joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2f4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dh, 1
sub esi, ebx
xor ebx, 0xfd
sub edi, 0x1c
xor edx, 1
mov ecx, ebp
xor esi, ebx
sub ebx, 0x9e
xor ebx, edi
add ecx, 0xa6
xor esi, ebx
and esi, 6
or esi, 6
sub edx, 0x6a
mov ecx, ebp
xor edx, 0x5d
add edi, 5
sub esi, 0x800
xor edi, 0x6a
add edi, edi
add ecx, 0x3c
add edx, 0x92
mov edi, edx
add edi, 0x94
add edx, 0x7fffffff
add edx, 0x42
sub eax, dword [ecx]
or ebx, 0x28
mov ecx, ebp
add edx, 0x80
add ecx, 0x96
add eax, dword [ecx]
or esi, 0x4a
sub edx, 0xc1
and edi, 0xf0
mov ecx, ebp
add ebx, 0x6a
or edx, esi
add ecx, 0xa6
and dword [ecx], eax
sub esi, 0x400
xor edx, 0x7f
and esi, 0x71
mov ecx, ebp
sub esi, 0x4a
xor ebx, eax
add ecx, 0x3c
or edi, edx
xor dword [ecx], 0x4a70cc2f
sub edi, eax
Function at 0x5207be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esi, 0x80
mov esi, 1
mov esi, 0xa
xor edx, 0x37364b0c
sub esi, 0x42
mov edi, ebp
xor esi, 0x7b
add edi, 0x41
or esi, 0xc3
sub esi, 0xf6
mov ecx, dword [edi]
add esi, 2
add esi, esi
mov edi, ebp
or esi, 0xae
add esi, ecx
sub esi, ebx
add edi, 0x9e
and esi, 0xee
mov esi, 0x400
xor esi, ecx
and esi, 0x7f
xor ecx, dword [edi]
mov esi, 1
mov edi, ebp
add edi, 0x26
or esi, 0xffff
xor esi, 0xffff
xor ecx, dword [edi]
sub esi, 0x92
sub esi, 0xd3
mov edi, ebp
sub esi, eax
and esi, 0xf
or esi, edi
xor esi, edi
add edi, 0x40
mov bl, byte [edi]
xor esi, 0x60
xor esi, 0x9e
xor esi, 0
xor esi, 0x80
xor bl, 0x6a
cmp bl, 1
jne 0x5208a1
add esi, 0xf
add esi, 0xf
movzx edx, cl
or esi, 0x1c
sub esi, 0xf
cmp bl, 2
jne 0x5208b6
movzx edx, cx
add esi, eax
mov esi, 0
add esi, eax
and esi, 0xf0
mov esi, 0x400
sub esi, 0x800
sub esi, 0x1c
and esi, 0x64
add ecx, edx
pushfd
and esi, 0xf
or esi, 0x40
mov edi, ebp
or esi, 0xee
and esi, 0xa9
mov esi, 1
add edi, 0x20
add esi, 0xd0
mov cl, byte [edi]
cmp cl, 0x4f
jbe 0x52095d
add esi, 0x800
add esi, 0xee
sub esi, 0x73
xor edx, 0x37364b0c
or esi, 0x6a
or esi, 0x80
mov esi, 0xa
xor esi, 0x4a
sub esi, ecx
mov edi, ebp
add esi, 0x40
mov esi, 0xa
add edi, 0x6f
mov dword [edi], edx
jmp 0x520989
and esi, 0xf0
xor esi, eax
and esi, 2
add edx, 0x3f9cd4bf
and esi, eax
and esi, 0x73
mov edi, ebp
add edi, 0x9e
mov dword [edi], edx
and esi, 0x92
mov esi, 0x400
xor esi, 0x4a
xor esi, edi
xor esi, 0x42
mov edi, ebp
or edx, 0x64
add edx, eax
add edi, 0xb7
and esi, ecx
mov cl, byte [edi]
xor cl, 0x77
sub esi, 0xc3
and esi, edx
xor edx, eax
mov esi, 0x400
and esi, 0xae
sub cl, 0x4a
cmp cl, 0
Function at 0x5209ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x520c0f
or edx, 0xc1
xor esi, ebx
xor edx, 0x78
xor edx, 0x1f
mov edi, ebp
xor esi, 0xd0
add edi, 0x63
or edx, edi
and esi, 0xa9
mov ebx, dword [edi]
and edx, 0x42
or edx, 0xd3
mov edi, ebp
and esi, 0xf
sub edx, 0x80
or esi, 0x9e
add esi, 0xc1
mov edx, 0x400
add edi, 0x26
or edx, esi
sub ebx, dword [edi]
mov edi, ebp
add edi, 0xb8
or esi, 0x1f
and edx, 0x4e
xor edx, eax
mov edx, 0x400
xor ebx, 0x37364b0c
xor edx, esi
sub esi, 0x7fffffff
and edx, 0x6a
mov edi, ebp
or esi, 5
xor edx, ecx
and edx, ecx
and esi, 0x73
add edi, 0x41
mov eax, dword [edi]
or esi, 0x92
and esi, 0x60
xor edx, 0xf6
mov edx, 0xa
mov edi, ebp
xor edx, 0xc3
sub edx, 0x6a
add edi, 0x9e
and edx, 0xf0
and edx, 0xffff
xor eax, dword [edi]
or esi, 0x7b
and esi, ebx
mov edi, ebp
add edi, 0x26
xor eax, dword [edi]
mov edi, ebp
add edx, 0x1c
and esi, ecx
add edi, 0xb6
sub esi, 0x800
add esi, 0xf
mov edx, 0xa
xor edx, 0
mov cl, byte [edi]
or edx, edx
xor esi, 0xf6
sub esi, 0x4a
xor cl, 0x1e
cmp cl, 1
jne 0x520b19
and bl, al
pushfd
mov edx, eax
sub edx, edx
and esi, 0x33
cmp cl, 2
jne 0x520b34
and bx, ax
pushfd
sub edx, 0xd3
add esi, edx
and esi, 0xffff
cmp cl, 3
jne 0x520b40
and ebx, eax
pushfd
add edx, eax
sub esi, ecx
mov edi, ebp
or esi, 4
add edi, 0x20
add edx, edx
add esi, 5
add edx, 0xf0
mov al, byte [edi]
cmp al, 0x4f
jbe 0x520bbb
add edx, 6
add esi, 0x92
or esi, 4
xor ebx, 0x37364b0c
and esi, edx
or edx, 0x9e
xor esi, 0xd0
and esi, 0x1c
or esi, 0xf
mov edi, ebp
add esi, 0x1c
xor edx, 0xee
add edi, 0x6f
mov dword [edi], ebx
jmp 0x520c01
and esi, 0x73
or esi, ecx
sub esi, 0x7f
add ebx, 0x3f9cd4bf
and esi, eax
and esi, 0xf9
add edx, 0x57
or edx, 0xd3
mov edi, ebp
xor edx, esi
sub edx, 0xc3
add esi, 0xd3
add edi, 0x9e
mov dword [edi], ebx
xor edx, eax
xor esi, edi
add esi, ecx
and edx, ecx
add edx, 0x42
and edx, 0x7f
and edi, 0x1e
and edi, 0xd0
invalid
out dx, eax
pop ds
Function at 0x52224e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub edx, 0x7fffffff
xor edx, ebx
add edi, 0x41
mov eax, dword [edi]
xor edx, 0x64
add edx, 0xa9
add esi, edi
mov edi, ebp
add esi, 0x7b
add edx, 0xc3
add edi, 0x9e
or edx, edx
sub edx, 0xc3
xor eax, dword [edi]
xor edx, 0x5d
mov edi, ebp
or esi, 0x1c
add edx, esi
add edi, 0x26
xor eax, dword [edi]
and edx, 0x1f
mov edi, ebp
sub edx, ecx
and esi, 6
or edx, 0x92
add edi, 0xb6
sub edx, edx
xor esi, 1
and edx, 1
xor esi, esi
mov cl, byte [edi]
mov esi, 0
and edx, 0x4e
or edx, 0xee
xor cl, 0x1e
cmp cl, 1
jne 0x5222fc
add bl, al
pushfd
or edx, 4
xor edx, 0x60
cmp cl, 2
jne 0x522309
add bx, ax
pushfd
cmp cl, 3
jne 0x52231b
add ebx, eax
pushfd
sub esi, 0xa9
and edx, ecx
xor edx, 0x400
xor edx, edi
or edx, 0xd0
mov edx, 0xa
mov edi, ebp
add esi, 0x33
xor esi, 0x4e
add edi, 0x20
add edx, 0xc1
mov al, byte [edi]
cmp al, 0x4f
jbe 0x522381
xor ebx, 0x37364b0c
mov esi, edx
xor edx, 0xfd
mov edi, ebp
sub edx, edx
and esi, edx
add edi, 0x6f
mov dword [edi], ebx
jmp 0x5223b2
add ebx, 0x3f9cd4bf
mov edx, 0x400
xor esi, 0xf6
mov edi, ebp
or edx, 0xfd
add edx, edx
xor esi, 0x80
add edi, 0x9e
xor esi, ebx
add esi, 0x94
mov dword [edi], ebx
xor edx, 0x6a
sub esi, ecx
xor edx, 1
or esi, 0x57
sub esi, 0x4e
and esi, 0xc1
or esi, 0x64
mov edi, ebp
and esi, 0x33
and esi, 0xae
add esi, 0xf
add esi, 2
add esi, 0xc1
add edi, 0xb7
xor esi, 0x28
mov bl, byte [edi]
and esi, 0xae
xor esi, 0x33
xor bl, 0x77
sub esi, 0x400
mov esi, 1
xor esi, 6
sub bl, 0x4e
cmp bl, 0
jne 0x5226c9
mov edi, ebp
sub esi, 0x40
add edi, 0x63
and esi, edi
mov eax, dword [edi]
and esi, eax
mov edi, ebp
add edi, 0x26
add esi, 0xae
sub eax, dword [edi]
sub esi, 0x71
add esi, 0x57
xor esi, 0x1c
and esi, esi
add esi, 0x5d
mov edi, ebp
add edi, 0xb8
sub esi, edx
and esi, 0xc1
add byte [eax], al
Function at 0x57770e
Capabilities:
Encode data using xor

Disassembly:
xor byte [esi - 0x62], al
add al, 0x15
inc ebp
test al, 0x91
pop ds
dec ecx
inc eax
test dword [0x6287ac5f], ebx
sbb al, byte [edi - 0x25a4dee6]
xchg dword [edx], ebx
and dword [ebx - 0x26], ebx
xchg dword [edx], ebx
and dword [ebx - 0x26], ebx
popfd
sbb eax, 0xba07b828
jle 0x57772e
jne 0x57772a
mov eax, dword [0xc02ba7f0]
and dword [edx + 0x7a], esi
fidiv dword [ebx - 4]
cmp byte [ebx - 0x70], al
invalid
nop
sbb ah, 0xa9
xor esi, dword [ebx - 0x21690653]
sbb byte [ecx], 0x10
inc ebx
push ebp
mov bh, 0xc3
inc ebp
test al, 0x49
and ebx, dword [esi - 0x64]
out 0x7f, eax
xchg ebx, eax
pop ebp
jecxz 0x57771e
cmpsd dword [esi], dword es:[edi]
in eax, dx
jae 0x5776fc
fmul qword [ebx - 0x47]
das
shr edi, 0xed
mov byte [0x6c0efa1a], al
push ss
xchg edx, eax
in al, 0xd2
dec ebp
dec esp
push eax
imul esp, dword [ecx - 0x44], 0x70b5d733
das
rcr byte [ecx], cl
add byte [edx - 0x6911e026], bl
adc byte [ebp + ebp*4 + 0x59dcaf6c], bl
dec esp
test dword [edx + 0x3c8e43a1], ecx
je 0x57779f
pop ss
mov edi, 0x9496d0a8
dec eax
sahf
mov ecx, 0x7f480255
inc edi
aaa
xchg edi, eax
mov bl, 0x4c
sub dword [0x2a59de28], 0xffffffd6
jge 0x57771b
test al, 0x8f
sbb byte [ecx + edi*4 + 0x32c7c2b4], bh
mov byte [edi], cl
hlt
ret 0x32c7
Function at 0x10073620
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10073804
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4a000]
push edi
or ebp, 0xffffffff
jmp 0x1007364a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10073651
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10073640
mov eax, 1
add ebx, ebx
jne 0x10073663
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10073674
jne 0x10073693
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10073693
dec eax
add ebx, ebx
jne 0x10073680
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10073658
add ebx, ebx
jne 0x1007368f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100736e5
xor ecx, ecx
sub eax, 3
jb 0x100736ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1007371a
sar eax, 1
mov ebp, eax
jmp 0x100736b6
add ebx, ebx
jne 0x100736b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10073684
inc ecx
add ebx, ebx
jne 0x100736c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10073684
add ebx, ebx
jne 0x100736d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100736c6
jne 0x100736e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100736c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10073704
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100736f6
jmp 0x10073646
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10073704
add edi, ecx
jmp 0x10073646
pop esi
mov edi, esi
mov ecx, 0x8ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10073722
cmp byte [edi], 9
jne 0x10073722
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10073727
lea edi, [esi + 0x6f000]
mov eax, dword [edi]
or eax, eax
je 0x10073796
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x731b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x73240]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10073754
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x73244]
or eax, eax
je 0x10073790
mov dword [ebx], eax
add ebx, 4
jmp 0x10073771
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100737c7
cmp al, 0xef
ja 0x100737ba
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1007379c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100737a9
mov ebp, dword [esi + 0x73248]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100737fb
sub esp, 0xffffff80
jmp 0x1004726c
Function at 0x4034f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0xb945c6c8
cmpsd dword [esi], dword es:[edi]
call fcn.0040325c
mov al, byte [0x8dd45604]
inc ebp
test al, 0x50
call fcn.0040326c
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403221
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40354a
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040325c
jns 0x40358d
mov ebp, 0xc0458d4c
push eax
call fcn.0040326c
push eax
push esi
push dword [ebp + 8]
call fcn.00403221
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0040325c
rcr byte [esi - 0x56], 1
lds ecx, [ebp + 0x5d88e845]
call 0xe99dbe1d
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040326c
push eax
push esi
push dword [ebp + 8]
call fcn.00403221
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040326c
push eax
push esi
push dword [ebp + 8]
call fcn.00403221
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040326c
push eax
push esi
push dword [ebp + 8]
call fcn.00403221
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040325c
jns 0x403669
fisubr word [esi - 0x836278]
invalid
Function at 0x4052cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x714]
push eax
call fcn.0040326c
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00403221
add esp, 0xc
mov dword [ebp - 0x37c], eax

Function at 0x4056c4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4056e0
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4056e3
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405712
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405756
test edi, edi
jne 0x40571d
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405750
Function at 0x401c35
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c74
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c74
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c74
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c74
cmp dword [ecx + 0x74], 0xe
jbe 0x401c74
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4077c3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407860
push ebx
push esi
call fcn.0040778c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407720
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40780d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40785f
push edi
push eax
call fcn.004083e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40782d
call fcn.00406281
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40785e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407720
add esp, 0x20
test eax, eax
jne 0x40784c
push edi
call fcn.00406281
jmp 0x407854
push ebx
call fcn.00406281
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408b5d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411070
push 0x411068
push str.FlsAlloc
push 0x1f
call fcn.00408a1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408b91
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f130]
call esi
jmp 0x408b97
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408bdb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411080
push 0x411078
push str.FlsGetValue
push 0x21
call fcn.00408a1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408c12
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408c1a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411088
push 0x411080
push str.FlsSetValue
push 0x22
call fcn.00408a1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408c54
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e0b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e0dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e0dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1259e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], esi
je 0x1260c
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x1c]
add ecx, edi
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x20]
add ecx, edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov ebx, esi
cmp dword [eax + 0x14], esi
jbe 0x1260b
mov eax, dword [ecx + ebx*4]
add eax, edi
push 0x115a8
push eax
call dword [0x16014]
pop ecx
test eax, eax
mov eax, dword [ebp - 4]
pop ecx
je 0x125f9
mov ecx, dword [ebp - 8]
inc ebx
cmp ebx, dword [eax + 0x14]
jb 0x125d4
jmp 0x1260b
mov eax, dword [eax + 0x24]
mov esi, dword [ebp - 0xc]
lea eax, [eax + ebx*2]
movzx eax, word [eax + edi]
mov esi, dword [esi + eax*4]
add esi, edi
pop ebx
call fcn.00013525
sub eax, dword [0x16040]
xor ecx, ecx
cmp eax, 0x7fff
cmova esi, ecx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x131ed
Capabilities:
Accept command line arguments
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x1123c
mov dword [ebp - 8], ecx
call edi
push eax
call dword [0x16008]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x13218
xor al, al
jmp 0x1327f
add esi, 0x2a
push 0x20
push esi
call dword [0x16004]
pop ecx
pop ecx
test eax, eax
jne 0x13237
push ecx
push 0x11268
call fcn.000124aa
jmp 0x13214
sub eax, esi
sar eax, 1
cmp eax, 2
jae 0x13251
push ecx
push 0x1127c
call fcn.000124aa
push ecx
call edi
push eax
jmp 0x13230
lea edi, [eax + eax]
push ebx
lea eax, [edi + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x13283
push ecx
push 0x11290
call fcn.000124aa
xor al, al
pop ebx
pop edi
pop esi
leave
ret
push edi
push esi
push ebx
call dword [0x16020]
add esp, 0xc
xor eax, eax
push ebx
mov word [edi + ebx], ax
xor ebx, ebx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x132c8
push ecx
push 0x112a4
call fcn.000124aa
push 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, 0x16048
call fcn.00012443
jmp 0x1327c
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
push ebx
push ebx
push 4
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x132e4
push ecx
push 0x112b8
jmp 0x132ae
push 0x20
push ebx
push dword [ebp - 8]
call dword [0x16020]
add esp, 0xc
call fcn.0001342c
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1327c
mov eax, dword [ebx + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, 0x18
mov edx, eax
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.000133db
test al, al
je 0x1327c
lea edx, [ebp - 4]
mov ecx, edi
call fcn.000133db
test al, al
je 0x1327c
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ebp - 8]
push 2
push dword [eax]
call esi
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x13359
push ecx
push 0x112cc
jmp 0x132ae
mov eax, dword [ebx + 0x24]
lea esi, [ebx + 0x28]
lea eax, [esi + eax*4]
mov dword [ebp - 0xc], eax
cmp esi, eax
je 0x13387
mov edx, dword [esi]
add edx, ecx
mov ecx, edi
call fcn.000133db
test al, al
je 0x1327c
mov ecx, dword [ebp - 8]
add esi, 4
cmp esi, dword [ebp - 0xc]
jne 0x13369
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1339f
push ecx
push 0x112e0
jmp 0x132ae
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call edi
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push ebx
call edi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x1327e
Function at 0x420730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d8b40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4207ec
cmp byte [esi + 0x3d], 0
je 0x4207ec
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4207da
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4207a1
sub eax, 1
je 0x4207a5
sub eax, 2
jne 0x4207da
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485bfe
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4207c3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4207da
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485bfe
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485bfe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00485bfe
mov esp, ebp
pop ebp
ret