joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009ff60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.1009ec40
mov eax, dword [0x100aa0f0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x1009ffd0
test byte [ebx + 0x20], 0xc
jne 0x1009ff90
mov eax, dword [0x101d7230]
test eax, eax
jne 0x1009ffa0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.100a1540
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x1009ffc2
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x1009ffc2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x1009ffe1
mov dword [esp], esi
call fcn.100a1880
add esp, 0x14
pop ebx
pop esi
ret
call fcn.1009ed00
mov ebx, eax
test eax, eax
jne 0x1009ff81
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x100a0001
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.100a1880
call fcn.1009fe70
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100a0090
mov dword [esp], eax
call fcn.100a1270
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x100a00d0
call fcn.1009ec40
mov eax, dword [0x100aa0f0]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x100a0130
test edi, edi
je 0x100a00aa
call fcn.1009ff60
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x100a0108
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.100a1390
call fcn.1009ff60
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.1009ec40
mov eax, dword [0x100aa0f0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100a0120
call fcn.1009ff60
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.1009ff60
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.1009ec40
mov eax, dword [0x100aa0f0]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x100a0062
call fcn.1009ed00
mov ebx, eax
jmp 0x100a0062
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x100a007e
call fcn.1009ed00
jmp 0x100a00aa
call fcn.1009ed00
mov ebx, eax
jmp 0x100a005e
Function at 0x100a0140
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.1009ec40
mov eax, dword [0x100aa0f0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x100a01b8
test esi, esi
je 0x100a0190
call fcn.1009ff60
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x100a01c8
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.100a1390
call fcn.1009ff60
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.1009ff60
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.1009ff60
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.1009ed00
mov ebx, eax
jmp 0x100a0165
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x100a0181

Function at 0x100a3f90
Capabilities:
Encrypt data using blowfish

Disassembly:
push edi
mov ecx, 0x400
push esi
mov esi, 0x100ab4a0
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
lea edx, [eax + 0x48]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov esi, 4
xor edx, edx
mov ebx, dword [esp + 0x24]
shl edx, 8
movzx ebx, byte [ebx + edi]
inc edi
or edx, ebx
cmp edi, dword [esp + 0x28]
jl 0x100a3fca
xor edi, edi
dec esi
jne 0x100a3fb4
xor edx, dword [ecx*4 + 0x100ac4a0]
mov dword [eax + ecx*4], edx
inc ecx
cmp ecx, 0x12
jne 0x100a3fad
xor edx, edx
xor ebx, ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
call fcn.10007a50
mov edx, dword [esp + 8]
mov dword [eax + ebx*4], edx
mov edx, dword [esp + 0xc]
mov dword [eax + ebx*4 + 4], edx
add ebx, 2
cmp ebx, 0x12
jne 0x100a3fe9
mov ebx, esi
xor edi, edi
lea edx, [esp + 8]
add edi, 2
lea ecx, [esp + 0xc]
call fcn.10007a50
mov edx, dword [esp + 8]
mov dword [eax + ebx + 0x48], edx
mov edx, dword [esp + 0xc]
mov dword [eax + ebx + 0x4c], edx
add ebx, 8
cmp edi, 0x100
jne 0x100a4011
add esi, 0x400
cmp esi, 0x1000
jne 0x100a400d
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x100a5198
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov ecx, edx
sar ecx, 5
cmp edx, 0x100
mov byte [eax], cl
je 0x100a5228
jg 0x100a51c3
cmp edx, 0x80
je 0x100a51d5
cmp edx, 0xa0
je 0x100a51fb
jmp 0x100a51cf
cmp edx, 0x140
je 0x100a5267
mov eax, 0xffffffea
ret
mov dword [eax + 0x50], 0x67452301
mov edx, 0x10033aa0
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
jmp 0x100a52b2
mov dword [eax + 0x50], 0x67452301
mov edx, 0x10035d00
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0xc3d2e1f0
jmp 0x100a52b2
mov dword [eax + 0x50], 0x67452301
mov edx, 0x10034b60
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0x76543210
mov dword [eax + 0x64], 0xfedcba98
mov dword [eax + 0x68], 0x89abcdef
mov dword [eax + 0x6c], 0x1234567
jmp 0x100a52b2
mov dword [eax + 0x50], 0x67452301
mov edx, 0x10037ad0
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0xc3d2e1f0
mov dword [eax + 0x64], 0x76543210
mov dword [eax + 0x68], 0xfedcba98
mov dword [eax + 0x6c], 0x89abcdef
mov dword [eax + 0x70], 0x1234567
mov dword [eax + 0x74], 0x3c2d1e0f
mov dword [eax + 0x78], edx
xor edx, edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
xor eax, eax
ret

Function at 0x100a52c0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, edx
sar ecx, 5
cmp edx, 0xe0
mov byte [eax], cl
je 0x100a5324
cmp edx, 0x100
je 0x100a5353
cmp edx, 0xa0
mov ecx, 0xffffffea
jne 0x100a53b1
mov dword [eax + 0x50], 0x67452301
mov edx, 0x1003aaa0
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0xc3d2e1f0
jmp 0x100a53a4
mov ebp, 0xc1059ed8
mov edi, 0x367cd507
mov esi, 0x3070dd17
mov ebx, 0xf70e5939
mov dword [esp + 4], 0x68581511
mov ecx, 0xffc00b31
mov edx, 0xbefa4fa4
mov dword [esp], 0x64f98fa7
jmp 0x100a5380
mov ebp, 0x6a09e667
mov edi, 0xbb67ae85
mov esi, 0x3c6ef372
mov ebx, 0xa54ff53a
mov dword [esp + 4], 0x9b05688c
mov ecx, 0x510e527f
mov edx, 0x5be0cd19
mov dword [esp], 0x1f83d9ab
mov dword [eax + 0x58], esi
mov esi, dword [esp]
mov dword [eax + 0x5c], ebx
mov ebx, dword [esp + 4]
mov dword [eax + 0x6c], edx
mov edx, 0x1003bcd0
mov dword [eax + 0x50], ebp
mov dword [eax + 0x54], edi
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ebx
mov dword [eax + 0x68], esi
mov dword [eax + 0x70], edx
xor ebx, ebx
xor ecx, ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add esp, 8
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100a53bc
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov edx, eax
sar edx, 6
cmp eax, 0x180
mov byte [ebp], dl
je 0x100a54f3
jg 0x100a5471
cmp eax, 0xe0
je 0x100a5562
cmp eax, 0x100
mov edx, 0xffffffea
jne 0x100a5660
mov dword [esp + 0x20], 0xc84c64c2
mov eax, 0xfc2bf72c
mov edx, 0x22312194
mov dword [esp + 0x24], 0x9f555fa3
mov esi, 0x53863992
mov edi, 0xbe5e1e25
mov dword [esp + 0x18], 0x6f53b151
mov ecx, 0x2c85b8aa
mov ebx, 0x2b0199fc
mov dword [esp + 0x1c], 0x2393b86b
mov dword [esp + 0x10], 0x5940eabd
mov dword [esp + 0x14], 0x96387719
mov dword [esp + 8], 0xa88effe3
mov dword [esp + 0xc], 0x96283ee2
mov dword [esp], 0x81c52ca2
mov dword [esp + 4], 0xeb72ddc
jmp 0x100a55cf
cmp eax, 0x200
mov edx, 0xffffffea
jne 0x100a5660
mov dword [esp + 0x20], 0x84caa73b
mov eax, 0xf3bcc908
mov edx, 0x6a09e667
mov dword [esp + 0x24], 0xbb67ae85
mov esi, 0x2b3e6c1f
mov edi, 0x9b05688c
mov dword [esp + 0x18], 0xfe94f82b
mov ecx, 0xfb41bd6b
mov ebx, 0x1f83d9ab
mov dword [esp + 0x1c], 0x3c6ef372
mov dword [esp + 0x10], 0x5f1d36f1
mov dword [esp + 0x14], 0xa54ff53a
mov dword [esp + 8], 0xade682d1
mov dword [esp + 0xc], 0x510e527f
mov dword [esp], 0x137e2179
mov dword [esp + 4], 0x5be0cd19
jmp 0x100a55cf
mov dword [esp + 0x20], 0x367cd507
mov eax, 0xc1059ed8
mov edx, 0xcbbb9d5d
mov dword [esp + 0x24], 0x629a292a
mov esi, 0x68581511
mov edi, 0x8eb44a87
mov dword [esp + 0x18], 0x3070dd17
mov ecx, 0x64f98fa7
mov ebx, 0xdb0c2e0d
mov dword [esp + 0x1c], 0x9159015a
mov dword [esp + 0x10], 0xf70e5939
mov dword [esp + 0x14], 0x152fecd8
mov dword [esp + 8], 0xffc00b31
mov dword [esp + 0xc], 0x67332667
mov dword [esp], 0xbefa4fa4
mov dword [esp + 4], 0x47b5481d
jmp 0x100a55cf
mov dword [esp + 0x20], 0x89dcd4d6
mov eax, 0x19544da2
mov edx, 0x8c3d37c8
mov dword [esp + 0x24], 0x73e19966
mov esi, 0x4c48942
mov edi, 0x77e36f73
mov dword [esp + 0x18], 0x32ff9c82
mov ecx, 0x6a1d36c8
mov ebx, 0x3f9d85a8
mov dword [esp + 0x1c], 0x1dfab7ae
mov dword [esp + 0x10], 0x582f9fcf
mov dword [esp + 0x14], 0x679dd514
mov dword [esp + 8], 0x7bd44da8
mov dword [esp + 0xc], 0xf6d2b69
mov dword [esp], 0x91d692a1
mov dword [esp + 4], 0x1112e6ad
mov dword [ebp + 0x90], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 0x94], edx
mov edx, dword [esp + 0x24]
mov dword [ebp + 0xb8], esi
mov dword [ebp + 0xbc], edi
mov dword [ebp + 0x98], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x9c], edx
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0xc0], ecx
mov dword [ebp + 0xc4], ebx
mov dword [ebp + 0xa0], eax
mov eax, dword [esp + 0x10]
mov dword [ebp + 0xa4], edx
mov edx, dword [esp + 0x14]
mov dword [ebp + 0xa8], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0xac], edx
mov edx, dword [esp + 0xc]
mov dword [ebp + 0xb0], eax
mov eax, dword [esp]
mov dword [ebp + 0xb4], edx
mov edx, dword [esp + 4]
mov dword [ebp + 0xc8], eax
xor eax, eax
mov dword [ebp + 0xcc], edx
xor edx, edx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100a566c
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
cmp ecx, 4
push edi
mov ebp, edx
push esi
push ebx
jne 0x100a56bb
mov edx, dword [edx + 0xc]
movzx ecx, byte [eax]
movzx edi, byte [eax + 1]
movzx esi, byte [eax + 2]
mov bl, byte [ecx + 0x100bc700]
movzx ecx, dh
xor cl, byte [edi + 0x100bc800]
mov byte [eax + 1], cl
mov ecx, edx
xor bl, dl
mov byte [eax], bl
shr ecx, 0x10
xor cl, byte [esi + 0x100bc800]
shr edx, 0x18
mov byte [eax + 2], cl
movzx ecx, byte [eax + 3]
xor dl, byte [ecx + 0x100bc700]
mov byte [eax + 3], dl
jmp 0x100a56c0
cmp ecx, 2
jle 0x100a5702
mov edx, dword [ebp + 8]
movzx ecx, byte [eax]
movzx esi, byte [eax + 1]
mov bl, byte [ecx + 0x100bc700]
movzx ecx, dh
xor cl, byte [esi + 0x100bc700]
movzx esi, byte [eax + 2]
mov byte [eax + 1], cl
mov ecx, edx
xor bl, dl
mov byte [eax], bl
shr ecx, 0x10
xor cl, byte [esi + 0x100bc800]
shr edx, 0x18
mov byte [eax + 2], cl
movzx ecx, byte [eax + 3]
xor dl, byte [ecx + 0x100bc800]
mov byte [eax + 3], dl
movzx ecx, byte [eax]
mov edx, dword [ebp + 4]
movzx esi, byte [ebp]
mov bl, byte [ecx + 0x100bc800]
xor bl, dl
movzx ecx, bl
movzx ecx, byte [ecx + 0x100bc800]
xor ecx, esi
movzx esi, byte [eax + 1]
mov bl, byte [ecx + 0x100bc700]
movzx ecx, dh
xor cl, byte [esi + 0x100bc700]
mov byte [eax], bl
mov ebx, dword [ebp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x100bc800]
movzx esi, bh
xor ecx, esi
movzx esi, byte [eax + 2]
mov bl, byte [ecx + 0x100bc800]
mov ecx, edx
shr ecx, 0x10
shr edx, 0x18
xor cl, byte [esi + 0x100bc800]
mov byte [eax + 1], bl
movzx esi, byte [ebp + 2]
movzx ecx, cl
movzx ecx, byte [ecx + 0x100bc700]
xor ecx, esi
mov bl, byte [ecx + 0x100bc700]
movzx ecx, byte [eax + 3]
mov byte [eax + 2], bl
xor dl, byte [ecx + 0x100bc700]
mov ecx, dword [ebp]
movzx edx, dl
movzx edx, byte [edx + 0x100bc700]
shr ecx, 0x18
xor edx, ecx
mov bl, byte [edx + 0x100bc800]
mov byte [eax + 3], bl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413e80
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10054
call fcn.004379d0
mov eax, dword [0x446004]
xor eax, esp
mov dword [esp + 0x10050], eax
xor eax, eax
push ecx
lea ecx, [esp + 4]
mov word [esp + 0x54], ax
mov word [esp + 4], ax
call fcn.004141a0
add esp, 4
lea eax, [esp + 0x50]
push 0x10000
push eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x413ef3
cmp eax, 0x10000
ja 0x413ef3
lea eax, [esp + 0x50]
push eax
call fcn.0042bae7
add esp, 4
mov ecx, dword [esp + 0x10050]
xor ecx, esp
call fcn.0041db2d
add esp, 0x10054
ret
mov ecx, dword [esp + 0x10050]
xor eax, eax
xor ecx, esp
call fcn.0041db2d
add esp, 0x10054
ret

Function at 0x413f10
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x54
mov eax, dword [0x446004]
xor eax, esp
mov dword [esp + 0x50], eax
xor eax, eax
push ecx
lea ecx, [esp + 4]
mov word [esp + 4], ax
call fcn.004141a0
add esp, 4
lea eax, [esp]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0041db2d
add esp, 0x54
ret
Function at 0x41b050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
cmp byte [0x44a7d1], 0
push ebp
push esi
mov ebp, edx
mov dword [esp + 8], ecx
jne 0x41b0b0
push 0xa
push 3
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x448828], eax
mov esi, dword [eax]
add eax, 4
mov dword [0x448828], eax
mov ecx, dword [eax]
lea edx, [eax + 4]
push ecx
mov dword [0x448828], edx
call fcn.00419990
add esp, 4
cmp eax, esi
jne 0x41b211
mov byte [0x44a7d1], 1
push ebx
mov ebx, dword [esp + 0x14]
mov ecx, 0x43e2b8
push edi
mov eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41b0e0
test dl, dl
je 0x41b0dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41b0e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x41b0c0
xor eax, eax
jmp 0x41b0e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b15d
cmp byte [0x44a7d2], 1
je 0x41b15d
mov esi, dword [sym.imp.python36.dll_PyDict_New]
call esi
mov dword [0x44aa3c], eax
call esi
mov dword [0x44ac98], eax
call esi
mov dword [0x44a7d4], eax
call esi
mov dword [0x44a78c], eax
call esi
mov dword [0x44acc8], eax
call esi
mov dword [0x44a818], eax
call esi
mov dword [0x44ac9c], eax
call esi
mov edi, dword [sym.imp.python36.dll_PyLong_FromLong]
mov esi, 0xfffffffb
mov dword [0x44aca8], eax
nop dword [eax + eax]
push esi
call edi
mov dword [esi*4 + 0x44ad14], eax
add esp, 4
inc esi
cmp esi, 0x101
jl 0x41b140
mov byte [0x44a7d2], 1
mov esi, dword [0x448828]
mov eax, ebx
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41b187
test dl, dl
je 0x41b183
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41b187
add eax, 2
add ecx, 2
test dl, dl
jne 0x41b167
xor edx, edx
jmp 0x41b18c
sbb edx, edx
or edx, 1
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b191
sub ecx, edi
add esi, ecx
mov eax, dword [esi + 1]
add esi, 5
test edx, edx
je 0x41b1f5
add esi, eax
mov ecx, ebx
mov eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41b1d0
test dl, dl
je 0x41b1cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41b1d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x41b1b0
xor edx, edx
jmp 0x41b1d5
sbb edx, edx
or edx, 1
mov ecx, esi
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b1e0
sub ecx, edi
add esi, ecx
mov eax, dword [esi + 1]
add esi, 5
test edx, edx
jne 0x41b1a6
movzx eax, word [esi]
mov edx, ebp
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esi + 2]
push eax
call fcn.0041a390
add esp, 8
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
push str.Error__corrupted_constants_object
call fcn.0042a6e0
add esp, 4
call fcn.00421045
int3

Function at 0x41e404
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41e443
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e443
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e443
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41e443
cmp dword [ecx + 0x74], 0xe
jbe 0x41e443
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42c4f4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43a4d0
push 0x43a4c8
push str.FlsAlloc
push 0x1e
call fcn.0042c3b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c528
push dword [ebp + 8]
mov ecx, esi
call dword [0x438454]
call esi
jmp 0x42c52e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42c572
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43a4e0
push 0x43a4d8
push str.FlsGetValue
push 0x20
call fcn.0042c3b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c5a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x438454]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42fc3b
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x42fc86
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0042fdda
test al, al
jne 0x42fc80
sub edx, 2
cmp edx, edi
jne 0x42fc66
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x42fca8
lea eax, [edi + 2]
cmp edx, eax
je 0x42fca8
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0042fb87
add esp, 0x10
jmp 0x42fda2
push esi
lea ecx, [ebp - 0x255]
call fcn.0042fdda
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42fceb
push dword [ebp - 0x25c]
jmp 0x42fc98
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x42fd28
cmp word [ebp - 0x226], 0
je 0x42fd49
cmp word [ebp - 0x226], ax
jne 0x42fd28
cmp word [ebp - 0x224], 0
je 0x42fd49
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0042fb87
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x42fd95
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x42fd02
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x42fd7d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x42fda2
push 0x42f8e8
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004355a0
add esp, 0x10
jmp 0x42fd72
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041db2d
leave
ret
Function at 0x43081b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4308b8
push ebx
push esi
call fcn.004307e4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043072d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x430865
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4308b7
push edi
push eax
call fcn.0042db0d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x430885
call fcn.0042c248
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4308b6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043072d
add esp, 0x20
test eax, eax
jne 0x4308a4
push edi
call fcn.0042c248
jmp 0x4308ac
push ebx
call fcn.0042c248
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4308bb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4308cc
pop esi
ret
push ebx
push edi
push esi
call fcn.004307e4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042db0d
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4308f4
push ebx
push esi
push edi
call fcn.0041f800
add esp, 0xc
push 0
call fcn.0042c248
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x431040
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00430b67
Function at 0x437640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43766d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43766d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407d10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 0xa0
je 0x407d1f
cmp al, 0x10
jne 0x407d8a
cmp byte [esp + 8], 0
jne 0x407d8a
jmp 0x4e4450
call esi
mov dword [0x4cb2e8], eax
mov al, 1
pop esi
ret
Function at 0x40d2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x40d2ad
cmp ecx, 9
jne 0x40d2b2
add eax, 2
jmp fcn.0040d2a0
movzx ecx, word [eax]
test cx, cx
jne 0x40d2bd
xor al, al
ret
jmp 0x4ecf60