joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e3a90
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100af144
mov eax, dword [0x10260540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10265be8]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x101e3c7b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x101e3bc6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x101e3bc6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x101e3ba2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x101e3b19
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101e3c34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x101e3c9b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x101e3c76
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x101e3c9b
jmp 0x101e3af2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b098b
mov esp, ebp
pop ebp
ret
Function at 0x404f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x438064]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x404f67
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x404f6e
mov al, 1
jmp 0x405042
call fcn.00406c90
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00406c90
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00406cc0
add esp, 8
movzx eax, al
test eax, eax
je 0x404faa
xor al, al
jmp 0x405042
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.004087f0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x404fe6
cmp dword [ebp - 0x30], 1
je 0x404fed
cmp dword [ebp - 0x30], 3
je 0x40503c
jmp 0x405040
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x40501c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.004104f0
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x40501c
xor al, al
jmp 0x405042
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x405030
mov dword [ebp - 0x38], 1
jmp 0x405037
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x405042
mov al, 1
jmp 0x405042
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a84b
mov esp, ebp
pop ebp
ret
Function at 0x4075c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x438064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.00406c90
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.00406cc0
add esp, 8
movzx edx, al
test edx, edx
je 0x407605
lea eax, [ebp + 8]
push eax
call fcn.00407470
add esp, 4
jmp 0x407786
mov ecx, dword [ebp - 0x2c]
call fcn.00407950
test eax, eax
je 0x407647
mov ecx, dword [ebp - 0x2c]
call fcn.00407950
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.00406ca0
cmp esi, eax
jae 0x407647
lea ecx, [ebp + 8]
push ecx
call fcn.00408460
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.00405cc0
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x407786
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x40765a
call fcn.00406c90
jmp 0x407786
mov ecx, dword [ebp - 0x2c]
call fcn.00405d10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x4076a9
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.00408460
add esp, 4
movzx ecx, al
push ecx
call fcn.00401c60
add esp, 8
movzx edx, al
test edx, edx
je 0x407699
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x4076a1
call fcn.00406c90
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x407786
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.00408460
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.00407580
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x407781
cmp dword [ebp - 0x34], 1
jle 0x407704
cmp dword [ebp - 0x34], 3
je 0x407751
jmp 0x407781
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x407736
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.004104f0
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x407736
call fcn.00406c90
jmp 0x407786
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x40774a
mov eax, dword [ebp + 8]
jmp 0x407786
call fcn.00406c90
jmp 0x407786
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.00401c60
add esp, 8
movzx eax, al
test eax, eax
je 0x407774
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x40777c
call fcn.00406c90
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x407786
call fcn.00406c90
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a84b
mov esp, ebp
pop ebp
ret 4
Function at 0x408900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x408a26
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x408938
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00408a40
jmp 0x408a3a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.00405380
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x4089cc
jg 0x408960
cmp dword [ebp + 0xc], 0
jbe 0x4089cc
cmp dword [ebp - 8], 0
jl 0x4089cc
jg 0x40896e
cmp dword [ebp - 0xc], 0
jbe 0x4089cc
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x40898c
jl 0x408980
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x40898c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.00407050
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004068f0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00406f40
cmp dword [ebp + 0x10], 0
jl 0x408a16
jg 0x4089da
cmp dword [ebp + 0xc], 0
jbe 0x408a16
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x408a16
mov ecx, dword [ebp - 4]
call fcn.00405d10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040fe5c
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x408a3a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00408a40
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x408c7e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x408b98
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00408ca0
jmp 0x408c92
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.00405c90
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x408c2c
jg 0x408bc0
cmp dword [ebp + 0xc], 0
jbe 0x408c2c
cmp dword [ebp - 8], 0
jl 0x408c2c
jg 0x408bce
cmp dword [ebp - 0xc], 0
jbe 0x408c2c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x408bec
jl 0x408be0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x408bec
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00407950
push eax
call fcn.004068f0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00407910
cmp dword [ebp + 0x10], 0
jl 0x408c6e
jg 0x408c3a
cmp dword [ebp + 0xc], 0
jbe 0x408c6e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x408c6e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004104f0
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x408c92
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00408ca0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418d7b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418bfa

Function at 0x41f3af
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f06f
Function at 0x409180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov dword [esp + 0x14], ecx
lea eax, [ebp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [0x440080]
xor ecx, ebp
mov dword [esp + 0x78], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], 0xcc0213f1
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
sub eax, 0xcc0213f1
je 0x40921d
jmp 0x4091c8
mov eax, dword [esp + 0x10]
sub eax, 0xd5159ec8
je 0x409381
jmp 0x4091dc
mov eax, dword [esp + 0x10]
sub eax, 0x156b09c
je 0x409360
jmp 0x4091f0
mov eax, dword [esp + 0x10]
sub eax, 0x1015108d
je 0x409295
jmp 0x409204
mov eax, dword [esp + 0x10]
sub eax, 0x4eb342dd
je 0x409246
jmp 0x409218
jmp 0x40940d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, ecx
add edx, 0x1c
mov dword [esp + 0x40], edx
add ecx, 0x34
mov dword [esp + 0x44], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], 0x4eb342dd
jmp 0x40940d
mov eax, dword [0x4415ac]
mov ecx, dword [0x4415a8]
mov edx, eax
sub edx, 0xc79c56ed
sub edx, 1
add edx, 0xc79c56ed
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd5159ec8
mov ecx, 0x1015108d
test dl, 1
cmovne eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x40940d
mov dword [esp + 0x34], 0x1482
mov byte [esp + 0x33], 1
mov byte [esp + 0x32], 1
mov dword [esp + 0x2c], 0x17c8
lea ecx, [esp + 0x60]
lea eax, [0x43947b]
mov dword [esp], eax
call fcn.0041e500
sub esp, 4
mov byte [esp + 0x2b], 0
vmovsd xmm0, qword [0x439208]
vmovsd qword [esp + 0x20], xmm0
lea ecx, [esp + 0x48]
lea eax, str.yyktjcfwgulgjughuzppqiyqmereqrxjzkjftcevsdatgakxjxabtwj
mov dword [esp], eax
call fcn.0041e500
sub esp, 4
lea ecx, [esp + 0x48]
call fcn.0041e640
lea ecx, [esp + 0x60]
call fcn.0041e640
mov ecx, dword [esp + 0x3c]
call fcn.0041e640
mov ecx, dword [esp + 0x40]
call fcn.0041e640
mov ecx, dword [esp + 0x44]
call fcn.0041e640
mov eax, dword [0x4415ac]
mov ecx, dword [0x4415a8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd5159ec8
mov ecx, 0x156b09c
test dl, 1
cmovne eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x40940d
fld dword [0x439210]
fstp xword [esp + 4]
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004295e0
fld xword [esp + 4]
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0x50
mov dword [esp + 0x34], 0x1482
mov byte [esp + 0x33], 1
mov byte [esp + 0x32], 1
mov dword [esp + 0x2c], 0x17c8
lea ecx, [esp + 0x60]
lea eax, [0x43947b]
mov dword [esp], eax
call fcn.0041e500
sub esp, 4
mov byte [esp + 0x2b], 0
vmovsd xmm0, qword [0x439208]
vmovsd qword [esp + 0x20], xmm0
lea ecx, [esp + 0x48]
lea eax, str.yyktjcfwgulgjughuzppqiyqmereqrxjzkjftcevsdatgakxjxabtwj
mov dword [esp], eax
call fcn.0041e500
sub esp, 4
lea ecx, [esp + 0x48]
call fcn.0041e640
lea ecx, [esp + 0x60]
call fcn.0041e640
mov ecx, dword [esp + 0x3c]
call fcn.0041e640
mov ecx, dword [esp + 0x40]
call fcn.0041e640
mov ecx, dword [esp + 0x44]
call fcn.0041e640
mov dword [esp + 0x1c], 0x1015108d
jmp 0x4091b0
Function at 0x40dbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x440080]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xcd8a81cb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0xafcf01d8
je 0x40dc4a
jmp 0x40dc1a
mov eax, dword [ebp - 0x20]
sub eax, 0xcd8a81cb
je 0x40dc32
jmp 0x40dc2d
jmp 0x40dc95
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xafcf01d8
jmp 0x40dc95
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x72
sub byte [edi], 0x25
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x40dc64
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004295e0
lea esp, [ebp - 4]
pop edi
pop ebp
ret
jmp 0x40dc04
Function at 0x429eab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x429eea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x429eea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x429eea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x429eea
cmp dword [ecx + 0x74], 0xe
jbe 0x429eea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43164e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4316eb
push ebx
push esi
call fcn.00431617
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004315ab
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x431698
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4316ea
push edi
push eax
call fcn.004300e3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4316b8
call fcn.00430131
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4316e9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004315ab
add esp, 0x20
test eax, eax
jne 0x4316d7
push edi
call fcn.00430131
jmp 0x4316df
push ebx
call fcn.00430131
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4328fa
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b9a0
push 0x43b998
push str.FlsAlloc
push 0x1f
call fcn.004327b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43292e
push dword [ebp + 8]
mov ecx, esi
call dword [0x43914c]
call esi
jmp 0x432934
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x432978
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b9b0
push 0x43b9a8
push str.FlsGetValue
push 0x21
call fcn.004327b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4329af
push dword [ebp + 8]
mov ecx, esi
call dword [0x43914c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4329b7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b9b8
push 0x43b9b0
push str.FlsSetValue
push 0x22
call fcn.004327b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4329f1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43914c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x437cc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x437ced
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x437ced
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130