joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b4cd
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x4cc044
call fcn.00497040
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b50b
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041d311
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004b21a6
lea eax, [ebp - 0x14]
push eax
call fcn.0041f5d2
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0041c823
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b21a6
push dword [ebp + 8]
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.004b233d
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 8]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0043b2ac
test eax, eax
je 0x43b562
mov esi, eax
jmp 0x43b597
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x20]
test eax, eax
je 0x43b57c
or esi, 0xffffffff
jmp 0x43b597
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x24]
or esi, 0xffffffff
cmp eax, esi
je 0x43b597
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041c890
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x43d580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cc358
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x44]
push esi
mov ebx, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43d602
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x43d627
push ebp
push eax
lea ecx, [esp + 0x18]
call fcn.00442920
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x3c], 0
call fcn.0043d730
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x34], 0xffffffff
call fcn.00442970
mov al, bl
jmp 0x43d629
mov edi, str.Unable_to_load_resource_
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor al, al
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x446810
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.0043c960
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x446842
mov dword [esp + 0x2c], 0
jmp 0x44685d
mov ecx, ebp
call fcn.0043c960
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.0043c960
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.0043c970
cmp eax, esi
jae 0x44689d
mov ecx, ebp
call fcn.0043c970
mov dword [esp + 0x10], eax
jmp 0x4468a1
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.0043c790
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x44690d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x446908
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.0043f650
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x4468fb
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.0043fac0
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x4468c8
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x4468b6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x44cf20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x44cf50
push esi
call fcn.0044d420
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x44cf49
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x44cfd3
mov eax, dword [esi + 0x1a0]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x44cfbf
mov eax, dword [esi + 8]
test eax, eax
je 0x44cf74
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1a0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44cfbb
cmp eax, 2
je 0x44cfbf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44cf67
cmp eax, 3
je 0x44cf9a
cmp eax, 1
jne 0x44cf67
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44cf67
mov edx, dword [esi + 0x120]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44cf67
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0044d000
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44cff3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0044d000
add esp, 4
pop esi
ret
Function at 0x474e90
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x474eaa
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x474eaa
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x476a80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
push 1
call fcn.00478470
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x476ab3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [edx + 0x258], eax
mov ecx, dword [ebp - 4]
push 0x40
mov dword [ecx + 0x25c], eax
push fcn.0049a3b4
mov edx, dword [ebp - 4]
push edx
call fcn.00474e30
push esi
push eax
call fcn.0049a430
add esp, 0x14
test eax, eax
je 0x476aef
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push eax
push ecx
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00478690
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00474ef0
mov edi, dword [ebp + 8]
add esp, 0x20
cmp edi, esi
mov ebx, 0x20000
je 0x476b59
push 0
call fcn.00475620
mov dl, byte [esi + edi]
mov cl, byte [eax + esi]
add esp, 4
cmp dl, cl
je 0x476b47
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x70]
or ecx, ebx
mov dword [eax + 0x70], ecx
push 0
call fcn.00475620
mov al, byte [eax + esi]
add esp, 4
inc esi
test al, al
jne 0x476b28
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x70]
test ebx, eax
je 0x476bd1
test edi, edi
je 0x476bca
mov bl, byte [edi]
push 0
call fcn.00475620
mov cl, byte [eax]
add esp, 4
cmp bl, cl
jne 0x476b9d
cmp bl, 0x31
jne 0x476b92
push 0
call fcn.00475620
mov dl, byte [edi + 2]
mov cl, byte [eax + 2]
add esp, 4
cmp dl, cl
jne 0x476b9d
cmp byte [edi], 0x30
jne 0x476bd1
cmp byte [edi + 2], 0x39
jge 0x476bd1
test edi, edi
je 0x476bca
push 0
call fcn.00475620
push eax
push edi
push str.Application_built_with_libpng__.20s_but_running_with__.20s
lea eax, [ebp - 0x58]
push 0x50
push eax
call fcn.0049a842
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00474c50
add esp, 0x20
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x476c1f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb4]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00478660
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
test eax, eax
jne 0x476c18
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x476c5c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb0]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00478610
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
push ecx
mov dword [eax + 0xb0], 0
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00478510
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004783f0
mov edx, dword [ebp - 4]
push edx
call fcn.00477180
add esp, 0x14
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498429
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x498449
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0049ae2e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x49846c
test byte [esp + 8], 2
je 0x49846c
call fcn.0049aea1
mov dword [eax], 0xd
call fcn.0049aeaa
mov dword [eax], 5
jmp 0x498445
xor eax, eax
ret
Function at 0x4aeaf0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00497240
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4aebbb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4aebbb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4aeb6e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4aeb79
or bh, 8
and edi, 0x8000000
je 0x4aeb94
mov eax, dword [0x50bb1c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4aebbb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aef90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4aefbb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4aefdf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4aeffa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x4b3660
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b3698
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b2664
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b263b
jmp 0x4b36a4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4b4faa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b4fec
call fcn.004c4e6b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b4fec
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b4fe3
xor eax, eax
jmp 0x4b4ff4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b4ffa
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bc567
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4cdedc
call fcn.00497040
push ecx
push ecx
push esi
push 0x10
call fcn.004b277a
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4bc5b4
mov ecx, esi
call fcn.004b7793
mov eax, dword [0x5035a0]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.004b233d
jmp 0x4bc5b6
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x4ebbf8
push eax
mov dword [ebp - 0x10], esi
call fcn.0049869c
pop esi
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x405890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and dword [ebp - 0x40a9acdc], 0xffffff8b
jge 0x4058a8
test eax, 0x85c933db
push dword [ebx - 0x73]
in al, 0xc
or ecx, 0xffffffef
leave
out dx, eax
push ss
rcl byte [esi + ebp*4 - 0x7cb62e09], 0x50
push es
jge 0x4058fc
mov dword [ebp + ebx*4 - 0x24], ecx
inc ebx
add edi, dword [esi + 4]
add esi, 0x48
add ebp, dword [ebp - 0x1f8a007b]
mov ebp, dword [edx + 8]
inc edx
push edx
push eax
call 0x3fa660
insd dword es:[edi], dx
and byte [esp + edx*2], cl
xlatb
test esi, esi
salc
inc ebp
hlt
push cs
mov esi, dword [edi - 0x6b]
leave
push dword [ebx]
rol byte [edx + 0x49d1f7ae], 0x8b
ror dword [ebx - 0x74057438], 0xd9
add edx, eax
call 0xa6335c01
mov eax, dword [ebp - 8]
mov ecx, ebx
and ecx, 3
add eax, 4
in al, dx
movsb byte es:[edi], byte [esi]
mov esi, dword [eax]
mov dword [ebp - 8], eax
test esi, esi
pushal
xor byte [ebx + 0x5e5ff445], cl
mov byte [edx], 0
pop ebx
lodsb al, byte [esi]
fstp dword [ebp - 0x3d]
nop
nop
and dl, byte [eax - 0x1374aa70]
sub esp, 8
mov cx, word [0x4013c8]
mov eax, dword [0x40d1c4]
mov dl, byte [0x40f3ca]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov word [ebp - 4], cx
xor eax, 0xf68508fe
push edi
lahf
inc ebp
mov cs, word [eax + 0x5d8dfe07]
clc
jg 0x4059c8
jl 0x405978
test ecx, ecx
jae 0x405997
mov eax, dword [ebp + 0x10]
mov edx, dword [str.___]
mov ecx, eax
pop edi
pop esi
lahf
jne 0x405999
mov dl, byte [0x40f3c0]
enter 0x451, 0xffffffffffffff8b
in eax, 0x5d
ret 0xc
test dword [esi + 0x7f], edi
sub eax, 0xf981087c
int 0xee
add byte [eax], al
jg 0x4059c8
jl 0x4059a5
cmp ecx, 0xeecd
int 0x9d
mov esi, dword [ebp + 0x10]
daa
push str._3d
push 5
push esi
call fcn.004085d1
add esp, 0xffffffb7
test eax, eax
mov eax, esi
into
invalid
mov edi, ecx
mov ecx, dword [ecx]
mov edx, esi
mov ecx, 0xd6ee
and edi, 0x3ff
call fcn.0040b810
mov ecx, dword [ecx - 0x97a3767]
jl 0x405a56
mov ecx, 0xcdf98108
add eax, dword [eax]
add byte [edx + 3], dh
inc ebx
jmp 0x4059c8
enter 0x40e, 0xffffffffffffff89
mov ebx, 0x56365371
Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x10001000
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10012038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10010260]
push ebx
push esi
push edi
push 0
push 4
add eax, 0xfffff001
call eax
lea ecx, [ebp - 0x20]
mov esi, eax
push ecx
push esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x100010dd
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100010ca
mov eax, dword [ebp - 0x18]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
push str.ntdll.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x10001093
push str.LoadLibrary___failed._n
call fcn.10002921
add esp, 4
xor eax, eax
jmp 0x100010bf
push str.NtQueryInformationThread
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100010aa
push esi
call ebx
xor eax, eax
jmp 0x100010bf
lea ecx, [ebp - 0x2c]
push ecx
push 4
lea edx, [ebp - 0x28]
push edx
push 9
push edi
call eax
push esi
call ebx
mov eax, dword [ebp - 0x28]
cmp eax, dword [0x10013df0]
je 0x100010f0
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10001053
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002614
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002614
mov esp, ebp
pop ebp
ret