joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bf00
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx]
push edi
test eax, eax
jne 0x1002bf21
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x100
ret 8
mov eax, dword [esp + 0x114]
test eax, eax
jne 0x1002bf3b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x100
ret 8
mov edi, dword [esp + 0x118]
xor esi, esi
test edi, edi
jbe 0x1002bf70
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esp + 0x114]
mov eax, edi
sub eax, esi
push 0
push eax
mov eax, dword [ebx]
lea edx, [esi + ecx]
push edx
push eax
call ebp
cmp eax, 0xffffffff
je 0x1002bf7f
add esi, eax
cmp esi, edi
jb 0x1002bf4e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x100
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x2733
je 0x1002bf70
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call esi
push eax
lea ecx, [esp + 0x14]
push str.Server_Socket_failed_to_send:__d
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 8

Function at 0x1002bfd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x2800
call fcn.1002c9f0
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x1002bff3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x2800
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xa00
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [esi]
push 0
lea eax, [esp + 0x10]
push 0x2800
push eax
push ecx
call edi
cmp eax, 0xffffffff
jne 0x1002c02f
call ebx
call ebx
cmp eax, 0x2733
jne 0x1002c0a9
jmp 0x1002c00c
test eax, eax
je 0x1002c09b
mov esi, dword [esp + 0x2814]
test esi, esi
ja 0x1002c074
push 0
push 0
push 0x1009efd4
call sub.MFC42.DLL_AfxMessageBox
mov edi, dword [esp + 0x2810]
mov ecx, esi
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x2800
ret 8
mov edi, dword [esp + 0x2810]
mov ecx, eax
mov edx, ecx
lea esi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x2800
ret 8
mov ecx, esi
call fcn.1002c0c0
mov ecx, esi
call fcn.1002c0e0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2800
ret 8
Function at 0x1002f6b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100850b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov al, byte [esp + 0x14]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi], 0x1008b714
mov byte [esi + 0x1c], al
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov cl, byte [esp + 0x1c]
mov dword [esp + 0x14], edi
mov byte [esi + 0x2c], cl
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 1
call fcn.10033120
mov dl, byte [esp + 0x1c]
lea ecx, [esi + 0x90]
push edi
mov byte [esp + 0x18], 2
mov byte [ecx], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [esp + 0x1c]
mov cl, byte [esp + 0x1c]
mov dl, byte [esp + 0x1c]
mov byte [esi + 0xe4], al
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
push 0x1002f660
mov byte [esi + 0xf4], cl
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
push 0xfffffffffffffffc
mov byte [esi + 0x104], dl
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
push eax
mov dword [esi], 0x1008b67c
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
push edi
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esi + 4]
push edi
push 0x32
push 1
push ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0x8c], 0xd8e9ec
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100311d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10085168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push edi
mov eax, dword [esi + 0xc]
xor ebp, ebp
push ecx
push eax
mov dword [esp + 0x18], ebp
call sub.gdiplus.dll_GdipCreateFromHDC
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
push 0xfe000000
push eax
mov dword [esp + 0x60], ebp
call sub.gdiplus.dll_GdipGraphicsClear
cmp eax, ebp
je 0x10031225
mov dword [esp + 0x1c], eax
mov edx, dword [esi + 0x7c]
mov eax, dword [esi + 0x78]
push edx
push eax
push ebp
lea ecx, [esp + 0x24]
push ebp
push ecx
lea ecx, [esi + 0x3c]
call fcn.100336b0
xor ebx, ebx
mov eax, dword [esi + 0xe8]
cmp eax, ebp
je 0x10031278
mov edx, dword [esi + 0xec]
sub edx, eax
sar edx, 2
cmp ebx, edx
jae 0x10031278
mov edi, dword [eax + ebx*4]
cmp edi, ebp
je 0x10031275
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x70]
test eax, eax
jne 0x10031275
mov eax, dword [edi]
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call dword [eax + 0x6c]
inc ebx
jmp 0x1003123e
xor edi, edi
mov eax, dword [esi + 0xf8]
cmp eax, ebp
je 0x100312ac
mov edx, dword [esi + 0xfc]
sub edx, eax
sar edx, 2
cmp edi, edx
jae 0x100312ac
mov ecx, dword [eax + edi*4]
cmp ecx, ebp
je 0x100312a9
cmp dword [ecx + 4], ebp
je 0x100312a9
lea edx, [esp + 0x18]
push edx
call fcn.10040390
inc edi
jmp 0x1003127a
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebp
call edi
push 1
mov ebx, eax
call edi
mov edx, dword [esi + 4]
mov dword [esp + 0x4c], eax
xor eax, eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], eax
push ecx
mov dword [esp + 0x3c], eax
push edx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
push ecx
mov dword [esp + 0x2c], eax
push eax
lea eax, [esp + 0x48]
mov ebp, edx
push eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edi
call ebx
test eax, eax
je 0x10031350
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x40]
push ecx
push ebp
push edx
call ebx
test eax, eax
je 0x10031350
mov eax, dword [esp + 0x28]
push edi
lea ecx, [esp + 0x44]
push eax
push ecx
call ebx
test eax, eax
je 0x10031350
mov edx, edi
mov eax, ebp
push edx
lea ecx, [esp + 0x44]
push eax
push ecx
call ebx
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x7c]
mov ecx, dword [esi + 0x78]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x18]
push eax
call sub.gdiplus.dll_GdipDeleteGraphics
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x10071f30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10088831
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x1c]
push esi
push edi
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x18], ebp
call fcn.10034260
mov dl, byte [esp + 0x28]
lea ebx, [ebp + 0x90]
xor esi, esi
mov dword [ebp + 0x8c], 0x1008dafc
mov dword [esp + 0x1c], esi
mov byte [ebx], dl
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov al, byte [esp + 0x28]
mov dword [ebp + 0xa4], esi
mov byte [ebp + 0xa0], al
mov dword [ebp + 0xa8], esi
mov dword [ebp + 0xac], esi
mov edi, 0x1009fd90
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp], 0x1008da40
mov dword [ebp + 0x8c], 0x1008da14
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x20], 2
mov edi, ecx
mov ecx, ebx
push edi
mov dword [esp + 0x30], edi
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x10072005
mov eax, dword [ebx + 4]
mov ecx, edi
mov edx, ecx
mov esi, 0x1009fd90
mov edi, eax
mov eax, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], eax
add eax, ecx
xor esi, esi
mov byte [eax], 0
push 0x2c
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, esi
mov byte [esp + 0x1c], 3
je 0x10072025
mov ecx, eax
call fcn.10072fc0
jmp 0x10072027
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [ebp + 0xb4], eax
mov dword [ebp + 0xb8], esi
mov dword [ebp + 0xbc], esi
pop edi
mov dword [ebp + 0xb0], 1
mov dword [ebp + 0x3c], 0xb
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x100764d0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x30
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push eax
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebx, eax
call edi
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x44]
mov edi, eax
mov eax, dword [esp + 0x10]
mov edx, ecx
sub edx, eax
add edx, ebp
cmp edx, ebx
jle 0x10076514
sub eax, ecx
add ebp, eax
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ebx, eax
test ebx, ebx
je 0x10076543
mov ecx, dword [ebx + 0x20]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, ebx
call sub.MFC42.DLL_CWnd::Detach
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esp + 0x1c]
add edx, edi
mov edi, dword [esp + 0x48]
mov ebx, eax
sub ebx, ecx
add ebx, edi
cmp ebx, edx
jle 0x1007656e
mov edx, dword [esi + 0x54]
sub edx, eax
add edx, ecx
add edi, edx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
sub edx, ecx
push 1
sub eax, ebx
push edx
push eax
push edi
push ebp
mov ecx, esi
call sub.MFC42.DLL_CWnd::MoveWindow
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8
Function at 0x1007eab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100892c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 8], al
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.1007ebc0
test al, al
jne 0x1007eb47
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x1007eb32
mov al, byte [ecx - 1]
cmp al, bl
je 0x1007eb28
cmp al, 0xff
je 0x1007eb28
dec al
pop esi
mov byte [ecx - 1], al
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
call fcn.1007a9a0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
push ecx
mov ecx, esi
call fcn.1007f980
mov ecx, eax
call fcn.1007ae70
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.1007acf0
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x1007eb9e
mov al, byte [ecx - 1]
cmp al, bl
je 0x1007eb94
cmp al, 0xff
je 0x1007eb94
dec al
mov byte [ecx - 1], al
jmp 0x1007eb9e
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x28]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x1007f760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100893ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x34]
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov byte [esp + 0x18], al
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x34], ebx
mov edx, dword [ecx]
mov dword [esp + 0xc], edx
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x14], ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x3c]
push eax
push ebx
push ecx
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov eax, dword [esi + 0x5c]
mov edx, dword [esp + 0x44]
add esi, 0x30
cmp eax, ebx
mov dword [esp + 0x28], edx
je 0x1007f85f
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
cmp eax, edx
je 0x1007f85f
lea ecx, [eax + 0x20]
cmp ecx, edx
jne 0x1007f81c
mov dword [esp + 0x40], eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x3c], eax
cmp eax, ebx
mov byte [esp + 0x34], 2
je 0x1007f80f
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.100819f0
mov ecx, esi
mov byte [esp + 0x34], bl
call fcn.10080c10
jmp 0x1007f88a
mov edi, eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
cmp edi, ebx
mov byte [esp + 0x34], 3
je 0x1007f88a
mov eax, dword [esp + 0xc]
mov edx, edi
mov dword [edx], eax
mov ecx, dword [esp + 0x10]
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edi + 0xc]
mov dword [edx + 8], eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov edx, dword [esp + 0x28]
mov dword [edi + 0x1c], edx
jmp 0x1007f88a
mov ecx, esi
call fcn.10080c10
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], ecx
lea eax, [ecx + 0x20]
mov dword [esi + 0x1c], eax
cmp ecx, ebx
mov byte [esp + 0x34], 1
je 0x1007f88a
lea edx, [esp + 0xc]
push edx
call fcn.100819f0
mov edx, dword [esi + 0x2c]
mov eax, dword [esp + 0x1c]
inc edx
cmp eax, ebx
mov dword [esi + 0x2c], edx
je 0x1007f8b6
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x1007f8ad
cmp al, 0xff
je 0x1007f8ad
dec al
mov byte [ecx], al
jmp 0x1007f8b6
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x532c413c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x538a36a5
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10043080
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp ecx, edx
je 0x100430a8
push edi
mov edi, esi
mov eax, esi
shr eax, 2
shl edi, 6
add edi, eax
movzx eax, word [ecx]
add eax, 0x9e3779b9
add ecx, 2
add eax, edi
xor esi, eax
cmp ecx, edx
jne 0x10043088
pop edi
mov eax, 3
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
imul eax, eax, 0x7fffffff
sub esi, eax
or esi, 0x40000000
mov eax, esi
pop esi
ret

Function at 0x100430d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100430df
pop dword [ebp - 0x40]
mov eax, 0x540445b9
add eax, 0xbbffeb26
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd069a280
sub dword [ebp - 0x50], 0x82175d35
mov dword [ebp - 0x4c], 0x3c38cd33
sub dword [ebp - 0x4c], 0xa0580ee
mov dword [ebp - 0x48], 0x4c5f96db
sub dword [ebp - 0x48], 0x1352ad
mov dword [ebp - 0x44], 0xcee34960
add dword [ebp - 0x44], 0x311cb6a0
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x154f55fb
sub dword [ebp - 0x50], 0xa0dceca5
mov dword [ebp - 0x4c], 0xdb2306da
add dword [ebp - 0x4c], 0x66495a9b
mov dword [ebp - 0x48], 0x7813ea45
sub dword [ebp - 0x48], 0x14a47dd9
mov dword [ebp - 0x44], 0xe1f925d
sub dword [ebp - 0x44], 0xe1f925d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xc193d7bd
add eax, 0x4e758953
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x58bde
push 0
call eax
mov ecx, 0x561cc77a
sub ecx, 0x561c86ea
mov esi, eax
mov edx, 0xb48bdc58
sub edx, 0xa47efc58
add edx, dword [ebp - 0x40]
mov edi, 0x20d48647
add edi, 0x7878a366
sub dword [ebp - 0x38], 0x623fb408
mov ebx, dword [edx]
add dword [ebp - 8], 0x1a610bb6
xor ebx, edi
add dword [ebp - 0x1c], 0xf21031cc
mov dword [esi], ebx
xor dword [ebp - 0x2c], 0x9a1f4b5f
add esi, 0x8f15e0fd
add esi, 0x70ea1f07
add edx, 0x6844fc19
add edx, 0x97bb03eb
loop 0x100431fc
add eax, 0xf513
mov ebx, eax
add eax, 0x62cea916
sub eax, 0x62cea911
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100858d9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100858ea
pop esi
ret
push ebx
push edi
push esi
call fcn.100430d0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100430d0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10085912
push ebx
push esi
push edi
call fcn.10067180
add esp, 0xc
push 0
call fcn.100430d0
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x419870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x522560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push esi
mov esi, dword [esp + 0x50]
push edi
push 0xff00
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x34], ecx
push 0
push 0
lea ecx, [esp + 0x54]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], eax
call fcn.0050da0e
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x48]
push eax
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.0050d003
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push 5
push ecx
push edx
mov edi, eax
call dword [0x5341a8]
push edi
mov ecx, esi
mov ebx, eax
call fcn.0050d003
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x48]
neg eax
sbb eax, eax
and eax, edx
push eax
call dword [0x5341d4]
mov dword [esp + 0x48], vtable.CGdiObject.0
lea ecx, [esp + 0x48]
mov dword [esp + 0x3c], 1
call fcn.0050d9f8
mov ecx, dword [esp + 0x34]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x14

Function at 0x41e6e0
Capabilities:
Create thread

Disassembly:
push 0xd903
mov word [0x56ddb8], 2
call fcn.004fde54
push 0
mov word [0x56ddba], ax
call fcn.004fde4e
mov dword [0x56ddbc], eax
mov eax, dword [0x56dde0]
push 0x10
push 0x56ddb8
push eax
call fcn.004fde48
cmp eax, 0xffffffff
jne 0x41e73b
mov ecx, dword [0x56ddc8]
call fcn.0041e850
mov ecx, dword [0x56dde0]
push ecx
call fcn.004fde24
call fcn.004fde42
xor eax, eax
ret
mov edx, dword [0x56dde0]
push 0x23
push edx
call fcn.004fde3c
cmp eax, 0xffffffff
jne 0x41e76c
mov ecx, dword [0x56ddc8]
call fcn.0041e850
mov eax, dword [0x56dde0]
push eax
call fcn.004fde24
call fcn.004fde42
xor eax, eax
ret
push 0
push 0
push 0x41e460
call fcn.004f1752
add esp, 0xc
mov eax, 1
ret

Function at 0x41e76e
Capabilities:
Create thread

Disassembly:
push 0xd903
mov word [0x56ddb8], 2
call fcn.004fde54
push 0
mov word [0x56ddba], ax
call fcn.004fde4e
mov dword [0x56ddbc], eax
mov eax, dword [0x56dde0]
push 0x10
push 0x56ddb8
push eax
call fcn.004fde48
cmp eax, 0xffffffff
jne 0x41e73b
mov ecx, dword [0x56ddc8]
call fcn.0041e850
mov ecx, dword [0x56dde0]
push ecx
call fcn.004fde24
call fcn.004fde42
xor eax, eax
ret
mov edx, dword [0x56dde0]
push 0x23
push edx
call fcn.004fde3c
cmp eax, 0xffffffff
jne 0x41e76c
mov ecx, dword [0x56ddc8]
call fcn.0041e850
mov eax, dword [0x56dde0]
push eax
call fcn.004fde24
call fcn.004fde42
xor eax, eax
ret
push 0
push 0
push 0x41e460
call fcn.004f1752
add esp, 0xc
mov eax, 1
ret