joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40174f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
call fcn.004013e9
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x402240
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017a2
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x40225c
push dword [ebp - 8]
call esi
push 0x402274
push dword [ebp - 8]
call esi
push 0x40228c
push dword [ebp - 8]
call esi
call fcn.0040161a
call fcn.00401294
push 0x3e80
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 4], 0x3e8
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.00401081
test eax, eax
je 0x4017fc
push edi
mov edi, dword [ebp - 4]
test edi, edi
je 0x4017fb
mov esi, ebx
mov eax, 0x7277
cmp word [esi + 4], ax
jne 0x4017f3
mov ecx, esi
call fcn.0040122d
add esi, 0x10
sub edi, 1
jne 0x4017e1
pop edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.004013a0
pop esi
pop ebx
test eax, eax
je 0x40184e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040147c
pop ecx
pop ecx
test eax, eax
je 0x40184e
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x218]
push eax
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.004014ca
pop ecx
pop ecx
test eax, eax
je 0x40184e
lea ecx, [ebp - 0x218]
call fcn.00401591
call section..text
xor eax, eax
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x726f51b2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4168309a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xa0376b1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2ceb6ef1
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x68d86660
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
mov eax, str.7St
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x537729c4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403a1c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1498
call fcn.00405810
push edi
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov al, byte [0x415e98]
invalid
invalid

Function at 0xf912f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xf89410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0xf91314
push ebx
call dword [0xfa201c]
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xc], 0x646f632e
mov dword [ebp - 8], 0x65
movzx edi, word [esi + 0x14]
push dword [esi + 0x88]
add edi, 0x18
push esi
add edi, esi
call fcn.00f8a824
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0xf913bd
movzx edx, word [esi + 6]
xor ecx, ecx
test edx, edx
jle 0xf9136a
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0xf91362
lea eax, [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 4]
je 0xf9136a
add edi, 0x28
inc ecx
cmp ecx, edx
jl 0xf9134e
cmp ecx, edx
je 0xf913bd
mov ecx, dword [esi + 0x34]
add ecx, dword [edi + 0xc]
mov edi, 0xf8ae30
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [edi + edx*4]
jne 0xf913bd
inc edx
cmp edx, 4
jne 0xf9137b
xor edx, edx
mov eax, dword [ecx + edx*4 + 0x140]
cmp eax, dword [edi + edx*4]
jne 0xf913bd
inc edx
cmp edx, 4
jne 0xf9138b
cmp dword [ecx + 0x124], 0
je 0xf913ad
push 0xf9167c
jmp 0xf913b2
push 0xf91661
push esi
push ebx
push ecx
call fcn.00f913ce
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00f92d46
mov esp, ebp
pop ebp
ret
Function at 0xfd1b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00fe5670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00fe4ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0xfd1c55
mov ecx, esi
call fcn.00fe4ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00fe4ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00fe4ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00fe4ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00fcf380
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00fe4ef0
lea ecx, [ebx + eax]
call fcn.00fcf380
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00fe4ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00fcf380
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.00fe4d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00fe61c0

Function at 0xfd1c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00fe5670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00fe4ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0xfd1d55
mov ecx, esi
call fcn.00fe4ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00fe4ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00fe4ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00fe4ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00fcf420
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00fe4ef0
lea ecx, [ebx + eax]
call fcn.00fcf420
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00fe4ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00fcf420
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.00fe4d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00fe61c0
Function at 0xfd1d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push edi
call fcn.00fe5670
mov ecx, ebx
call fcn.00fe4ef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0xfd1dff
mov ecx, ebx
call fcn.00fe5670
cmp dword [edi + 0x28], 0xffffffff
jne 0xfd1dab
cmp dword [edi + 0x2c], 0xffffffff
je 0xfd1de9
push esi
mov esi, dword [edi + 0x28]
lea ecx, [esp + 0xc]
mov edi, dword [edi + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
call fcn.00fd1b20
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.00fd1b20
pop esi
push dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x24]
call fcn.00fe4d20
mov ecx, ebx
call fcn.00fe61c0
pop edi
mov ecx, ebx
pop ebx
add esp, 0x10
jmp fcn.00fe61c0

Function at 0xfd1e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
push edi
call fcn.00fe5670
mov ecx, esi
call fcn.00fe4ef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0xfd1e92
mov ecx, esi
call fcn.00fe5670
cmp dword [edi + 0x28], 0xffffffff
jne 0xfd1e4b
cmp dword [edi + 0x2c], 0xffffffff
je 0xfd1e7c
push dword [edi + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push dword [edi + 0x28]
mov dword [esp + 0x18], 0xffffffff
push esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00fce0a0
lea ecx, [esp + 8]
call fcn.00fcc780
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.00fe4d20
mov ecx, esi
call fcn.00fe61c0
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00fe61c0

Function at 0xfd1ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00fe5670
mov ecx, edi
call fcn.00fe4ef0
mov esi, eax
add esi, dword [esp + 0x10]
lea ecx, [esi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0xfd1f3d
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
cmp ecx, 0xffffffff
jne 0xfd1ed7
cmp eax, ecx
je 0xfd1ee0
push eax
push ecx
mov ecx, edi
call fcn.00fe4d20
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0xffffffff
jne 0xfd1eef
cmp eax, ecx
je 0xfd1ef8
push eax
push ecx
mov ecx, edi
call fcn.00fe4d20
cmp dword [esi + 0x18], 0xffffffff
jne 0xfd1f04
cmp dword [esi + 0x1c], 0xffffffff
je 0xfd1f13
push dword [esi + 0x1c]
push dword [esi + 0x18]
push edi
call fcn.00fd1b70
add esp, 0xc
cmp dword [esi + 0x20], 0xffffffff
jne 0xfd1f1f
cmp dword [esi + 0x24], 0xffffffff
je 0xfd1f2e
push dword [esi + 0x24]
push dword [esi + 0x20]
push edi
call fcn.00fd1c70
add esp, 0xc
push dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x14]
call fcn.00fe4d20
mov ecx, edi
pop edi
pop esi
jmp fcn.00fe61c0
Function at 0xfd1f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
push edi
call fcn.00fe5670
mov ecx, esi
call fcn.00fe4ef0
mov edi, eax
add edi, dword [esp + 0x10]
lea ecx, [edi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0xfd1fb4
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
cmp ecx, 0xffffffff
jne 0xfd1f87
cmp eax, ecx
je 0xfd1f90
push eax
push ecx
mov ecx, esi
call fcn.00fe4d20
mov edx, dword [edi + 0x10]
mov eax, edx
mov ecx, dword [edi + 0x14]
or eax, ecx
je 0xfd1fa5
push ecx
push edx
mov ecx, esi
call fcn.00fe4d20
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.00fe4d20
pop edi
mov ecx, esi
pop esi
jmp fcn.00fe61c0
Function at 0x1079370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0x10793d6
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov dword [esp + 0x14], eax
mov edi, dword [eax + 0x78]
add edi, ebx
cmp dword [edi + 0x18], esi
jbe 0x10793d6
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x20]
lea eax, [eax + esi*4]
mov ecx, dword [eax + ebx]
add ecx, ebx
test ecx, 0xffff0000
je 0x10793c5
test edx, 0xffff0000
je 0x10793c5
push edx
push ecx
call dword [0x100df134]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
jmp 0x10793cc
xor eax, eax
cmp ecx, edx
sete al
test eax, eax
jne 0x10793dd
inc esi
cmp esi, dword [edi + 0x18]
jb 0x1079397
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ebp, dword [eax + ebx]
add ebp, ebx
cmp ebp, edi
jb 0x10793d6
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
add eax, edi
cmp ebp, eax
ja 0x10793d6
xor ecx, ecx
mov eax, ebp
cmp byte [ebp], cl
je 0x1079419
lea esp, [esp]
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x1079410
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
je 0x107942d
push esi
call fcn.01073830
add esp, 4
mov edi, eax
push esi
push ebp
push edi
call fcn.01073930
add esp, 0xc
mov esi, edi
cmp byte [edi], 0
je 0x107944b
nop
cmp byte [esi], 0x2e
je 0x107945d
inc esi
cmp byte [esi], 0
jne 0x1079440
push edi
xor esi, esi
call fcn.01073820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov byte [esi], 0
call dword [0x100df1e0]
mov ecx, eax
lea eax, [esi + 1]
push eax
push ecx
call fcn.01079370
add esp, 8
mov esi, eax
push edi
call fcn.01073820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x421d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xc
mov eax, dword [0x5bdd90]
xor eax, ebp
je 0x421ded
jne 0x421ded
mov eax, dword [0xe91580]
adc dword [ecx - 0x3deecaae], edi
mov eax, 0x106de560
lea ecx, [esi + 0x37c]
cmp byte [ebx + 0xac], 1
push 0xadae0c
push 0xa29f90
mov eax, dword [0x112ae170]
push 0xacc620
push 0x114849e0
mov dword [0x100ce454], eax
lea esi, [eax*4]
push 0x7b3480
dec ecx
cld
push eax
aaa
dec esp
cli
lds edi, [edi]
cmc
push esp
loope 0x421d9c
jmp 0x52fb2ea1
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [edi]
mov ecx, dword [edi + 4]
jmp 0x4227a3
shr eax, 8
push 0x421e83
ret
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
jmp 0x4224c7
push edx
pop eax
jmp 0x421e39
mov eax, 0x473530
xchg edx, eax
ja 0x4225b9
pushal
mov al, byte [0x28c496de]
popal
cli
shr eax, 8
je 0x422b79
jne 0x422b79
mov eax, 0x4a0944
push reloc.wtsapi32.dll_WTSSetSessionInformationW
push 0x47e334
call dword [0x9a8358]
mov dword [0x445268], 0x445238
xor eax, 0x46e53b96
xchg esi, eax
cmp esp, ebp
inc esi
jno 0x42257a
outsb dx, byte [esi]
into
mov al, 0xb3
mov eax, dword [0xf681827]
mov dh, 0x47
invalid
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
push ecx
pop eax
shr eax, 0x10
mov byte [ebp - 0xb], al
lea edx, [esi*8]
mov eax, ecx
je 0x42258a
jne 0x42258a
mov edi, 0x4752e0
push 0xa00ddc
cmp dword [ebp - 0x264], edi
fld qword [ebx + 0x10]
push 0xd2c
add byte [0xcc00623c], ch
mov dword [edi + esi + 0x5d], eax
cmp dword [ebp - 0x114c], 0x449
add byte [ebp - 0x15], al
jmp dword [ecx*4 + 0x4b0f00]
mov eax, esi
shr eax, 0x1d
shl ecx, 3
or ecx, eax
je 0x422608
jne 0x422608
push 0x902
mov ecx, 0x103e3618
or dword [0xe482a8], 1
push 0xb50ad0
push 0x11470d40
mov edx, dword [ebp - 0x9cf8]
push 0xa8b5f0
jmp dword [ecx*4 + 0x4286f0]
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
je 0x421f93
jne 0x421f93
add ax, 0x30
call dword [0x45e178]
push 0xb14744
mov dword [ebx], 0x1010a530
adc dword [edx - 0x6deec0e8], edx
add eax, 0xe453a0
push 0x100e0cd0
push 0xb129e0
push 0xaeb480
mov edi, 0x45160a
fld dword [esp + 0x1c]
jmp dword [0x106e0370]
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx