joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471ab4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471c86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
jne 0x471c70
xor eax, eax
push ebp
push 0x471c66
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
jmp 0x471c47
cmp dword [ebp - 0x1c], 0x1000
jne 0x471c3f
cmp dword [ebp - 0x18], 1
je 0x471c3f
cmp esi, dword [ebp - 0x28]
je 0x471c3f
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jne 0x471c3f
push 0x104
lea eax, [ebp - 0x236]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
jbe 0x471c3f
mov eax, dword [ebp - 0x28]
call fcn.0043867c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x471c3f
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x471c3f
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x471c3f
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x4dbc20]
mov esi, dword [esi]
mov eax, 0x471c94
mov ecx, 0xe
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471c00
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x4dbc20]
mov esi, dword [esi]
mov eax, 0x471ca4
mov ecx, 0x10
mov edx, dword [ebp - 0x10]
call esi
inc eax
sete dl
mov eax, dword [ebp - 0x28]
call fcn.004711c0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x4dbc20]
mov esi, dword [esi]
mov eax, 0x471cb8
mov ecx, 0xc
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x471c3f
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.00470fe0
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
add ebx, eax
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery
cmp eax, 0x1c
je 0x471b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471c70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471c8d
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__LStrClr_qqrpv
ret
Function at 0x473ecc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x473f91
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0xc], 0
je 0x473f88
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x473f82
cmp dword [ebp - 0x10], 1
jne 0x473f74
mov eax, ebx
mov edx, esi
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
jmp 0x473f82
push 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl250.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47f93c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
lea eax, [ebp - 8]
mov edx, dword [0x47e4f0]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x47f9a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x47f750
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x47f98d
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f9b0
lea eax, [ebp - 8]
mov edx, dword [0x47e4f0]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret

Function at 0x4929b4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov dword [ebp - 4], 0x200
lea eax, [ebp - 0x204]
mov edx, 0x200
call fcn.00403d90
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call sub.rtl250.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4930c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4931cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
lea ecx, [ebp - 4]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
push ebp
push 0x4931a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
lea ecx, [ebp - 8]
mov eax, dword [ebx + 8]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x14]
xor eax, eax
push ebp
push 0x493183
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004928bc
lea edx, [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x4dc004]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x30]
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49318a
lea eax, [ebp - 8]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret
Function at 0x493b58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, eax
push edi
mov esi, edi
lea edi, [ebp - 0x21]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
xor ebx, ebx
mov eax, ebx
movzx eax, al
bt dword [ebp - 0x21], eax
jae 0x493bbd
mov byte [ebp - 1], bl
movzx esi, byte [ebp - 1]
push esi
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x493bbd
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
mov eax, dword [0x4dbb84]
mov eax, dword [eax]
mov ecx, 0x493bd8
mov dl, 1
call fcn.00479a24
mov eax, edi
movzx edx, byte [ebp - 1]
call fcn.00493bf4
inc ebx
test bl, bl
jne 0x493b73
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4995cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4996d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], edx
lea eax, [ebx + 4]
mov edx, esi
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebx + 0xc]
mov edx, dword [0x4320ec]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
mov edi, eax
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System_Variants_Null_qqrv
lea edx, [ebp - 0x10]
lea eax, [ebx + 0x30]
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
jle 0x4996a8
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x499240]
call sub.rtl250.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
mov edi, eax
dec edi
test edi, edi
jl 0x4996b6
inc edi
xor esi, esi
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
sub eax, esi
add eax, eax
mov edx, dword [ebx + 8]
lea eax, [edx + eax*8 - 0x10]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp + 8]
lea eax, [edx + eax*8 + 0x18]
lea edx, [ebp - 0x20]
call sub.rtl250.bpl__System_Rtti_TValue_AsVariant_qqrv
lea edx, [ebp - 0x20]
pop eax
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
inc esi
dec edi
jne 0x499673
jmp 0x4996b6
lea eax, [ebx + 8]
mov edx, dword [0x499240]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4996de
lea eax, [ebp - 0x20]
mov edx, dword [sym.imp.rtl250.bpl___xp_14System_Variant]
mov ecx, 2
call sub.rtl250.bpl__System__FinalizeArray_qqrpvt1ui
ret
Function at 0x4a8760
Capabilities:
Inspect section memory permissions

Disassembly:
xor eax, eax
test edx, 0x20000000
je 0x4a8798
test edx, 0x40000000
je 0x4a8784
test edx, 0x80000000
je 0x4a877f
or eax, 0x40
jmp 0x4a87c2
or eax, 0x20
jmp 0x4a87c2
test edx, 0x80000000
je 0x4a8793
or eax, 0x80
jmp 0x4a87c2
or eax, 0x10
jmp 0x4a87c2
test edx, 0x40000000
je 0x4a87b2
test edx, 0x80000000
je 0x4a87ad
or eax, 4
jmp 0x4a87c2
or eax, 2
jmp 0x4a87c2
test edx, 0x80000000
je 0x4a87bf
or eax, 8
jmp 0x4a87c2
or eax, 1
test edx, 0x4000000
je 0x4a87cf
or eax, 0x200
ret

Function at 0x4a88e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
lea eax, [ebx + 0x44]
mov edx, 0xf8
call fcn.00403d90
lea edx, [ebx + 4]
mov eax, dword [ebx + 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x40]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x28]
lea edx, [ebx + 0x44]
mov eax, dword [ebx + 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0x48]
mov eax, dword [ebx + 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
movzx ecx, word [ebx + 0x58]
lea edx, [ebx + 0x5c]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebx + 4], 0x5a4d
jne 0x4a8970
cmp dword [ebx + 0x44], 0x4550
jne 0x4a8970
cmp word [ebx + 0x48], 0x14c
je 0x4a8986
mov ecx, 0x4a8998
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_Exception_]
call sub.rtl250.bpl__System_Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl250.bpl__System__RaiseExcept_qqrv
pop esi
pop ebx
pop ebp
ret
Function at 0x4a9e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a9f9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
push 1
mov ecx, esi
mov dl, 1
mov eax, dword [0x4a3c1c]
call fcn.004a3ffc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a9f71
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x4a9ed6
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xc], 0
jne 0x4a9ed6
lea eax, [ebp - 4]
mov edx, dword [0x4dbce4]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x4a9f02
mov eax, dword [ebp - 0xc]
call fcn.004a4294
test al, al
je 0x4a9ef2
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x14]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x4a9f02
lea eax, [ebp - 4]
mov edx, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov esi, 0x12
mov ebx, dword [0x4dbce4]
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x10]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebx]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
xor edi, eax
mov eax, edi
xor edx, edx
push edx
push eax
call sub.rtl250.bpl__System_Math_Min_qqrxjxj
mov dword [ebp - 8], eax
add ebx, 8
dec esi
jne 0x4a9f0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9f78
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
Function at 0x4b0fa4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1098
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4b0d28]
call sub.rtl250.bpl__System_TObject__bctr_qqrv
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x4b0fe2
sub edx, 0xfffffff8
call sub.rtl250.bpl__System__IntfCopy_qqrr44System__DelphiInterface_17System_IInterface_x44System__DelphiInterface_17System_IInterf
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x2c], ebx
mov eax, dword [ebp - 0x24]
add eax, 0x30
mov edx, edi
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x34], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x2c]
call fcn.004af7f0
mov eax, dword [ebp - 0x24]
mov byte [eax + 0xc], 0
xor eax, eax
push ebp
push 0x4b107b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dbda4]
cmp byte [eax], 0
je 0x4b1031
call sub.rtl250.bpl__System__TryFinallyExit_qqrv
jmp 0x4b1082
mov eax, dword [0x4dbc04]
cmp dword [eax], 0
je 0x4b1066
cmp dword [0x4dfa94], 0
je 0x4b1066
mov eax, dword [0x4dbc04]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x10]
test ax, ax
je 0x4b1066
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x4b105f
sub edx, 0xffffffc8
xor eax, eax
call sub.AxComponentsRTL.bpl__Axrtl_System_Thread_TThread_Synchronize_qqrp27Axrtl_System_Thread_TThread58System__DelphiInterface_31
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1082
mov eax, dword [ebp - 0x24]
movzx ebx, byte [eax + 0xc]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b109f
lea eax, [ebp - 0x20]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1000e9bf
pop dword [ebp - 0x38]
mov eax, 0xb8df8d08
sub eax, 0xa8dea349
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x23458661
sub dword [ebp - 0x48], 0xd4f34116
mov dword [ebp - 0x44], 0xcb862b2e
sub dword [ebp - 0x44], 0x9952dee9
mov dword [ebp - 0x40], 0xd8adfce5
sub dword [ebp - 0x40], 0x8c61b8b7
mov dword [ebp - 0x3c], 0x6d88847c
add dword [ebp - 0x3c], 0x92777b84
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x7d2a518f
add dword [ebp - 0x48], 0xf74817c7
mov dword [ebp - 0x44], 0xcec64cdb
add dword [ebp - 0x44], 0x72a6149a
mov dword [ebp - 0x40], 0x46139114
sub dword [ebp - 0x40], 0xe2a424a8
mov dword [ebp - 0x3c], 0xe3e954bf
add dword [ebp - 0x3c], 0x1c16ab41
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3772d
push 0
call eax
mov ecx, 0x4b8e
xor ebx, ebx
add ebx, eax
mov edx, 0x80bed3e4
sub edx, 0x70bcabe4
add edx, dword [ebp - 0x38]
mov edi, 0x9f04490c
sub edi, 0x9042650e
xor dword [ebp - 0x34], esi
mov esi, dword [edx]
sub dword [ebp - 0x24], ecx
add esi, edi
sub dword [ebp - 0x1c], edx
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x5d24518a
add ebx, 0x47159902
sub ebx, 0x471598fe
add edx, 0x3ae71cb
add edx, 0xfc518e39
loop 0x1000ead3
add eax, 0x5069bae7
add eax, 0xaf976624
mov ebx, eax
add eax, 0x9cd2189
sub eax, 0x9cd2184
mov ecx, 0xbc7848e0
add ecx, 0x5387b720
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x5a383a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5a3879
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a3879
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a3879
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5a3879
cmp dword [ecx + 0x74], 0xe
jbe 0x5a3879
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5aab2a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5aabc7
push ebx
push esi
call fcn.005aaaf3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005aaa87
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5aab74
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5aabc6
push edi
push eax
call fcn.005a948b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5aab94
call fcn.005a94d9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5aabc5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005aaa87
add esp, 0x20
test eax, eax
jne 0x5aabb3
push edi
call fcn.005a94d9
jmp 0x5aabbb
push ebx
call fcn.005a94d9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5abdd6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b4b80
push 0x5b4b78
push str.FlsAlloc
push 0x1f
call fcn.005abc95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5abe0a
push dword [ebp + 8]
mov ecx, esi
call dword [0x5b2134]
call esi
jmp 0x5abe10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x5abe54
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b4b90
push 0x5b4b88
push str.FlsGetValue
push 0x21
call fcn.005abc95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5abe8b
push dword [ebp + 8]
mov ecx, esi
call dword [0x5b2134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x5abe93
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b4b98
push 0x5b4b90
push str.FlsSetValue
push 0x22
call fcn.005abc95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5abecd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5b2134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5b1290
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5b12bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5b12bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4151c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x4151e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4151e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4151d8
mov eax, 1
add ebx, ebx
jne 0x4151fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4151f0
jne 0x41520c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4151f0
xor ecx, ecx
sub eax, 3
jb 0x415220
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415292
mov ebp, eax
add ebx, ebx
jne 0x41522b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415238
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41525c
inc ecx
add ebx, ebx
jne 0x415248
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41523d
jne 0x415259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41523d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41527c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41526d
jmp 0x4151de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41527c
add edi, ecx
jmp 0x4151de
pop esi
mov edi, esi
mov ecx, 0x22b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41529a
cmp byte [edi], 5
jne 0x41529a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41529f
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x41530e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a20]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4152cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a28]
or eax, eax
je 0x415308
mov dword [ebx], eax
add ebx, 4
jmp 0x4152e9
call dword [esi + 0x19a24]
mov ebp, dword [esi + 0x19a2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415342
sub esp, 0xffffff80
jmp 0x403008