joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482454
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
mov eax, dword [ebp - 8]
call fcn.004058ec
mov eax, dword [ebp - 0xc]
call fcn.004058ec
mov eax, dword [ebp + 8]
call fcn.004058ec
xor eax, eax
push ebp
push 0x482557
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x420e38]
call fcn.00420f7c
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, 0x482570
call fcn.00405894
jne 0x4824bf
mov esi, 0x80000002
mov eax, dword [ebp - 4]
mov edx, 0x48257c
call fcn.00405894
jne 0x4824d3
mov esi, 0x80000001
mov eax, dword [ebp - 8]
mov edx, 0x48257c
call fcn.00405894
jne 0x4824ef
lea eax, [ebp - 0x10]
mov edx, 0x482588
call fcn.00405504
mov eax, dword [ebp - 8]
mov edx, 0x482570
call fcn.00405894
jne 0x48250b
lea eax, [ebp - 0x10]
mov edx, 0x482588
call fcn.00405504
mov edx, esi
mov eax, ebx
call fcn.00421014
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00421158
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0042187c
mov eax, ebx
call fcn.00404640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48255e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405490
lea eax, [ebp + 8]
call fcn.0040546c
ret

Function at 0x4825b8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x482675
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x482650
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x420e38]
call fcn.00420f7c
mov ebx, eax
mov esi, 0x80000001
lea eax, [ebp - 8]
mov edx, 0x482690
call fcn.00405504
mov edx, esi
mov eax, ebx
call fcn.00421014
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00421158
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00421ad8
test al, al
je 0x48263b
mov byte [ebp - 9], 1
jmp 0x48263f
mov byte [ebp - 9], 0
mov eax, ebx
call fcn.00404640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48265a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48267c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405490
ret

Function at 0x488b54
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x488b97
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488b9e
lea eax, [ebp - 4]
call fcn.0040546c
ret
Function at 0x4891f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x489277
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403aac
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0x500
mov eax, dword [ebp - 4]
call fcn.004058fc
mov dword [ebp - 0x30], eax
mov eax, 0x489284
mov dword [ebp - 0x34], eax
mov eax, 0x48928c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48927e
lea eax, [ebp - 4]
call fcn.0040546c
ret

Function at 0x489398
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x489420
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403aac
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x489438
mov edx, dword [ebp - 4]
call fcn.00405784
mov eax, dword [ebp - 0x28]
call fcn.004058fc
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x54
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperation
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489427
lea eax, [ebp - 0x28]
call fcn.0040546c
lea eax, [ebp - 4]
call fcn.0040546c
ret
Function at 0x489450
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1a0], edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x19c], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48959a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405664
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x489499
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x19c]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405964
mov eax, dword [ebp - 0x19c]
mov edx, 0x4895b4
call fcn.00405894
jne 0x4894db
mov eax, dword [ebp - 4]
test eax, eax
je 0x4894cd
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 4]
mov ecx, 1
xchg edx, eax
call fcn.004059a4
lea eax, [ebp - 0x1a4]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405964
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x1a0]
call fcn.00409754
mov eax, dword [ebp - 0x1a0]
mov edx, 0x4895c0
call fcn.00405894
jne 0x489533
lea eax, [ebp - 4]
mov ecx, 7
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 4]
call fcn.004058fc
mov esi, eax
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, 0x4895c8
mov dword [ebp - 8], eax
push esi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x489574
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x489568
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov dword [ebp - 8], eax
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x48955d
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4895a1
lea eax, [ebp - 0x1a4]
mov edx, 3
call fcn.00405490
lea eax, [ebp - 4]
call fcn.0040546c
ret

Function at 0x489aa0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
mov eax, dword [ebp - 8]
call fcn.004058ec
xor eax, eax
push ebp
push 0x489b4f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x489b2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a1e4
test al, al
je 0x489af2
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_DeleteFileA
mov dl, 1
mov eax, dword [0x4177d0]
call fcn.00404610
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489b34
mov eax, dword [ebp - 0xc]
call fcn.00404640
ret
Function at 0x489d98
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489ee4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040546c
mov eax, 0x320
call fcn.00402ef0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x489dee
mov eax, 0x489efc
call fcn.0047294c
lea eax, [ebp - 0x10]
push eax
push 0x320
mov eax, dword [ebp - 0xc]
push eax
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x489e14
mov eax, 0x489f1c
call fcn.0047294c
mov eax, 0xff
call fcn.00402ef0
mov ebx, eax
mov eax, 0xff
call fcn.00402ef0
mov esi, eax
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x489eb3
inc edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405664
push dword [ebp - 0x24]
push 0x489f40
lea eax, [ebp - 0x28]
mov edx, esi
call fcn.00405664
push dword [ebp - 0x28]
push 0x489f4c
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00405800
inc dword [ebp - 0x14]
dec edi
jne 0x489e3e
mov eax, ebx
call fcn.00402f0c
mov eax, esi
call fcn.00402f0c
mov eax, dword [ebp - 0xc]
call fcn.00402f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489eeb
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405490
ret

Function at 0x489f50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48a010
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDList
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040aa8c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x489fac
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405964
mov eax, dword [ebp - 0x114]
mov edx, 0x48a028
call fcn.00405894
je 0x489fe5
mov eax, esi
mov ecx, 0x48a028
mov edx, dword [ebp - 4]
call fcn.00405784
jmp 0x489fef
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004054c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a017
lea eax, [ebp - 0x114]
call fcn.0040546c
lea eax, [ebp - 4]
call fcn.0040546c
ret
Function at 0x48a16c
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x48a277
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x320
call fcn.00402ef0
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x48a1b0
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 8]
push eax
push 0x320
push edi
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x48a1d0
push 1
call sub.kernel32.dll_Sleep
mov eax, 0xff
call fcn.00402ef0
mov ebx, eax
mov eax, 0xff
call fcn.00402ef0
mov dword [ebp - 0x10], eax
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x48a24b
inc esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0xff
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
lea eax, [edi + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00405664
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.0048a02c
inc dword [ebp - 0xc]
dec esi
jne 0x48a1f8
mov eax, ebx
call fcn.00402f0c
mov eax, dword [ebp - 0x10]
call fcn.00402f0c
mov eax, edi
call fcn.00402f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a27e
lea eax, [ebp - 0x20]
call fcn.0040546c
ret

Function at 0x48beb0
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x48bedc
mov edx, ebx
lea eax, [esp + 4]
call fcn.0048be9c
jmp 0x48bee3
mov eax, ebx
call fcn.0040546c
add esp, 0x104
pop ebx
ret

Function at 0x48beec
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48bf18
mov edx, ebx
lea eax, [esp + 4]
call fcn.0048be9c
jmp 0x48bf1f
mov eax, ebx
call fcn.0040546c
add esp, 0x104
pop ebx
ret

Function at 0x48bf28
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push 5
lea eax, [esp + 4]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA
cmp eax, 3
sete al
test al, al
je 0x48bf54
mov eax, ebx
mov edx, esp
call fcn.00405664
pop ecx
pop edx
pop ebx
ret

Function at 0x48c8a8
Capabilities:
Identify system language via api

Disassembly:
push ebx
add esp, 0xffffff98
mov ebx, eax
call sub.kernel32.dll_GetUserDefaultLangID
push 0x64
lea edx, [esp + 4]
push edx
movzx eax, ax
push eax
call sub.kernel32.dll_VerLanguageNameA
mov eax, ebx
mov edx, esp
mov ecx, 0x65
call fcn.004056dc
add esp, 0x68
pop ebx
ret
Function at 0x48cf50
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48d056
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48d01c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x28]
call fcn.0048ba34
push dword [ebp - 0x28]
push 0x48d06c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x34]
call fcn.0048ba34
push dword [ebp - 0x34]
push 0x48d078
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x38]
call fcn.0048ba34
push dword [ebp - 0x38]
push 0x48d084
mov eax, dword [ebp - 4]
mov edx, 6
call fcn.00405800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d033
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d05d
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00405490
lea eax, [ebp - 0x28]
call fcn.0040546c
ret

Function at 0x48d098
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x48d129
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xa
push ebx
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
lea edx, [ebp - 8]
mov ecx, ebx
xchg edx, eax
call fcn.0040555c
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004054c0
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d130
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405490
ret
Function at 0x4b3350
Capabilities:
Copy file
Create process on windows
Create thread
Packed with generic packer
Terminate process

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x79000]
mov dword [edi + 0x8f7b0], 0xf35bcc7
push edi
or ebp, 0xffffffff
jmp 0x4b337a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b3381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b3370
mov eax, 1
add ebx, ebx
jne 0x4b3393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b33a4
jne 0x4b33c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b33c3
dec eax
add ebx, ebx
jne 0x4b33b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b3388
add ebx, ebx
jne 0x4b33bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b3415
xor ecx, ecx
sub eax, 3
jb 0x4b33db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b344a
sar eax, 1
mov ebp, eax
jmp 0x4b33e6
add ebx, ebx
jne 0x4b33e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b33b4
inc ecx
add ebx, ebx
jne 0x4b33f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b33b4
add ebx, ebx
jne 0x4b3401
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b33f6
jne 0x4b3412
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b33f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b3434
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b3426
jmp 0x4b3376
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b3434
add edi, ecx
jmp 0x4b3376
pop esi
mov edi, esi
mov ecx, 0x4cef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b3452
cmp byte [edi], 0x1f
jne 0x4b3452
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b3457
lea edi, [esi + 0xaf000]
mov eax, dword [edi]
or eax, eax
je 0x4b34c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb31d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb33c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b3484
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb33cc]
or eax, eax
je 0x4b34c0
mov dword [ebx], eax
add ebx, 4
jmp 0x4b34a1
call dword [esi + 0xb33dc]
mov ebp, dword [esi + 0xb33d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b34fa
sub esp, 0xffffff80
jmp fcn.0048e85c
Function at 0x100cb0f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
push dword [ebp + 0xc]
push 8
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub eax, dword [ebp + 0xc]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop ebp
ret 8

Function at 0x100cb118
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
lea eax, [ebp + 8]
push 1
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x100cb139
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
lea eax, [ebp + 8]
push 1
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x100cb15a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
lea eax, [ebp + 8]
push 1
push 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x100cb17b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
lea eax, [ebp + 8]
push 1
push 8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
inc eax
pop ebp
ret 8

Function at 0x100cb205
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
push dword [ebp + 0xc]
push 8
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub eax, dword [ebp + 0xc]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop ebp
ret 8

Function at 0x100cc695
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100cc6a4
pop dword [ebp - 0x20]
mov eax, 0x93a473c2
add eax, 0x7c6852e2
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x7ec3a
push 0
mov eax, 0xbf20cca1
sub eax, 0xaf122a6d
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x455a778a
sub ecx, 0x455a2cd4
mov edi, eax
mov esi, 0xb9bf4e1c
sub esi, 0xa9a66a1c
add esi, dword [ebp - 0x20]
mov ebx, 0x6d0ab488
sub ebx, 0x68ce2e7b
add dword [ebp - 0x14], esi
mov edx, dword [esi]
xor dword [ebp - 0x18], edx
add edx, ebx
xor dword [ebp - 0x18], edi
mov dword [edi], edx
add edi, 0x31b9fc73
add edi, 0xce460391
add esi, 0x71e288fa
sub esi, 0x71e288f6
loop 0x100cc703
add eax, 0x9b582595
add eax, 0x64a8f816
mov ebx, eax
add eax, 0x3c3fc98e
add eax, 0xc3c03677
mov ecx, sym.fpsrvutl.dll_Ordinal_2028
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x100d41dd
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x100e9902
call fcn.1000131b
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
push 1
xor ebx, ebx
push ebx
push ebx
call sym.fpsrvutl.dll_Ordinal_116
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [esi + 0x50], eax
mov al, byte [ebp + 0xc]
push ebx
mov byte [esi + 0x54], al
mov al, byte [ebp + 0x14]
push ebx
push 8
mov dword [esi], vtable.SMP_HEAP.0
mov byte [esi + 0x55], 1
mov byte [esi + 0x56], al
mov word [esi + 0x34], bx
call fcn.100d1f77
push ebx
push ebx
push 0x14
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.100d1f77
push ebx
push ebx
push 8
mov ecx, esi
mov dword [esi + 0x3c], eax
call fcn.100d1f77
push ebx
push ebx
push 0xc
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
call fcn.100d1f77
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x48], eax
test ecx, ecx
je 0x100d42a9
cmp dword [esi + 0x3c], ebx
je 0x100d42a9
cmp dword [esi + 0x40], ebx
je 0x100d42a9
test eax, eax
je 0x100d42a9
mov dword [ecx + 4], ebx
mov dword [ecx], ebx
mov eax, dword [esi + 0x40]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov edi, dword [esi + 0x48]
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
setne cl
mov byte [edi], cl
je 0x100d42b3
cmp eax, 0x40000000
jge 0x100d42b3
lea eax, [eax*4 + 0xe10]
mov dword [edi + 8], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x34], 1
mov eax, esi
call fcn.100013b7
ret 0x14
mov ecx, str.No_TLS_available
call sym.fpsrvutl.dll_Ordinal_116
int3

Function at 0x100d4799
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x100d47d3
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d47c1
lea ecx, [eax + 8]
mov eax, dword [ecx]
pop esi
mov eax, dword [eax + 0xc]
pop ebp
jmp eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100d1e75
jmp 0x100d47d5
xor al, al
pop esi
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx