joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ac14
Capabilities:
Encode data using xor

Disassembly:
jl 0x42ac37
pop edi
mov bl, 0x6e
sbb byte [ebx + 0x68e0700a], ch
push 0x32924b25
mov esp, 0xbb21b7cb
inc esp
enter 0xffffffffffffc7b9, 0xfffffffffffffff5
out 0x10, al
test byte [ecx + eax*8], cl
cld
jno 0x42acb4
cmp byte [eax], cl
add byte [edi + eax*2 - 0x724e98ca], dh
or byte [eax], al
mov ah, 0x47
mov cl, 0x8d
std
push ebx
cmp ebp, dword [ecx + ebx*8 - 0x3297ff03]
sbb dword [ecx], eax
inc ebx
push 0xffffffffffffffc1
lodsw ax, word [esi]
and byte [ecx + 0xf], 0x83
mov cl, dl
mov ch, 0x98
sub dword [ebx], edi
push eax
mov dword [0x2a275ba6], eax
cmp dl, cl
and al, 0x13
pop ebx
daa
sub bh, byte [edx]
shl dword [ebx + edx], 1
test al, 0x47
enter 0x7bbb, 0x4a
in al, 0x87
leave
lodsd eax, dword [esi]
das
mov ah, 0xff
in al, 0xa3
retf
out dx, al
nop
sub bl, byte [eax + 0x13]
mov ah, 9
or dword [ebp + 0x531e1906], ebp
and al, 0x32
not dword [edi]
or al, 0x76
jns 0x42ad00
adc eax, 0xd28f58ac
aad 0x3c
jns 0x42ac5d
lahf
jle 0x42ad48
cmp dh, bl
pushal
fsub dword cs:[ebp + 0x77]
cli
retf
mov ebx, 0x1b26925e
sal dword [esi + 0x1824fe94], 1
add esp, dword [0x3f879b4f]
jae 0x42ad19
xor byte [eax + 0x24], 0x5a
push esi
adc dword [edi - 0x544c1486], eax
xchg dword [edx - 0x15], edi
mov bl, 0xab
jnp 0x42ad88
adc eax, 0x30fcc260
jle 0x42ad7e
mov cs, edx
loopne 0x42ad86
sbb eax, 0x8e02604a
cmovp esp, dword [esi + 0x78]
pop esp
popal
cmpsd dword [esi], dword es:[edi]
mov bl, 0x30
invalid
invalid
fild qword [edi + 0x3a]
add dl, byte [esi + 0x58]
sbb cl, byte [eax - 0x13437050]
rol ch, cl
add al, 0x2b
test byte [edx + 0x1c23121e], bh
mov al, 0x8f
mov esp, 0x4c5d2ec
sub eax, dword [edx + edi*4 + 0x1c23121e]
fcmovbe st(0), st(5)
mov dword [0x45c0c0d0], eax
adc byte [ecx - 0x64], dh
rcr dword [eax + 0x39], 1
popfd
and byte [edx + 0x7131164e], ah
invalid

Function at 0x43dcf4
Capabilities:
Check for software breakpoints

Disassembly:
aas
inc ecx
sub eax, 0x749067c6
test al, 0x87
mov al, cl
xlatb
fld qword [edi - 0x4176be6a]
push esp
out 0xea, eax
movsb byte es:[edi], byte [esi]
jge 0x43dc64
in al, dx
adc edi, dword [ecx + 0x4071acaa]
inc eax
mov cl, 0x4d
adc eax, 0xac0f9ff9
rcr byte [esi + 0x40], 1
add al, dl
push ebx
dec edx
jle 0x43dc62
sub al, 0x65
or dword [0xf6d1fd48], eax
pop ds
out dx, eax
mov gs, edi
or bl, ch
jne 0x43dc8d
int 0x69
pop ebx
and eax, 0xcc3a09a4
retf 0xfc49
dec ebx
push ss
xchg ebp, eax
sti
lodsd eax, dword es:[esi]
cwde
lodsb al, byte [esi]
test al, 0x39
inc eax
call 0xaca2b6e3
inc esp
cld
das
int 0xc
sub ecx, ecx
jbe 0x43dcdc
rcl dword [eax + esi]
add ebp, dword [ebx + 0x4467b5d3]
inc esp
jle 0x43dcbb
je 0x43dc80
inc edi
pushal
mov al, 0x2e
jno 0x43dd55
mov dh, 0x4f
or al, 0x8b
xor bh, byte [edi + 0x5a]
imul edi, dword [ebp - 4], 0xe80f3de6
invalid
jb 0x43dd69
call 0x42c04f6b
jl 0x43dd3b
pop es
mov ebp, 0xc1e71c54
jle 0x43dd2e
inc eax
lodsb al, byte [esi]
in eax, 0x7b
invalid
jmp 0x43dccd
popfd
invalid
in eax, 0x2d
jbe 0x43dceb
mov ebx, 0xf6a6e32d
fcom qword [ecx - 0x16]
xchg esp, eax
xor al, al
pop ds
push eax
mov bh, 0xd4
add ecx, dword [esi + 0x63]
push ebp
int3
dec esi
arpl word [ebp + 0x66], dx
int3
Function at 0x44329d
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
mov esi, 0xbb7da9d6
invalid
and al, 0x9c
mul byte [edx]
dec eax
push ecx
and cl, byte [eax + 0x51]
xchg ebx, eax
pop ds
js 0x4432a0
jno 0x443320
leave
fcompi st(7)
add byte [edi + edx - 0x4dccc827], bl
pushfd
xor esi, dword [edi]
mov dword [esi - 0x3d4dadb8], ebx
das
pushfd
fiadd dword [edi + eax*4 - 0x2b]
pop ebp
aad 0x5d
xor eax, 0xd9e32c9
dec edx
dec eax
movsb byte es:[edi], byte [esi]
lea ebp, [eax + ecx]
jo 0x4432b4
xor dword [0x24ea076c], edi
jne 0x4432ef
jne 0x443313
adc ebx, dword [edi + edx*8 - 0x6a]
daa
pop edx
jb 0x443292
mov word [ebx + 0x53], ss
pop edx
invalid
add al, 0x9a
out dx, al
xlatb
mov ch, 0x3a
pop edi
jl 0x443326
sub al, 0xea
mov eax, dword [0x9aab595e]
mov bh, 0xc6
and edx, ebp
jo 0x4432c2
hlt
sub byte [ecx + 0x36], dh
call 0xb8ad2f99
mov ah, 0xcf
xor edi, dword [esp + esi*8 - 0x943b894]
cwde
inc edi
insb byte es:[edi], dx
inc edi
mov esp, 0xbc4798f6
bound esp, qword [ecx + 0x64]
out 0x61, eax
mov esp, 0xe7646162
popal
pushfd
xor esp, esp
test dword [ecx + esi*2 - 0x19], ebx
mov eax, ecx
push 0x37fc32b8
das
insd dword es:[edi], dx
lock xor edx, dword [ebx - 0x4e]
fnstcw word [ebp + 0x6fa433ef]
cli
xchg edi, eax
into
enter 0x5beb, 0x43
mov ah, 0x68
pop esi
hlt

Function at 0x443d26
Capabilities:
Encode data using xor

Disassembly:
rol dword [edi], 0x8e
mov dword [ecx + edi + 0xd], esi
add al, 0
push esi
push ebp
push esp
mov esp, 0xda366077
cmp al, 0x8d
aas
mov dh, 0xba
dec eax
jl 0x443d15
ror byte [esi], 0xff
pushal
or dword [ebx], edi
cmp byte [ecx + 0x7c16757f], dh
inc edi
lea esp, [edi]
loop 0x443cf5
adc edi, dword [ecx + 0x44d12810]
xlatb
jge 0x443d3d
loopne 0x443d4f
cwde
out 0x61, al
iretd
retf 0x4ccc

Function at 0x46ceb4
Capabilities:
Encode data using xor

Disassembly:
lds ebp, [esi - 0x5c54f794]
xchg ebx, eax
setb bh
pushal
mov edi, 0x6515e183
push ebx
xchg byte [esi + ebp*4 - 0x26], bl
sbb eax, ecx
jge 0x46ced4
aad 0x65
setg byte [ecx - 0x43]
mov ds, word [esi + 0x5c6ad22a]
and dh, bl
mov edi, 0x75252f94
fisttp qword [eax]
outsd dx, dword [esi]

Function at 0x4868bb
Capabilities:
Encode data using xor

Disassembly:
pop eax
cmc
jo 0x486919
fidiv dword [ecx - 0x11ad541f]
adc al, 0x93
pushfd
mov dl, 0x7c
invalid
pop edi
add byte [esi + 0xf64b00e], 0xd6
invalid

Function at 0x48bc21
Capabilities:
Encode data using xor

Disassembly:
push edx
inc ebp
stosd dword es:[edi], eax
je 0x48bc2a
sub al, 0x59
stosd dword es:[edi], eax
ret
and ah, ah
add esp, dword [edi - 0x1107f1a2]
invalid
Function at 0x4965ea
Capabilities:
Encode data using xor

Disassembly:
mov ecx, esi
lea ecx, [edi + ebp*4 - 0x2467470c]
scasd eax, dword es:[edi]
add dword [edi + 0x5725b646], ebp
int 0xb5
div edi
dec ecx
cmp eax, 0x34be77bc
cdq
xchg edx, eax
mov eax, dword [0x5e0ca01e]
mov edx, 0xc55d5756
push 0xde5e21c7
dec eax
xor dword [edi - 0x4c77a173], 0x58
in eax, dx
mov ebx, 0x9bacb6b7
cmc
push esp
fistp dword [eax]
add eax, 0x5dde02b9
invalid
out dx, ax
add esp, edx
sbb dword [ecx - 0x7c], edi
loop 0x4965e3
jns 0x496550
stc
mov byte [0x76d5063e], al
xor dword [eax + 0x3e], esp
out 0xac, eax
imul ecx, dword [eax - 0x34882b11], 0x5a06a09b
jbe 0x4965c5
jmp 0x496618
pushal
das
cmpsb byte [esi], byte es:[edi]
rol dword [edi + 0x21], 1
mov edi, 0x4574fcf5
mov al, byte [0xf22946b9]
out 0xe3, eax
div dh
mov eax, 0xf8d86c45
cmp al, byte [edx + 0x48]
cmp edx, esi
fidiv word [esp + edi*2]
sub edx, eax
movsb byte es:[edi], byte [esi]
xchg ebx, eax
xlatb
imul esp, dword [esi], 0xc3ca15ea
dec edi
and byte [esi], al
push es
mov dh, 0x9f
pushal
cmp edx, edi
imul eax, dword [ebp - 0x996172d], 0xaabab244
mov eax, dword [0x9a8ee95d]
mov dh, 0x39
cli
dec edx
jbe 0x4965c8
xchg edi, eax
sbb byte [edi + 0x7064d5f4], dh
xor edi, dword [esi]
invalid

Function at 0x4ac857
Capabilities:
Encode data using xor

Disassembly:
shr dword [ecx + 0x56], cl
cmp al, 0x56
cmc
ret 0x22ff
push cs
sahf
xor eax, 0xd4d268b4
pop esp
adc cl, 2
adc cl, 2
xor al, 0x3b
mov ah, 0x72
clc
xor ch, byte [edx + 0x700c65c2]
salc
add al, 0xe6
mov edi, 0x57b1f72e
pop edx
xor dword [edi + 0x58a7c138], ebx
sub eax, ebx
jb 0x4ac822
jl 0x4ac812
retf
sbb eax, 0x9a898044
inc edi
or esp, ecx
or byte [edi + 0x3b], 0x38
lds ebp, [ecx + ebp*8]
jl 0x4ac7ed
adc esp, dword [esp + ecx*2 - 0x4d5d4cac]
mov ebx, 0x2a2b2ec1
push ebp
cdq
aas
loopne 0x4ac81b
inc esp
push cs
pop ebp
sbb dword [ecx + 0x1b], esi
xor al, dl
pop esp
movq mm3, qword [eax + 0x76f05aa3]
push ebp
push ebx
cmp ebx, esi
inc ebp
shl dword [ecx], 4
jb 0x4ac8a8
outsb dx, byte [esi]
invalid
add dh, byte [ebx + ecx]
dec esi
sbb dl, dl
sub ecx, dword [edi - 0x6c]
pushfd
mov ebp, 0x4a0655b4
retf 0x9ac6
Function at 0x4ad783
Capabilities:
Encode data using xor

Disassembly:
push cs
sbb byte [eax + 0x5052c8ad], bl
mov dl, 0xd6
popfd
inc esp
aaa
pop edi
dec edx
lcall 0x9d8d, 0xdf1bd165
push esi
clc
call 0xc5aabf48
push ebp
aad 0x54
mov al, byte [0x38973f1d]
invalid
sbb ah, bl
jns 0x4ad60c
pop esi
out 0x61, eax
or eax, ebp
push esi
inc edx
adc byte [ebx + 0x790c48ad], dh
in eax, dx
inc edx
in al, dx
push cs
sub eax, 0x614a6f4f
enter 0x482c, 0xffffffffffffff94
sbb dh, byte [ecx - 0x105bd45d]
stc
or bl, byte [eax - 0x6f1386c1]
jle 0x4ad6c2
shr dword [ebx], 1
adc ebx, ebx
jno 0x4ad6f8
loope 0x4ad68e
and al, 4
push es
mov bh, 0x7c
add eax, 0xbe43923
cld
rep stosd dword es:[edi], eax
jns 0x4ad6a1
hlt
ja 0x4ad741
loope 0x4ad71f
push ss
sahf
and al, 0xd1
sub al, 0x58
xchg ebx, eax
cli
salc
std
sub eax, 0x30a17358
outsb dx, byte [esi]
outsd dx, dword [esi]
xor byte [esi + 0x6f], ch
enter 0xf25, 0x25
xchg dword [ebp - 0x11b6211c], ebp
adc al, 0x7c
xchg esi, eax
cwde
jo 0x4ad735
insd dword es:[edi], dx
sbb edx, edx
mov al, byte [0xe3d367db]
in eax, 0x39
loop 0x4ad6d5
in al, dx
cmp dword [ebp + ebp - 0x80], 0x8c5a0402
push edx
iretd
sub eax, 0x5a040280
mov word [edx - 0x31], ss
pop ss
int1
inc eax
invalid
invalid
dec ecx
in eax, dx
cld
inc eax
or eax, 0x2afacf45
invalid
sub eax, 0x4a6b4e20
xchg byte [eax + eax], dh
add al, 0x66
jae 0x4ad759
mov ch, 0x29
cld
sub al, 0xcd
dec edx
sub eax, 0xadcb1c4f
subps xmm4, xmmword [ecx - 0x15]
dec eax
out dx, al
push edx
insb byte es:[edi], dx
pop ebx
and eax, 0x9c4d7cb7
pushal
mov dh, 0x33
mov ah, 0xa6
adc al, 0x6c
out dx, eax
enter 0xffffffffffffe053, 0xffffffffffffffbb
add al, 0xee
mov eax, dword gs:[0x20d03249]
cwde
cmp esi, edx
pop ebp
and byte [ebp - 0xa5f3e8], bh
jmp ebp
dec esp
or byte [edx - 0x3cb95d0b], bl
jne 0x4ad795
pop esp
popal
jmp 0x4ad7a5
cmp esp, dword [ebx + 0x101b8a9e]
rcl byte [edi], 0x14
mov cs, word [edx + 0x62]
aaa
inc edx
cmp al, 0x34
ficomp dword [ebx - 0x5a]
add ecx, dword [eax + 0x2ab35a47]
pop edx
mov bl, 0x2a
invalid

Function at 0x4b8687
Capabilities:
Encode data using xor

Disassembly:
iretd
jne 0x4b8677
push edi
scasb al, byte es:[edi]
sal dword cs:[ebx + ebp*4 - 0x65bf82c3], cl
aaa
sbb dh, byte [edi + ebx*8]
inc esp
or ah, byte [ebx]
popfd
cdq
inc edx
pop ss
jmp 0x4b862f
loop 0x4b86c6
aaa
ret 0xf908
sub ecx, dword [ebx]
xchg esi, eax
push eax
push ss
cld
dec eax
fcom dword [eax + 0x4c]
inc ebp
cmp esp, dword [eax + 0x2ea86349]
push edx
xchg ebp, eax
cld
mov eax, 0xeb4f3455
mov dh, 0x29
nop
or edx, dword [esi]
call 0xc6ef8d3d
mov edx, 0xff941a6a
xor edi, edi
out 0xeb, al
add ebp, edi
popal
sal al, 0xcb
or al, 0x5e
jp 0x4b8656
pop ds
cmp edi, dword [eax + 0x5ef95dc5]
rcr byte [ecx - 0x7f8fccc3], 1
sbb dword [ecx], esi
mov bh, 0x9a
mov fs, word [ebx + 0x13c1b17f]
push edx
inc ebp
cdq
cmp eax, 0x19807033
xor dword [edi + 0x7fa38e9a], esi
mov cl, 0xc1
adc edx, dword [edx + 0x45]
dec ebp
imul eax, dword [eax], 0xecb41751
pop ss
mov ah, 0xec
stosb byte es:[edi], al
jl 0x4b86dd
xor bl, byte [ecx]
in al, 0x5b
and ebx, dword [ecx + 0x7d]
and byte [0x232422e2], dl
fdiv qword [edi + 0x54db8498]
jp 0x4b86de
mov byte [ebx], cl
rol dword [edi + ecx - 0x791f05e2], 0x82
int 0xbe
in al, dx
invalid
Function at 0x4bb959
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4368
cmp edx, dword [eax]
je 0x4bb97b
add eax, 8
inc ecx
cmp eax, 0x4c43f8
jl 0x4bb96c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4368]
jne 0x4bbaa9
mov eax, dword [0x4c8cfc]
cmp eax, 1
je 0x4bba83
test eax, eax
jne 0x4bb9ac
cmp dword [0x4c4290], 1
je 0x4bba83
cmp edx, 0xfc
je 0x4bbaa9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb9e3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc340
pop edi
or dword [eax], eax
add byte [ecx + 0x59], bl
lea eax, [ebp + 8]
lea esi, [esi + 0x4c436c]
push 0
push eax
push dword [esi]
call fcn.004bc7d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5fae231d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0xe1f7335
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7545677a
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1dec0e3f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10019f20
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10019f5f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10019f5f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10019f5f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10019f5f
cmp dword [ecx + 0x74], 0xe
jbe 0x10019f5f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001cc1d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001ccba
push ebx
push esi
call fcn.1001cbe6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001cb7a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001cc67
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ccb9
push edi
push eax
call fcn.1001ac5d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001cc87
call fcn.1001b6c2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ccb8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001cb7a
add esp, 0x20
test eax, eax
jne 0x1001cca6
push edi
call fcn.1001b6c2
jmp 0x1001ccae
push ebx
call fcn.1001b6c2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001cf27
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d10
push 0x10024d08
push str.FlsAlloc
push 0x1f
call fcn.1001ce43
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001cf5b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
jmp 0x1001cf61
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001cfa5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d20
push 0x10024d18
push str.FlsGetValue
push 0x21
call fcn.1001ce43
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001cfdc
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001cfe4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d28
push 0x10024d20
push str.FlsSetValue
push 0x22
call fcn.1001ce43
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d01e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100225c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100225ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100225ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404b70
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x664
push ebx
push esi
mov esi, dword [esp + 0x670]
xor ebx, ebx
cmp esi, ebx
je 0x404d13
push esi
call fcn.00410ece
add esp, 4
test eax, eax
je 0x404d13
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x18]
push ebx
push eax
push esi
mov dword [esp + 0x24], ebx
call fcn.00402070
add esp, 0x1c
test eax, eax
je 0x404d13
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x404d13
test al, 1
je 0x404bdc
and al, 0xfe
push eax
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 8]
test al, 0x10
je 0x404d03
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bx
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
stosw word es:[edi], ax
call fcn.00410faf
lea edx, [esp + 0x18]
push 0x4836c0
push edx
call fcn.00410f85
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x22c]
mov dword [esp + 0x228], ebx
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x218]
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404cf2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [esp + 0x248]
push 0x483708
push edx
call ebp
test eax, eax
je 0x404cd3
lea eax, [esp + 0x248]
push 0x483704
push eax
call ebp
test eax, eax
je 0x404cd3
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x46c]
push esi
push ecx
stosw word es:[edi], ax
call fcn.00410faf
lea edx, [esp + 0x1c]
push 0x483700
push edx
call fcn.00410f85
lea eax, [esp + 0x258]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00410f85
lea edx, [esp + 0x484]
push edx
call fcn.00404b70
add esp, 0x1c
lea eax, [esp + 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404c52
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x664
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
add esp, 0x664
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x664
ret
Function at 0x404e80
Capabilities:
Get graphical window text

Disassembly:
call fcn.00422620
test eax, eax
je 0x404e9f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
je 0x404f20
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x404f20
lea ecx, [esi + esi]
xor eax, eax
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00457717
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404f20
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebp, eax
test ebp, ebp
je 0x404f20
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xffffffffffffffff
push ebx
xor ebp, ebp
call fcn.00401470
add esp, 0x10
test eax, eax
je 0x404f20
push esi
call fcn.00410ece
add esp, 4
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x421ee0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x48b548]
sub esp, 0x114
test eax, eax
jne 0x42202d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x48b3e0
mov dword [0x48b548], 1
mov dword [0x48b3e0], 0x94
call esi
mov edx, dword [0x48b3f0]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x4880a8], eax
je 0x422008
push ebx
push 0x48b478
mov dword [0x48b478], 0x9c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x48b53c], eax
call edi
mov dword [0x48b540], eax
mov eax, dword [0x48b53c]
test eax, eax
push 0x48b518
je 0x421f84
call eax
jmp 0x421f8a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x48b47c]
cmp eax, 6
jae 0x421fa2
cmp eax, 5
jne 0x421fb6
cmp dword [0x48b480], 2
jb 0x421fb6
cmp word [0x48b518], 9
jne 0x421fb6
mov dword [0x48b3d4], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x421fd4
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x48b544], edx
jmp 0x421fda
mov edx, dword [0x48b544]
test edx, edx
je 0x422008
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x422008
mov ecx, dword [esp + 0x14]
mov dword [0x48b3ec], ecx
push 0x48b3e8
push 0x48b3e4
call fcn.004223d0
add esp, 8
call fcn.00422040
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret