joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7ec0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c806b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c804c
mov dl, 1
mov eax, dword [0x48c34c]
call fcn.004afd10
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409c7c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c803b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052c1c4
test al, al
je 0x5c802e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c807c
lea eax, [ebp - 0x394]
call fcn.00424124
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5c802e
xor eax, eax
push ebp
push 0x5c8027
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c80ec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5c8010
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a7c4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c8010
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a7c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c802e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c7f31
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004afc34
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c8072
lea eax, [ebp - 0x3a0]
call fcn.00409c7c
ret

Function at 0x5c8c78
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x600168]
cmp byte [eax + 0xc5], 0
jne 0x5c8cea
cmp dword [0x60018c], 0
jne 0x5c8caa
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x5f897c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x60018c], eax
cmp dword [0x600188], 0
jne 0x5c8cc5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x600188], eax
cmp dword [0x600190], 0
jne 0x5c8cea
push esp
push 0
push 0
mov eax, dword [0x5f8978]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x600190], eax
pop edx
ret
Function at 0x5c910c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c9123
add esp, 0xfffffff0
call fcn.00408518
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c06e8
mov eax, dword [0x5f8a50]
cmp byte [eax], 0
jne 0x5c9150
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5f8da0]
cmp word [eax + 2], 0
jne 0x5c916a
mov eax, dword [0x5f8da0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cb500
mov eax, dword [0x5f8ee0]
cmp word [eax + 2], 0
jne 0x5c9184
mov eax, dword [0x5f8ee0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cb704
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4f1e34]
call fcn.004f835c
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5cbc7c
mov dl, 1
mov eax, dword [0x488990]
call fcn.00407e60
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x488990]
call fcn.00407e60
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f6bd0]
call fcn.005025b4
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c9374
mov eax, dword [0x5f8c4c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00502ad0
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5cbf64
mov dl, 1
mov eax, dword [0x488990]
call fcn.00407e60
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5f8c4c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00423f24
test eax, eax
je 0x5c929e
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00423d7c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00423f08
test eax, eax
je 0x5c92b6
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a7c4
push ebx
push 0x5caedc
call fcn.005be318
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5f8a50]
cmp byte [eax], 0
jne 0x5c9307
mov eax, ebx
call fcn.005c9558
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005cc19c
mov eax, ebx
call fcn.005cce3c
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c936b
call fcn.00408570
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c989c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c993e
cmp dword [ebx + 0xac], 0
jne 0x5c9938
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c97d8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c9938
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c98fe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c9938
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004ab1a4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c990d
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c9bf8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x600168]
cmp dword [eax + 0x188], 0
je 0x5c9d72
test bl, bl
jne 0x5c9cbd
cmp dword [esi + 0xb4], 0
jne 0x5c9cb2
mov eax, esi
call fcn.005ccc8c
push eax
push 0x5c9aec
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c9c83
mov eax, dword [0x600168]
cmp byte [eax + 0xeb], 0
je 0x5c9c83
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5c9c64
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c9c83
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c9c6c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c9cb2
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab1a4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c9c92
inc dword [esi + 0xb4]
jmp 0x5c9d72
cmp dword [esi + 0xb4], 0
jle 0x5c9d72
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c9d72
cmp dword [esi + 0x58], 0
je 0x5c9d27
mov eax, dword [0x600168]
cmp byte [eax + 0xeb], 0
je 0x5c9d27
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5c9d08
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c9d27
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c9d10
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c9d56
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab1a4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c9d36
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5bab5c]
call fcn.0040c048
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5caa10
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5caa6d
cmp byte [ebx + 0xeb], 0
jne 0x5caa6d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e04
mov eax, dword [esi]
test eax, eax
je 0x5caa5a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5caa7a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a05c
jmp 0x5caa7a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a05c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5cc3b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5cc421
mov eax, esi
call fcn.00525cd8
test al, al
je 0x5cc421
mov eax, dword [ebx + 0x98]
call fcn.00525904
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5cc421
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5cc412
push 0
mov eax, dword [ebx + 0x98]
call fcn.00525904
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0051c300
jmp 0x5cc421
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005cc1bc
pop esi
pop ebx
ret
Function at 0x5d338c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5d340a
mov eax, dword [ebx + 8]
call fcn.00525904
mov ecx, eax
mov dl, 1
mov eax, dword [0x532f20]
call fcn.0051f9c0
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.00538778
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5d2c5c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00525904
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00525904
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d3484
mov eax, dword [ebx + 8]
call fcn.00525904
mov ecx, eax
mov dl, 1
mov eax, dword [0x532f20]
call fcn.0051f9c0
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.00538778
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5d2ca8
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00525904
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00525904
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5d34f2
mov eax, dword [ebx + 8]
call fcn.00525904
mov ecx, eax
mov dl, 1
mov eax, dword [0x5339bc]
call fcn.0051f9c0
mov dword [ebx + 0x94], eax
mov eax, dword [ebx + 0x94]
mov byte [eax + 0x2a0], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00525904
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.00525904
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x582810
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x104000]
push edi
jmp 0x58282a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x582831
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582820
mov eax, 1
add ebx, ebx
jne 0x582843
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x582854
jne 0x582873
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582873
dec eax
add ebx, ebx
jne 0x582860
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x582838
add ebx, ebx
jne 0x58286f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5828c5
xor ecx, ecx
sub eax, 3
jb 0x58288b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5828fa
sar eax, 1
mov ebp, eax
jmp 0x582896
add ebx, ebx
jne 0x582896
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582864
inc ecx
add ebx, ebx
jne 0x5828a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582864
add ebx, ebx
jne 0x5828b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5828a6
jne 0x5828c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5828a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5828e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5828d6
jmp 0x582826
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5828e4
add edi, ecx
jmp 0x582826
pop esi
mov edi, esi
mov ecx, 0x4002
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x582902
cmp byte [edi], 0x19
jne 0x582902
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x582907
lea edi, [esi + 0x180000]
mov eax, dword [edi]
or eax, eax
je 0x58297f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c2ca4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c2da0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x582934
mov ecx, edi
jns 0x582963
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c2da8]
or eax, eax
je 0x582979
mov dword [ebx], eax
add ebx, 4
jmp 0x582951
call dword [esi + 0x1c2da4]
mov ebp, dword [esi + 0x1c2dac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x25f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5829b3
sub esp, 0xffffff80
jmp 0x4da93d
Function at 0x404837
Capabilities:
Get disk information

Disassembly:
mov eax, 0x429b10
call fcn.00428650
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401f1f
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x40490d
mov eax, SysReAllocString
cmp ebx, eax
ja 0x404873
mov eax, ebx
add eax, eax
push eax
call fcn.00405733
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x404906
cmp ebx, dword [ebp - 0x18]
ja 0x404906
lea ecx, [ebp - 0x2c]
call fcn.00402679
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4048ee
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4048e3
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401d25
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x4048b1
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402153
push esi
call fcn.00402153
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x40490f
push esi
call fcn.00402153
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x405742
pop dword [ebp - 0x24]
mov eax, 0x405742
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3e0be
push 0
mov eax, 0xa78b4c8a
add eax, 0x58b773a2
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xac28955d
add ecx, 0x53d7c5b7
xor edx, edx
add edx, eax
mov ebx, 0x23cbbe29
sub ebx, 0x23880629
add ebx, dword [ebp - 0x24]
mov edi, 0x574d0087
add edi, 0xd0826059
xor dword [ebp - 0x10], esi
mov esi, dword [ebx]
add dword [ebp - 8], 0xbfa907e0
add esi, edi
xor dword [ebp - 0x1c], 0xd58d92a
mov dword [edx], esi
xor dword [ebp - 0x14], ecx
add edx, 0x84de9b99
add edx, 0x7b21646b
add ebx, 4
loop 0x40579e
add eax, 0xd88324e3
sub eax, 0xd881c5c0
xor ebx, ebx
add ebx, eax
add eax, 0xbef222b3
sub eax, 0xbef222ae
mov ecx, 0x31c1f127
sub ecx, 0x3181f127
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10001020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10001047
push 0
push 0
push 0
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10004397
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100043d6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100043d6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100043d6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100043d6
cmp dword [ecx + 0x74], 0xe
jbe 0x100043d6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000705f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100070fc
push ebx
push esi
call fcn.10007028
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10006fbc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100070a9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100070fb
push edi
push eax
call fcn.1000801a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100070c9
call fcn.10005b04
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100070fa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10006fbc
add esp, 0x20
test eax, eax
jne 0x100070e8
push edi
call fcn.10005b04
jmp 0x100070f0
push ebx
call fcn.10005b04
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007369
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e4f8
push 0x1000e4f0
push str.FlsAlloc
push 0x1f
call fcn.10007285
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000739d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d118]
call esi
jmp 0x100073a3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100073e7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e508
push 0x1000e500
push str.FlsGetValue
push 0x21
call fcn.10007285
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000741e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d118]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10007426
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e510
push 0x1000e508
push str.FlsSetValue
push 0x22
call fcn.10007285
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007460
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000d118]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000cae0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000cb0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000cb0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000c004
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1000dec0
call fcn.1000c190
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1000f98c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1000bda7
cmp eax, esi
jne 0x1000bd9a
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1000bdaa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000bd81
xor esi, esi
inc esi
mov eax, dword [0x1000f988]
cmp eax, esi
jne 0x1000bdbd
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x1000bdec
mov eax, dword [0x1000f988]
test eax, eax
jne 0x1000bde6
mov dword [0x1000f988], esi
push 0x100012ac
push 0x100012a0
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x1000bdec
jmp 0x1000bf14
mov dword [0x1000f644], esi
mov eax, dword [0x1000f988]
cmp eax, esi
jne 0x1000be10
push 0x1000129c
push 0x1000128c
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x1000f988], 2
test ebx, ebx
jne 0x1000be1c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1000f998], 0
je 0x1000be40
push 0x1000f998
call fcn.1000c500
pop ecx
test eax, eax
je 0x1000be40
push 0
push 2
push 0
call dword [0x1000f998]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1000be9c
test al, al
je 0x1000be5a
cmp dword [ebp - 0x1c], 0
jne 0x1000be9c
mov al, byte [esi]
test al, al
je 0x1000be6a
cmp al, 0x20
ja 0x1000be6a
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1000be5a
test byte [ebp - 0x3c], 1
je 0x1000be76
movzx eax, word [ebp - 0x38]
jmp 0x1000be79
push 0xa
pop eax
push eax
push esi
push 0
push 0x10000000
call main
mov dword [0x1000f640], eax
cmp dword [0x1000f634], 0
jne 0x1000bef0
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x1000beab
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x1000bebe
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1000be47
cmp dword [0x1000f644], 0
jne 0x1000beff
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1000f640]
jmp 0x1000bf20
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.1000c1d5
ret
call 0x1017d000
jmp 0x1000bd47

Function at 0x1000c020
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f15c]
jne 0x1000c02a
repz ret
jmp fcn.1000c685