joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6f5c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004d6f48
test eax, eax
jne 0x4d6f7d
mov eax, esi
call fcn.004048fc
jmp 0x4d700e
mov eax, ebx
call fcn.004d70ac
test al, al
je 0x4d6fc3
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004049ec
test edi, edi
je 0x4d6fba
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4d700e
mov eax, esi
call fcn.004048fc
jmp 0x4d700e
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x4d7007
mov eax, dword [ebp + 0x208]
call fcn.0041d2e4
test eax, eax
jle 0x4d6ff5
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.0047a820
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00404950
jmp 0x4d700e
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.00404950
jmp 0x4d700e
mov eax, esi
call fcn.004048fc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d8cfc
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00407100
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x523438
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x523450
mov eax, ebx
call fcn.00522ccc
cmp dword [ebx + 0x68], 0
jne 0x52345d
mov eax, ebx
call fcn.00522c28
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x52360d
cmp dword [ebx + 0x68], 0
je 0x52360d
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00522a98
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00531c8c
cmp eax, dword [esp]
je 0x5234df
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00531ca0
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5234bb
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00531c8c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5234d4
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x5234f2
mov eax, dword [eax + 0x18]
call fcn.00451bec
mov esi, eax
jmp 0x5234f5
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x52350a
or esi, 0xffffffff
jmp 0x523514
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0044ab04
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.0044ab28
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0044ab50
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0044ab74
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040711c
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00451bec
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00451bec
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00451bec
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042e56c
call fcn.00429b78
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00451bec
push eax
call dword [0x5abe4c]
push 4
mov eax, dword [ebx + 0x68]
call fcn.00451bec
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x523874
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.004033c4
lea eax, [esp + 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x523a60
push 0
push 0x523a68
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x523a60
push 0
push 0x523a78
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x523a60
push 0
push 0x523a88
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x523a60
push 0
push 0x523a98
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x523a60
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x523a60
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x523a60
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x523a60
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x523a60
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x523a4c
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x523a42
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x523a42
test byte [esp + 0x1d], 0xd
jne 0x523a42
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x523a42
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x523a42
cmp dword [esp + 0xc], 0
je 0x523a42
mov eax, dword [0x5aa900]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x523a42
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x523a1e
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x523a4c
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.00407160
jmp 0x523a4c
cmp ebx, dword [esp + 4]
jl 0x523982
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x52da6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52dadd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5a96b8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x52dac7
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0052da5c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x52d834]
call fcn.0052db04
mov dword [0x5a971c], eax
mov eax, dword [ebp - 4]
call fcn.0052da0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52dae4
lea eax, [ebp - 8]
call fcn.004068a0
ret

Function at 0x52dcbc
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.004033c4
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x52dd54
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x5a96b0], eax
cmp dword [0x5a96b0], 0
je 0x52dd4c
cmp dword [0x5a96b4], 0
jne 0x52dd4c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a04f4]
call fcn.004a0d90
mov dword [0x5a96b4], eax
mov edx, dword [0x5a96b0]
mov eax, dword [0x5a96b4]
call fcn.00458a0c
mov eax, dword [0x5a96b4]
mov byte [eax + 0x42], 1
mov dl, 1
mov eax, dword [0x5a96b4]
call fcn.004a2454
push 0xffffffffffffffff
mov eax, dword [0x5a96b4]
call fcn.00458a48
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x160
ret

Function at 0x53260c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040a324
test al, al
je 0x532693
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.004033c4
or esi, 0x100
test esi, esi
jns 0x532647
call fcn.004039a4
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404dbc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x532693
mov dl, 1
mov eax, dword [0x427ba8]
call fcn.0042fb90
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0042ff9c
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x532693
mov eax, esp
call fcn.004101b8
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x563230
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004033c4
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x566e64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push esi
push edi
push ebx
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [esi], eax
add esi, 4
add edx, 4
dec ecx
jne 0x566e7e
mov ecx, 0x30
mov edi, dword [esi - 0x1c]
mov eax, dword [esi - 8]
mov ebx, eax
mov edx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x566e97
pop ebx
pop edi
pop esi
pop ecx
pop ecx
pop ebp
ret
Function at 0x570cd8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x570dd3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0x570de0
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 4]
call fcn.00407f94
movzx eax, ax
lea ecx, [ebp - 0x220]
mov edx, 4
call fcn.00409dd4
push dword [ebp - 0x220]
push 0x570dec
lea ecx, [ebp - 0x224]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.00409dd4
push dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404c7c
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
mov edx, 0x570dec
call fcn.0057299c
mov edx, dword [ebp - 0x218]
mov eax, ebx
mov ecx, 0xff
call fcn.00404b98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570dda
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00404920
ret

Function at 0x571274
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dac
xor eax, eax
push ebp
push 0x5712fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.00407fb0
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x571310
mov edx, dword [ebp - 4]
call fcn.00404c08
mov eax, dword [ebp - 0x28]
call fcn.00404dbc
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x571301
lea eax, [ebp - 0x28]
call fcn.004048fc
lea eax, [ebp - 4]
call fcn.004048fc
ret

Function at 0x574798
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x5747d0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5747ae
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5747bd
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5747cc
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x575dc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x575e24
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b6c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409e38
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575e2b
lea eax, [ebp - 0xc]
call fcn.004048fc
ret
Function at 0x575e88
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x575ee4
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x575eb3
call fcn.0040fbe0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402cec
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x575ee4
call fcn.0040fbe0
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x57c414
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x5aab68]
cmp dword [eax], 2
je 0x57c432
mov ecx, 0x30e
mov edx, 0x57c464
mov eax, 0x57c4ac
call fcn.00404858
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x57c3b4
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5ac8f4], eax
cmp dword [0x5ac8f4], 0
jne 0x57c459
call fcn.0040fbe0
ret

Function at 0x57c6e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x5aa578]
cmp byte [eax], 0
jne 0x57c70e
mov ecx, 0xaf
mov edx, 0x57c75c
mov eax, 0x57c7a4
call fcn.00404858
mov eax, ebx
call fcn.00405008
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x57c74d
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040519c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57c7b8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x5aa578]
cmp byte [eax], 0
jne 0x57c7db
mov ecx, 0xbd
mov edx, 0x57c81c
mov eax, 0x57c864
call fcn.00404858
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x57c80e
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x57c80e
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x57c80e
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617

Function at 0x408943
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
call fcn.0040895d
xor dword [ecx], ebx
inc ecx
cmp ecx, esi
jne fcn.00408943
ret
Function at 0x46ca80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46caad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46caad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5df450f1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4c032802
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x7b
mov cl, byte [eax]
inc eax
nop
xor cl, byte [eax]
lea eax, [eax + 1]
sub edx, 1
jne 0x401cc0
xor eax, eax
cmp cl, byte [ebp + 0xc]
sete al
dec eax
pop ebp
ret

Function at 0x401ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x7b
mov dl, byte [eax]
inc eax
mov byte [edi], dl
mov cl, byte [eax]
lea eax, [eax + 1]
xor cl, dl
mov byte [edi], cl
mov dl, cl
sub esi, 1
jne 0x401cf5
pop edi
pop esi
pop ebp
ret

Function at 0x404230
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x422170]
xor eax, ebp
mov dword [ebp - 4], eax
push str.hig_tras
mov dword [0x423ec8], 0
mov byte [0x422c02], 0
call 0x4043a2
lea eax, [ebp - 0x194]
push eax
push 0x101
call 0x404396
test eax, eax
jne 0x404350
call fcn.00401c90
cmp byte [0x422c02], 0
jne 0x404327
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402ac0
mov eax, dword [0x423ec8]
dec eax
cmp eax, 0xd
ja case.0x4042a7.2
movzx eax, byte [eax + 0x404388]
jmp dword [eax*4 + 0x404370]
call fcn.00403c70
jmp case.0x4042a7.2
call fcn.00401000
cmp eax, 2
jne 0x4042cb
push 0
call fcn.00401b20
add esp, 4
jmp case.0x4042a7.2
call fcn.00402d00
jmp case.0x4042a7.2
push 0x41a238
push str.hig_tras
push 0x41a250
call sub.cscmhfws.dll_coalrms
add esp, 0xc
call fcn.00401000
cmp eax, 2
jne 0x4042ff
push 0
call fcn.00401b20
add esp, 4
jmp case.0x4042a7.2
call fcn.004034d0
jmp case.0x4042a7.2
call fcn.00403970
jmp case.0x4042a7.2
call fcn.00403e80
push 0x1f4
call esi
cmp byte [0x422c02], 0
je 0x404290
pop esi
push 0
mov dword [0x423ec8], 9
call fcn.00401b20
add esp, 4
call sub.subsysdl.dll__proc_end_0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0040554d
mov esp, ebp
pop ebp
ret
push str.WSAStartup
push str.hig_tras
push 0x41a234
call sub.cscmhfws.dll_coalrms
add esp, 0xc
push 1
call fcn.0040870f
nop
scasb al, byte es:[edi]
inc edx
inc eax
add byte [ebp + 0x6004042], dh
inc ebx
inc eax
add dl, dl
inc edx
inc eax
add byte [0x12004043], cl
inc ebx
inc eax
add byte [eax], al
add eax, 0x2050105
add eax, 84083973
add eax, 637469701
sbb al, 161
inc ecx
add bh, bh
and eax, sym.imp.WSOCK32.dll_WSACleanup
jmp dword [sym.imp.subsysdl.dll__proc_begin_4]
Function at 0x405d52
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405d91
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405d91
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405d91
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405d91
cmp dword [ecx + 0x74], 0xe
jbe 0x405d91
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d95b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bc70
push 0x41bc68
push str.FlsAlloc
push 0x1e
call fcn.0040d81c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d98f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a190]
call esi
jmp 0x40d995
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d9d9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bc80
push 0x41bc78
push str.FlsGetValue
push 0x20
call fcn.0040d81c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40da10
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a190]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x410c71
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x410d0e
push ebx
push esi
call fcn.00410c3a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00410b83
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x410cbb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x410d0d
push edi
push eax
call fcn.0040dbb7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x410cdb
call fcn.0040db7d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x410d0c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00410b83
add esp, 0x20
test eax, eax
jne 0x410cfa
push edi
call fcn.0040db7d
jmp 0x410d02
push ebx
call fcn.0040db7d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x410d11
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x410d22
pop esi
ret
push ebx
push edi
push esi
call fcn.00410c3a
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0040dbb7
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x410d4a
push ebx
push esi
push edi
call fcn.004061f0
add esp, 0xc
push 0
call fcn.0040db7d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x411496
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410fbd