joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100617c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101d3400
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x1006184d
push edi
push 0
push 1
push 0x101d9174
call esi
cmp eax, 1
jne 0x1006180a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101d9174
call esi
cmp eax, 1
je 0x100617f6
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101d3400
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x10061837
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x10061837
push esi
push 0x101d3400
call edi
push 0
push 0x101d9174
call edi
pop edi
cmp esi, 0xffffffff
jne 0x1006184d
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101d3400]
test eax, eax
jl 0x10061871
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10061871
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x10061846
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
mov dword [ebx], 1
mov eax, dword [0x101d3400]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x10066c30
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101d3400]
test eax, eax
jge 0x10066c3d
xor eax, eax
jmp 0x10066c44
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x100243c0], edi
jne 0x10066c5e
cmp dword [edx], 0
jne 0x10066c73
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x10066c50
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.10166da0
ret
mov edx, dword [eax + ecx*8 + 0x24]
test edx, edx
je 0x10066c95
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x24], esi
test esi, esi
pop esi
jne 0x10066c8f
mov dword [eax + ecx*8 + 0x28], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x10066ca6
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.10166da0
ret
mov eax, edx
ret

Function at 0x100678e0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x10067934
mov eax, dword [0x101d3400]
push ebx
push edi
test eax, eax
jge 0x100678f3
xor ebx, ebx
jmp 0x100678fc
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x100243c0]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x28]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x1006792c
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x24], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x10087f50
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push edi
mov dword [esi + 0x48], ebx
cmp byte [esi + 0x4c], bl
je 0x10087f87
mov edi, dword [esi + 0x40]
cmp edi, ebx
je 0x10087f84
mov eax, dword [0x101d3400]
cmp eax, ebx
jge 0x10087f72
xor eax, eax
jmp 0x10087f79
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x4c], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x38], ebx
cmp byte [esi + 0x3c], bl
je 0x10087fbe
mov edi, dword [esi + 0x30]
cmp edi, ebx
je 0x10087fbb
mov eax, dword [0x101d3400]
cmp eax, ebx
jge 0x10087fa9
xor eax, eax
jmp 0x10087fb0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x3c], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x28]
push edx
xor ecx, ecx
call fcn.10166da0
mov dword [esi + 0x28], ebx
cmp byte [esi + 0x2c], bl
je 0x10088003
mov edi, dword [esi + 0x20]
cmp edi, ebx
je 0x10088000
mov eax, dword [0x101d3400]
cmp eax, ebx
jge 0x10087fee
xor eax, eax
jmp 0x10087ff5
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x2c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x18]
push ecx
xor ecx, ecx
call fcn.10166da0
mov dword [esi + 0x18], ebx
cmp byte [esi + 0x1c], bl
je 0x10088048
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x10088045
mov eax, dword [0x101d3400]
cmp eax, ebx
jge 0x10088033
xor eax, eax
jmp 0x1008803a
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
push ebx
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x1c], bl
push esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.10166da0
cmp byte [esi + 0xc], bl
je 0x10088081
mov edi, dword [esi]
cmp edi, ebx
je 0x1008807e
mov eax, dword [0x101d3400]
cmp eax, ebx
jge 0x1008806c
xor eax, eax
jmp 0x10088073
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
ret
Function at 0x10088090
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x12ef4]
mov dword [edi], 0x10038158
test esi, esi
je 0x100880c9
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100880ba
xor eax, eax
jmp 0x100880c1
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push 0
push eax
call ebx
mov esi, dword [edi + 0x12f0c]
test esi, esi
je 0x100880ef
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100880e0
xor eax, eax
jmp 0x100880e7
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call ebx
mov eax, dword [edi + 0x12f80]
test eax, eax
je 0x1008810b
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi + 0x12f80], 0
lea esi, [edi + 0x12f84]
call fcn.10087f50
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.10132c00

Function at 0x100a0e30
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov dword [esi + 8], ebx
cmp byte [esi + 0xc], bl
je 0x100a0e67
push edi
mov edi, dword [esi]
cmp edi, ebx
je 0x100a0e63
mov eax, dword [0x101d3400]
cmp eax, ebx
jge 0x100a0e51
xor eax, eax
jmp 0x100a0e58
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
ret

Function at 0x100a12f0
Capabilities:
Get thread local storage value

Disassembly:
cmp esi, 0xaaaaaaa
jbe 0x100a12fb
xor eax, eax
ret
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100a1308
xor eax, eax
jmp 0x100a130f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [esi + esi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
ret

Function at 0x100a1790
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [edi + 4]
test esi, esi
je 0x100a1801
mov eax, dword [esi + 0xc]
cmp eax, dword [ebx + 0xc]
jb 0x100a17cf
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100a17ba
xor eax, eax
mov ecx, dword [eax]
push ebx
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
test esi, esi
je 0x100a1801
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100a17ee
xor eax, eax
mov edx, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi + 4], ebx
pop esi
ret
Function at 0x100adf20
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x12fe0]
push esi
mov dword [ebx], 0x10039a10
call fcn.10166da0
cmp byte [esi + 0xc], 0
je 0x100adf6a
push edi
mov edi, dword [esi]
test edi, edi
je 0x100adf65
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100adf52
xor eax, eax
jmp 0x100adf59
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
mov dword [esi], 0
mov dword [esi + 4], 0
pop esi
mov ecx, ebx
pop ebx
jmp fcn.10088090

Function at 0x100ca240
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x1c]
push edi
xor edi, edi
cmp esi, edi
je 0x100ca26f
mov eax, dword [0x101d3400]
cmp eax, edi
jge 0x100ca25d
xor eax, eax
jmp 0x100ca264
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x20]
mov dword [ebx + 0x1c], edi
cmp esi, edi
je 0x100ca298
mov eax, dword [0x101d3400]
cmp eax, edi
jge 0x100ca286
xor eax, eax
jmp 0x100ca28d
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push edi
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x24]
mov dword [ebx + 0x20], edi
cmp esi, edi
je 0x100ca2c1
mov eax, dword [0x101d3400]
cmp eax, edi
jge 0x100ca2af
xor eax, eax
jmp 0x100ca2b6
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push edi
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x2c]
mov dword [ebx + 0x24], edi
cmp esi, edi
je 0x100ca2ea
mov eax, dword [0x101d3400]
cmp eax, edi
jge 0x100ca2d8
xor eax, eax
jmp 0x100ca2df
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 0x2c], edi
lea edi, [ebx + 0x1b4]
call fcn.100d4910
push 0xd4
push 0
add ebx, 0x1c4
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x100ca320
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
push edi
cmp ecx, esi
je 0x100ca333
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edi, dword [ebx + 0x1b0]
mov dword [ebx + 8], esi
cmp edi, esi
je 0x100ca358
call fcn.100e6ca0
lea esi, [edi + 0x28]
call fcn.100e8270
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
mov dword [ebx + 0x1b0], esi
cmp byte [ebx + 0x1ac], 0
mov dword [ebx + 0x1a8], esi
je 0x100ca39d
mov edi, dword [ebx + 0x1a0]
cmp edi, esi
je 0x100ca396
mov eax, dword [0x101d3400]
cmp eax, esi
jge 0x100ca384
xor eax, eax
jmp 0x100ca38b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0x1ac], 0
pop edi
mov dword [ebx + 0x1a0], esi
mov dword [ebx + 0x1a4], esi
mov eax, ebx
pop esi
jmp fcn.100ca240
Function at 0x100e68a0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 4], ebx
jbe 0x100e68cc
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi + 0x10]
test ecx, ecx
je 0x100e68c2
push 1
call fcn.10166da0
inc ebx
add edi, 0x18
cmp ebx, dword [esi + 4]
jb 0x100e68b0
pop edi
mov esi, dword [esi + 0xc]
test esi, esi
je 0x100e68ff
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100e68ec
xor eax, eax
mov ecx, dword [eax]
push esi
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x100e6e30
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test eax, eax
jne 0x100e6e8f
lea ecx, [ecx]
cmp dword [eax*4 + 0x10023a30], edi
jae 0x100e6e51
inc eax
cmp eax, 0x1c
jb 0x100e6e40
jmp 0x100e6e58
mov edi, dword [eax*4 + 0x10023a30]
mov eax, dword [0x101d3400]
test eax, eax
jge 0x100e6e65
xor eax, eax
jmp 0x100e6e6c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [edi*4]
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
jne 0x100e6e8c
mov eax, 0x8007000e
pop edi
pop esi
pop ecx
ret
mov dword [esi + 0x38], eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
mov ecx, eax
add esi, 0x28
mov eax, edi
call fcn.10166da0
pop edi
pop esi
pop ecx
ret
Function at 0x10136ba0
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi + 0x48], 0
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
je 0x10136bef
mov eax, dword [0x101d3400]
test eax, eax
jge 0x10136bbb
xor eax, eax
jmp 0x10136bbe
push eax
call edi
movzx ecx, word [esi + 0x48]
cmp ecx, dword [eax + 0x128]
ja 0x10136be6
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10136be6
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x48], dx
mov dword [esi + 0xc], edx
cmp word [esi + 0x4a], 0
je 0x10136c37
mov eax, dword [0x101d3400]
test eax, eax
jge 0x10136c03
xor eax, eax
jmp 0x10136c06
push eax
call edi
movzx ecx, word [esi + 0x4a]
cmp ecx, dword [eax + 0x128]
ja 0x10136c2e
mov edx, dword [esi + 0x14]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10136c2e
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x4a], dx
mov dword [esi + 0x14], edx
pop edi
ret

Function at 0x1013a2e0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x1013a326
mov eax, dword [0x101d3400]
test eax, eax
jl 0x1013a326
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x1013a325
push 0x4c
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x1c]
add esp, 0xc
test eax, eax
je 0x1013a31f
mov dword [eax], esi
mov dword [edi + 0x1c], esi
pop edi
ret
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
pop edi
ret

Function at 0x1013b740
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x1013b779
push edi
mov edi, dword [esi]
test edi, edi
je 0x1013b774
mov eax, dword [0x101d3400]
test eax, eax
jge 0x1013b761
xor eax, eax
jmp 0x1013b768
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
ret

Function at 0x1013fd30
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101d3400]
test eax, eax
jge 0x1013fd3d
xor eax, eax
jmp 0x1013fd44
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 0xc], 0
je 0x1013fd69
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x1013fd54
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
test edx, edx
jne 0x1013fd60
mov dword [eax + 0x10], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 8]
push 0x10
push 0x108
call fcn.10166da0
ret
Function at 0x1013fd80
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x1013fdc9
mov eax, dword [0x101d3400]
push edi
test eax, eax
jge 0x1013fd92
xor edi, edi
jmp 0x1013fd9b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0x108
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x1013fdc2
mov dword [eax], esi
mov dword [edi + 0x10], esi
pop edi
ret
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
pop edi
ret

Function at 0x10166da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10166daf
pop dword [ebp - 0x1c]
mov eax, 0x10166daf
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x715b9
push 0
mov eax, 0xcb6b6350
add eax, 0x4494ad3c
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x26cb1b14
sub ecx, 0x26cacf2d
mov esi, eax
mov edi, 0xb973b94c
sub edi, 0xa955494c
add edi, dword [ebp - 0x1c]
mov edx, 0xda9b3360
add edx, 0xfa28937a
mov ebx, dword [edi]
add dword [ebp - 0x14], ecx
xor ebx, edx
sub dword [ebp - 0xc], 0xf9210b2f
mov dword [esi], ebx
add esi, 0xb3ff6dba
add esi, 0x4c00924a
add edi, 4
loop 0x10166e09
add eax, 0x3d91ddf8
sub eax, 0x3d90bb89
mov ebx, eax
add eax, 0x63baedb0
sub eax, 0x63baedab
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3aff2914
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x33780417
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40633c
pop dword [ebp - 0x18]
mov eax, 0x3ef30d0f
add eax, 0xc14d562d
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x5f4e98af
add dword [ebp - 0x28], 0xef03ac9c
mov dword [ebp - 0x24], 0xac9eb5a1
sub dword [ebp - 0x24], 0x7a6b695c
mov dword [ebp - 0x20], 0xc24cf25a
sub dword [ebp - 0x20], 0x7600ae2c
mov dword [ebp - 0x1c], 0x89a106ee
sub dword [ebp - 0x1c], 0x89a106ee
lea eax, [ebp - 0x28]
push eax
mov eax, 0x6fa09b88
add eax, 0x909fd4d8
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xfea0a51e
add dword [ebp - 0x28], 0x75d1c438
mov dword [ebp - 0x24], 0x980761c9
add dword [ebp - 0x24], 0xa964ffac
mov dword [ebp - 0x20], 0x97f06b05
sub dword [ebp - 0x20], 0x3480fe99
mov dword [ebp - 0x1c], 0x1b3766f3
add dword [ebp - 0x1c], 0xe4c8990d
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3b591
push 0
call eax
mov ecx, 0x636bea41
sub ecx, 0x636b8f56
xor esi, esi
add esi, eax
mov edi, 0xd55a83f6
add edi, 0x2ae67c0a
add edi, dword [ebp - 0x18]
mov ebx, 0x53a0a263
sub ebx, 0x507b6757
xor dword [ebp - 0xc], edx
mov edx, dword [edi]
add dword [ebp - 0x10], 0xd5737361
sub edx, ebx
xor dword [ebp - 4], 0x63a45903
mov dword [esi], edx
xor dword [ebp - 0x10], 0x1d87f38e
add esi, 0x3e733923
sub esi, 0x3e73391f
add edi, 0xf8f0a138
sub edi, 0xf8f0a134
loop 0x40645b
add eax, 0x6cdea0e3
add eax, 0x9322bd9c
xor ebx, ebx
add ebx, eax
add eax, 0xf71c8254
sub eax, 0xf71c824f
mov ecx, 0xeb86ffbf
add ecx, 0x14b90041
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040632d
jmp 0x406676

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret