joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bf40
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45bf57
add esp, 0xfffffff0
call fcn.00403b44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041ece0
mov eax, dword [0x475c58]
cmp word [eax + 2], 0
jne 0x45bf7f
mov eax, dword [0x475c58]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d6a8
mov eax, dword [0x475d28]
cmp word [eax + 2], 0
jne 0x45bf99
mov eax, dword [0x475d28]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d8a0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415d10]
call fcn.004037f0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415d10]
call fcn.004037f0
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4218bc]
call fcn.00428fb4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45c120
mov eax, dword [0x475b5c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429384
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45de40
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x475b5c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d494
test eax, eax
je 0x45c08e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409470
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d4bc
test eax, eax
je 0x45c0a2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404864
mov eax, dword [0x475a10]
cmp byte [eax], 0
jne 0x45c0d6
mov eax, ebx
call fcn.0045c248
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045e01c
mov eax, ebx
call fcn.0045e9e0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c116
call fcn.00403b9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c4c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x476be4]
cmp dword [eax + 0x30], 0
je 0x45c572
cmp dword [ebx + 0x94], 0
jne 0x45c56c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c458
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c56c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c532
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c56c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041839c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c541
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d0d4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45d109
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046e4
jmp 0x45d116
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404648
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e1f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e239
mov eax, esi
call fcn.00444600
test al, al
je 0x45e239
mov eax, dword [ebx + 0x84]
call fcn.004442fc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e239
push 0
mov eax, dword [ebx + 0x84]
call fcn.004442fc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x461690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x4617d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409320
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004086ac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048b4
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404b14
mov eax, dword [ebp - 0xc]
mov edx, 0x4617f0
call fcn.00404a00
jne 0x461706
lea eax, [ebp - 0xc]
mov edx, 0x4617fc
call fcn.0040468c
mov eax, dword [ebp - 0xc]
call fcn.00404ab4
mov ebx, eax
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409220
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040468c
push ebx
mov eax, dword [ebp - 4]
call fcn.00404ab4
push eax
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x461775
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x46180c
call fcn.00404900
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x415a8c]
call fcn.0040c5cc
call fcn.00403fac
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov eax, esi
call fcn.0041b088
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0041ab6c
xor ecx, ecx
xor edx, edx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.0040741c
push ebx
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4617df
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret

Function at 0x46502c
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
mov eax, ebx
call fcn.004045f4
call fcn.004637a0
test al, al
je 0x465066
push 0x400
lea eax, [esp + 4]
push eax
push 0x465070
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
je 0x465066
mov edx, ebx
mov eax, esp
call fcn.0040964c
add esp, 0x400
pop ebx
ret
Function at 0x4655b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x465700
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409320
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004086ac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048b4
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404b14
mov eax, dword [ebp - 0xc]
mov edx, 0x465718
call fcn.00404a00
jne 0x46562e
lea eax, [ebp - 0xc]
mov edx, 0x465724
call fcn.0040468c
mov eax, dword [ebp - 0xc]
call fcn.00404ab4
mov ebx, eax
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409220
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040468c
push ebx
mov eax, dword [ebp - 4]
call fcn.00404ab4
push eax
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x46569d
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x465734
call fcn.00404900
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x415a8c]
call fcn.0040c5cc
call fcn.00403fac
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov eax, esi
call fcn.0041b088
push edi
mov eax, dword [0x476668]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0041ab6c
xor ecx, ecx
xor edx, edx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.0040741c
push ebx
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465707
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret

Function at 0x467c00
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x467c7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x467c49
mov eax, dword [ebx + 4]
call fcn.00404ab4
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467c85
lea eax, [ebp - 4]
call fcn.004045f4
ret
Function at 0x468e04
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x468e30
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404ab4
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x468e55
call fcn.0040dd20
xor eax, eax
push ebp
push 0x468e8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x468e75
call fcn.0040dd20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468e93
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x46b3e8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x46b4d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004086ac
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
call fcn.0040468c
xor ebx, ebx
lea eax, [ebp - 0x144]
push eax
push 0x46b4e0
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x46b4ab
or eax, 0xffffffff
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404864
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.004086ac
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 4]
call fcn.00404a00
jne 0x46b494
mov bl, 1
jmp 0x46b4a5
lea eax, [ebp - 0x144]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x46b459
push esi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b4d8
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret
Function at 0x46bba4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aa4
xor eax, eax
push ebp
push 0x46bce3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
cmp dword [0x475994], 0
je 0x46bcc0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00409320
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004086ac
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004048b4
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404b14
mov eax, dword [ebp - 0x10]
mov edx, 0x46bcfc
call fcn.00404a00
jne 0x46bc31
lea eax, [ebp - 0x10]
mov edx, 0x46bd08
call fcn.0040468c
mov eax, dword [ebp - 0x10]
call fcn.00404ab4
mov ebx, eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409220
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.0040468c
push ebx
mov eax, dword [ebp - 4]
call fcn.00404ab4
push eax
mov eax, dword [0x475994]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x475994]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
je 0x46bcc0
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
call fcn.0041b088
push edi
mov eax, dword [0x475994]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
call fcn.0041ab6c
mov eax, dword [esi]
xor ecx, ecx
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.0040741c
push ebx
call sub.KERNEL32.DLL_FreeResource
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bcea
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404618
lea eax, [ebp - 4]
call fcn.004045f4
ret

Function at 0x471324
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4713cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4713e0
call fcn.0040468c
mov eax, dword [0x475cb8]
mov eax, dword [eax]
mov edx, 0x4713f0
call fcn.00404a00
jne 0x471368
lea eax, [ebp - 4]
mov edx, 0x4713fc
call fcn.0040468c
lea eax, [ebp - 8]
mov edx, 0x471408
call fcn.0040468c
push 8
push 0
push 0
push 0x471418
push dword [ebp - 4]
push 0x471438
push dword [ebp - 8]
push 0x471460
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404974
mov eax, dword [ebp - 0xc]
call fcn.00404ab4
push eax
push 0x471468
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4713d4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404618
ret
Function at 0x4721b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4722cf
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00472094
mov dl, 1
mov eax, dword [0x4162b8]
call fcn.004037f0
mov dword [ebp - 4], eax
test bl, bl
je 0x472226
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00408b64
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4722e4
call fcn.00404900
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov edx, 0x27ac40
call fcn.0046e8c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x472243
lea ecx, [ebp - 0x18]
mov edx, 0x27ac40
mov eax, 0x4722e4
call fcn.0046e8c0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push 0x4722f8
call fcn.0040a7ac
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x20]
mov eax, 0x47231c
call fcn.0040b428
push dword [ebp - 0x20]
push 0x472330
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404974
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 8]
mov eax, dword [0x476e0c]
call fcn.0045f810
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 4]
call fcn.0040e27c
push 8
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404ab4
push eax
push 0x472338
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4722d6
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404618
ret

Function at 0x472360
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47243b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov dl, 1
mov eax, dword [0x431a74]
call fcn.00431b74
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47241b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00431c14
mov cl, 1
mov edx, 0x472454
mov eax, dword [ebp - 8]
call fcn.00431c78
test al, al
je 0x472409
xor eax, eax
push ebp
push 0x4723e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x47248c
mov eax, dword [ebp - 8]
call fcn.0043203c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4723f7
cmp dword [ebp - 0xc], 0
je 0x472401
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
call fcn.00431be4
mov eax, dword [ebp - 8]
call fcn.00403820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x472425
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472442
lea eax, [ebp - 0xc]
call fcn.004045f4
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..pdata
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x45c4084
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..pdata_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x67651beb
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x646271cd
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x19d737bb
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1005f320
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x100c5290
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x101da8b1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x101da8f0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101da8f0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101da8f0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x101da8f0
cmp dword [ecx + 0x74], 0xe
jbe 0x101da8f0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x101e51a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101e51cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101e51cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x101e56d9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10209988
push 0x10209980
push 0x10209988
push 0x1f
call fcn.101e60fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101e570d
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x101e5713
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x101e5757
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102099ac
push 0x102099a4
push 0x102099ac
push 0x21
call fcn.101e60fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101e578e
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x101e5796
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102099c0
push 0x102099b8
push 0x102099c0
push 0x22
call fcn.101e60fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101e57d0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]