e230]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x10d22f1d
cmp dword [0x10d1e234], ecx
je 0x10d22f1d
push eax
call esi
push dword [0x10d1e234]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10d22f1d
test ebx, ebx
je 0x10d22f1d
call edi
test eax, eax
je 0x10d22f14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10d22f14
test byte [ebp - 8], 1
jne 0x10d22f1d
or dword [ebp + 0x10], 0x200000
jmp 0x10d22f50
mov eax, dword [0x10d1e228]
cmp eax, dword [ebp - 0x18]
je 0x10d22f50
push eax
call esi
test eax, eax
je 0x10d22f50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10d22f50
mov eax, dword [0x10d1e22c]
cmp eax, dword [ebp - 0x18]
je 0x10d22f50
push eax
call esi
test eax, eax
je 0x10d22f50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10d1e224]
call esi
test eax, eax
je 0x10d22f6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10d22f6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10d1f01f
leave
ret
Function at 0x402992
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.00408f90
mov eax, dword [0x2e7e000]
mov ecx, dword [0x2e7cf50]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402a6f
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2e7e000], 0x959
jne 0x402a5d
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call fcn.0040279e
add edi, 8
dec ebx
jne 0x4029be
pop edi
pop ebx
pop esi
leave
ret
Function at 0x407019
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8099f0]
jne 0x407023
repz ret
jmp fcn.00408805

Function at 0x40717b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403880
and dword [ebp - 4], 0
cmp dword [0x80a8cc], 0
mov ebx, eax
jne 0x40722c
push 0x4019c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4072dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019b8
push edi
call esi
test eax, eax
je 0x4072dd
push eax
call fcn.0040380e
mov dword [esp], 0x4019a8
push edi
mov dword [0x80a8cc], eax
call esi
push eax
call fcn.0040380e
mov dword [esp], 0x401994
push edi
mov dword [0x80a8d0], eax
call esi
push eax
call fcn.0040380e
mov dword [esp], 0x401978
push edi
mov dword [0x80a8d4], eax
call esi
push eax
call fcn.0040380e
pop ecx
mov dword [0x80a8dc], eax
test eax, eax
je 0x40722c
push 0x401960
push edi
call esi
push eax
call fcn.0040380e
pop ecx
mov dword [0x80a8d8], eax
mov eax, dword [0x80a8d8]
cmp eax, ebx
je 0x407284
cmp dword [0x80a8dc], ebx
je 0x407284
push eax
call fcn.00403889
push dword [0x80a8dc]
mov esi, eax
call fcn.00403889
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407284
test edi, edi
je 0x407284
call esi
test eax, eax
je 0x40727b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40727b
test byte [ebp - 0xc], 1
jne 0x407284
or dword [ebp + 0x10], 0x200000
jmp 0x4072bd
mov eax, dword [0x80a8d0]
cmp eax, ebx
je 0x4072bd
push eax
call fcn.00403889
pop ecx
test eax, eax
je 0x4072bd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4072bd
mov eax, dword [0x80a8d4]
cmp eax, ebx
je 0x4072bd
push eax
call fcn.00403889
pop ecx
test eax, eax
je 0x4072bd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80a8cc]
call fcn.00403889
pop ecx
test eax, eax
je 0x4072dd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4072df
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x9bc6161
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xf695da6
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x43f8a1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43f8cf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43f8ed
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043f80b
jmp 0x43f8ed
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43f8ed
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043f80b
test edi, edi
mov eax, edi
jne 0x43f8d7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56a314]
test ecx, ecx
je 0x43f9a0
jmp 0x43f8a0
ret 8

Function at 0xbed1b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bed308
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbed1de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed1ca
add dl, dl
jne 0xbed1e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed23c
xor eax, eax
add dl, dl
jne 0xbed1f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed2dd
add dl, dl
jne 0xbed205
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed210
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed21b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed226
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbed232
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbed1d5
mov eax, 1
add dl, dl
jne 0xbed24a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed255
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed241
sub eax, ebx
mov ebx, 1
jne 0xbed288
mov ecx, 1
add dl, dl
jne 0xbed26e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbed279
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed265
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed1d5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbed29f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbed2aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed296
cmp eax, 0x7d00
jae 0xbed2cd
cmp eax, 0x500
jb 0xbed2c8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed1d5
cmp eax, 0x7f
ja 0xbed2d0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed1d5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbed2fe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbed1d5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445bcd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x45e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.004264b6
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x403330
push 0
push 0
call fcn.0042b40c
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x403101
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004264a8
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.00424f2e
int3
Function at 0x406800
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446118
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x54
mov eax, dword [0x45e080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x449300
mov dword [ebp - 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x406991
mov ecx, edx
mov dword [ebp - 0x3c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x4c], xmm0
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406883
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4c]
call fcn.00403110
mov byte [ebp - 4], 1
lea eax, [ebx + 8]
cmp dword [ebx + 0x1c], 7
lea ecx, [ebp - 0x4c]
push dword [ebx + 0x18]
cmova eax, dword [ebx + 8]
push eax
call fcn.00402ef0
xor ecx, ecx
movups xmm1, xmmword [eax]
movq xmm0, qword [eax + 0x10]
movups xmmword [ebp - 0x64], xmm1
mov dword [eax + 0x10], 0
movq qword [ebp - 0x54], xmm0
mov dword [eax + 0x14], 7
mov word [eax], cx
xor eax, eax
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x34], xmm1
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00404dc0
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0x19], al
cmp ecx, 7
jbe 0x40693d
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406933
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069eb
push ecx
push edx
call fcn.004264e6
add esp, 8
mov ecx, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp ecx, 7
jbe 0x406987
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40697d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069eb
push ecx
push edx
call fcn.004264e6
add esp, 8
cmp byte [ebp - 0x19], 0
mov byte [ebp - 0x19], 1
jne 0x406995
mov byte [ebp - 0x19], 0
mov ecx, dword [ebx + 0x1c]
cmp ecx, 7
jbe 0x4069cb
mov edx, dword [ebx + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4069c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069f0
push ecx
push edx
call fcn.004264e6
add esp, 8
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004264a8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042b25f
call fcn.0042b25f
int3